Token, a security company, created an AI agent named Rehearsal that violated all of their standard security guidelines—forcing them to rethink how they design, monitor, and control agents. Conventional advice to give agents distinct identities, scoped permissions, and separate audit trails proved meaningless when Rehearsal ran entirely inside a user’s browser session, gaining full access to whatever the user could do. This unexpected setup exposed three major gaps in AI agent defense.
A browser agent with too much power
Rehearsal is a browser agent built to operate on behalf of a user in Token’s platform. It automatically navigates the interface, applies filters, fills forms, and clicks through the dashboard. The fact that it runs within the authenticated user session means that on the server side it looks just like any human user—session cookies offer no way for the app to know whether a human or the agent is driving interactions. That means no built-in traceability of the agent’s identity, scope or intent.
By building the app and agent itself, Token found levers to correct these problems. Rehearsal reports who’s actually controlling the session, and the platform locks or dims the UI when the agent is active to make that visible. It also records every action—successful or blocked—so there’s a full audit trail. Permissions are constrained compared to users: although Rehearsal can read dashboards, it’s prevented from saving certain changes, filling secret fields, sending denied API calls, or accessing destructive functionality without approval.
Standards and tools trying to close the gap
Token points to emerging browser- and web-standards that can begin exposing agent identity, scope, and connectedness. For example, tools like WebMCP let applications expose agent actions as explicit tools, marked with attributes like read-only or consequential. Initiatives like Web Bot Auth draft a way for apps to verify which agent issued a request. Meanwhile, browsers are starting to mark when an agent is driving: requiring human approval for high-risk actions, limiting what agents can see or enter (e.g. passwords, payments), and adding agent-generated activity to user history.
Yet Token argues that these pieces remain disjoint. None fully ensure that agent identity, task scope, and human delegation are present together—each is covered in some contexts, but linking all three into a dependable, action-level decision for authorization still lacks maturity.
Concrete defenses while standards mature
Token urges security teams not to wait until new protocols are finalized. There are steps organizations can take now to reduce risk:
- Keep an inventory of agentic browsers, extensions, and other tools that act through authenticated sessions, mapping them to users and owners.
- Ensure every agent’s identity is traced: who created it, who owns it, and which users (or other agents) use it.
- Audit what each agent identity has access to, especially sensitive controls or data.
- Identify how agents might create attack vectors—especially to bypass access controls by acting like human sessions.
- Require explicit confirmation or step-up authentication for actions that are irreversible or sensitive.
- Ask vendors if their logs distinguish between human and agent activity, and whether they support task-scoped delegation.
- Treat every agent using a human session as a delegated identity that must be constrained, audited, and treated cautiously.
AI agents are being adopted fast—often faster than the standards and frameworks meant to guide them. When standards like WebMCP or Web Bot Auth gain traction, companies will need them. But in the meantime, Rehearsal’s experiment shows that agents running entirely under human sessions break key security assumptions. Organizations must build inventories, enforce constraint, require accountability, and demand that vendors do the same—before agents make major breaches all too easy.
