A security team built a browser AI helper and found it broke its own rules, because it borrows the user's full access. Here is what that means for any business.
Token, a company that advises customers on securing AI agents, built its own browser helper and found it broke all three of its own security rules by default. The helper, called Rehearsal, works inside a person's logged-in browser. That means it carries everything that person can do.
Rehearsal answers questions inside the Token platform by doing the work instead of explaining it. It opens pages in the browser tab, sets filters and fills in forms. Token's usual advice is that an AI agent needs its own identity, access that fits its job, and a record of its actions kept apart from any human's. A helper that runs inside a user's session does none of that on its own.
When an AI helper acts inside your logged-in session, the app usually sees only you. It does not see the agent, who sent it, or what the task was meant to cover. Token could fix this for Rehearsal because it built both the agent and the app. An outside agent working in a customer database or a cloud console gives the app no such clues. The agent also cannot tell which field holds a secret or which button deletes a record.
Some safeguards already exist in pieces:
The gap is that these pieces do not pass information to each other. Web Bot Auth names the agent but not the person it works for. A WebMCP tool still runs with the user's full rights. Token argues every agent lane should carry the agent's identity, a verifiable link to the person, and a scope narrower than that person's. The article notes that agents are arriving faster than the standards.
Waiting is not an option, according to Token. Companies should find agentic browsers and extensions in use, including whose sessions they borrow. An app cannot tell who clicked, but it can decide which clicks need a person. A passkey prompt, a login check done on your own device, can be added before risky actions.
Until browsers and apps can carry all three signals, every agent using a human session should be treated as delegated access: found, limited and audited.
If staff use AI browser tools, treat them as borrowed access: find them, limit what they can do, and require a passkey check for risky actions.
Google DeepMind used AI agents to mathematically prove that the core code behind Signal's private messaging does what its designers intended, in four weeks.
Read more: AI checks Signal's encryption code with mathematical proofMicrosoft researchers hid a backdoor in an AI model by editing fewer than 10 of its neurons. Businesses running their own AI agents should check where their models come from.
Read more: Microsoft shows an AI helper can be secretly rigged with a tiny editSome US power companies now use Anthropic's Mythos AI to find weak spots in their systems, which could mean fewer hacker-caused outages for homes and businesses.
Read more: Some power companies now use Anthropic's AI to find security holes
