AI Agents Operate in Browsers with Hidden Access

Chrome introduced an early preview of WebMCP in 2026.

Remote Debugging and the Chrome DevTools Protocol

One established route for AI agents to operate inside browsers is not new: the Chrome DevTools Protocol (CDP). Built to let developers inspect, debug, and automate Chromium-based browsers, CDP exposes navigation, page content, network activity, and simulated user interactions. Tools such as Playwright and Puppeteer have long used CDP — and AI agents now use the same channel to navigate sites, extract information, fill forms, and interact with authenticated web applications.

The practical security implication is straightforward and sharp: an external application that connects to a browser with debugging enabled can act with whatever authenticated sessions are present in that browser. To conventional security tooling, “a browser launched with debugging enabled and signed into corporate applications looks like any other authenticated browser session.” That parity hides whether a human or software is driving the tab.

Keep Aware’s framing for defenders: ask which applications can launch or connect to debuggable browsers, whether policies permit that, and which corporate sessions those applications can access.

AI Extensions, Agentic Browsers, and permissions

A second approach places the agent inside the browser itself. Browser extensions such as Claude in Chrome can read pages, switch tabs, click buttons, and complete multistep workflows; doing so requires powerful permissions — scripting, tab access, and use of the debugger API. Agentic browsers like Perplexity Comet and ChatGPT Desktop integrate AI into the browsing experience more deeply, in ways that “aren’t necessarily governed by extension permissions,” so familiar extension controls may not apply.

Two risks stand out in the Keep Aware account. First, agents act with the user’s identity: when an agent downloads a document or changes an internal setting, the application records an authenticated user performing an authorized action. Without extra telemetry, neither the application nor its audit logs may distinguish agent-driven actions from employee actions. Second, agents treat page content as direct input, creating prompt-injection risks when websites, documents, or emails contain instructions that aim to redirect the agent’s behavior. In short, software is interpreting untrusted content while operating with trusted permissions.

WebMCP: websites exposing tools directly to agents

WebMCP, an emerging web standard developed through the W3C Web Machine Learning Community Group with contributions from Google and Microsoft, changes the interaction model again. Rather than simulating clicks and parsing pages, agents can call structured tools that websites expose directly — for example, invoking a ticket-creation tool instead of navigating a support portal and filling a form. Chrome offered an early preview of WebMCP in 2026 as the specification continued to evolve.

That convenience brings a distinct trust problem: tool names, descriptions, and input schemas are authored by the website and “shouldn’t be treated as trusted instructions.” A compromised or malicious site could mislabel functionality or steer agents toward unwanted actions. Each tool runs in the site’s security context, but agents operating across multiple sites can move information between those contexts. The question becomes not only what a tool does, but what data the agent supplies when it calls that tool.

What this means for security teams, application owners, and standards groups

• Security teams: inventory which applications and processes can launch debuggable browsers and whether policies allow those connections; discover which AI-enabled browsers and extensions exist across the fleet; and consider what additional telemetry is required to separate agent actions from human activity.
• Application owners and procurement leaders: determine which AI extensions and agentic browsers are permitted, what access they have inside authenticated sessions, and whether existing extension controls can govern them — remembering that some agentic browsers bypass extension models entirely.
• Standards bodies and website operators (W3C contributors, Google, Microsoft): recognize the “new trust problem” WebMCP introduces. Because tool names, descriptions, and input schemas guide agent behavior, those definitions are a vector for influence and should be designed and reviewed with that risk in mind.

Browser security’s practical conclusion

All three approaches share a single, consequential fact: software can act on websites with access tied to a user’s browser session. Endpoint, network, and application controls remain necessary, but they were built to observe processes, traffic, and logins — not to see what an agent reads, decides, and does inside an authenticated tab. As Keep Aware summarizes, “browser security can’t assume a human is behind every click anymore.”

The goal articulated in the source is not to halt employee use of AI agents but to ensure the controls you expect in the browser continue to apply when an agent operates it. For defenders that means discovery, tighter policy on debuggable browsers and powerful extensions, and new telemetry or controls that can enforce data protection policies before sensitive information leaves the tab.

Source: 3 Ways AI Agents Already Operate in Your Browser — BleepingComputer