"We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s," wrote engineers at Token after building an agent that violated all three rules. The result is a concrete lesson in what happens when browser agents inherit a human session without a distinct identity, scope, or delegation record.
Rehearsal, Token's browser agent that ran in a user's session
Token built an agent named Rehearsal whose job is "to answer questions inside the Token platform by doing rather than telling." Rehearsal autonomously opens pages in a browser tab, sets filters, and fills in forms. Because it runs in the user's browser, it inherits the user's authenticated session and, to the server, appears identical to the user. Token notes the technical reason plainly: "nothing in a session cookie points to who the session driver is." That indistinguishability is the core risk the team set out to explore.
How Token closed gaps when it controlled both agent and app
Owning both the agent and the application let Token implement mitigations that are not available when an external agent drives a third-party app. They applied simple-but-specific controls: while the agent moves, dim and lock the application and clearly indicate who has control; record every move for each session, including blocked actions; and deliberately reduce the agent's reach below the user's.
For Rehearsal, reducing reach meant making dashboards read-only, preventing saves without explicit user approval, never filling secret fields, refusing to issue calls the platform itself had blocked, and relying on page accessibility labels to understand controls. Those constraints work only because Token can embed them into both sides of the interaction.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleBrowser features, WebMCP, and Web Bot Auth: three lanes that don't yet connect
Token maps current technical efforts into three lanes—and shows why each alone is insufficient. Browsers have started to mark agent-driven activity: Chrome auto-browse already requires a person’s approval before high-stakes actions such as payments or mass emails, limits the agent to the sites a task requires, and tags pages the agent visits in the user's history. Microsoft exposes admin controls to turn agentic browsing on per site and to pause before passwords and card numbers are entered.
Separately, WebMCP—a draft Google and Microsoft are writing in a W3C community group—lets a site expose actions as tools and mark them read-only or consequential so agents don't have to guess what a button does. And Web Bot Auth, an IETF working group draft, provides a way for a site to verify which agent sent a request.
Token's diagnosis: "Each lane knows something the others don’t, and none of them passes it on." The browser can signal an agent is driving but not tell the app; a WebMCP tool still runs inside the user's session and carries the user's rights; Web Bot Auth can name the agent but "doesn't cover delegation" and therefore omits the person the agent acts for.
Practical steps security teams can take before standards arrive
- Inventory browser agents, agentic extensions, and endpoint agents that can act through authenticated sessions—and map them to users and owners.
- Trace every AI agent consumer so you know which people and which other agents are using each agent.
- Review every identity that each individual agent has access to, and identify potential attack paths that use agents to bypass access controls.
- Require explicit approval or step-up authentication (for example, a passkey prompt) before sensitive or irreversible application actions.
- Ask critical SaaS vendors whether their audit records distinguish agent activity from human activity and whether they support task-scoped delegation.
Token emphasizes that waiting for standardization is not an option: companies must discover agentic browsers and extensions quickly and treat every agent using a human session as delegated access that needs discovery, constraints, and auditability.
What this means for technologists, SaaS vendors, and end users
- Technologists and security teams: discover and map agents to users, instrument step-up checks for sensitive clicks, and model agent-to-agent interactions to find bypass paths.
- SaaS vendors and procurement leaders: prepare to answer whether audit logs separate agent and human activity and whether the platform will accept task-scoped delegation such as WebMCP-style tools.
- End users: expect agentic browsing to be visible in the UI (for example, a dimmed, locked page and a control indicator) and to require explicit approvals for high-risk operations.
Token's experiment makes one practical demand clear: for safe agent use at scale, every lane must carry three signals together—the agent's identity, a verifiable link to the person it acts for, and a scope narrower than that person's rights. Until browsers and applications can transmit those signals together, the faster lanes being built for agents risk becoming faster paths to misuse. In the meantime, discover, constrain, and audit.
