We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
Summary: Token built a browser agent called Rehearsal that broke its own three rules for securing AI agents by default: it runs inside the user's authenticated session, and nothing in the session cookie identifies who is driving it, so the server cannot distinguish the agent's clicks from the user's. Token closed the gaps only because it wrote both the agent and the app, and it points to emerging lanes - Chrome auto-browse approval gates, Microsoft's per-site agentic browsing controls, the WebMCP draft from Google and Microsoft, and the Web Bot Auth IETF draft - none of which passes the agent's identity, the person it acts for, and a narrower scope to the application together.
Why it matters: A browser agent driving your CRM or cloud console arrives with the user's full reach and no way for the app to see it, so until agent identity, delegation, and task scope travel together, every agent borrowing a human session is privilege you have not scoped or audited.
Read the original at The Hacker News ↗