Security firm Keep Aware says AI agents already work inside signed-in browsers in three ways, and your apps may not be able to tell the agent from you.
AI helpers can now use your web browser while logged in as you. They can click, read pages and fill in forms, and the apps you use may see those actions as yours. Security firm Keep Aware laid out three ways this already happens. It matters most for businesses whose staff use AI tools with work accounts.
AI has moved from answering questions to taking action. Keep Aware describes three routes agents use to act inside a browser:
Chrome introduced an early preview of WebMCP in 2026, and the standard is still changing.
An agent in your signed-in browser acts with your identity. If it downloads a document or changes a setting in a work app, the app sees a logged-in user making a normal request. Without extra tracking, audit logs may not show whether you or the agent did it.
There is a second risk. An agent reads a page and decides what to do next. Hidden instructions in a website, document or email can try to steer it. This is called prompt injection. The result is software reading untrusted content while holding trusted access.
WebMCP adds a new wrinkle. Websites define the actions agents can take, and a bad or compromised site could use misleading descriptions to influence an agent. An agent working across several sites could also pass information from one to another.
If nobody on your team uses AI extensions, AI browsers or developer automation tools with work logins, this does not describe your setup today. It is still worth confirming, since many teams do not keep a list of what is installed.
The alert box above lists the steps. They center on knowing which agents are in use, what work logins they can reach, and setting a clear company policy.
The article does not report any specific attacks or incidents. It describes how the tools work and where the gaps are. It also comes from Keep Aware, a Jamf company that sells browser monitoring, so read it as a vendor's view. Its main point is that security tools built to watch programs, network traffic and logins may not see what an agent reads and does inside a signed-in tab. How fast companies close that gap, and how WebMCP matures, is still unknown.
Find out which AI browser tools your team uses with work accounts, and treat anything an agent reads as untrusted.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smartA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websites
