Token, a security-focused platform, set out to test the practical limits of AI agent security by building an agent that intentionally broke the three rules the company normally recommends to customers.
The agent, named Rehearsal, answers questions inside the Token platform by autonomously opening pages, setting filters, and filling forms within the user's browser tab. Because it operates inside an authenticated user session, backend servers see only the user's identity and cannot distinguish the agent, its delegation chain, or the intended task scope.
Token's dual ownership of both the agent and the application allowed the company to close several gaps internally. The platform receives explicit signals from Rehearsal about who is driving the session. The interface dims and locks during agent activity, every action is recorded, and the agent's reach is deliberately reduced to read-only dashboards. Rehearsal cannot save changes, access secret fields, or execute refused calls without explicit user approval.
These mitigations work only because Rehearsal was built by the same team that maintains the application. External agents driving third-party CRMs or cloud consoles receive none of this context. The session cookie carries only the human user's identity, leaving applications unable to apply appropriate authorization decisions.
Emerging standards aim to address these shortcomings. WebMCP, a draft from Google and Microsoft in a W3C community group, lets sites expose actions as callable tools and flag them as read-only or consequential. Web Bot Auth, an IETF working group draft, enables sites to verify which agent issued a request. Chrome and Microsoft Edge already implement some agent-specific restrictions, such as requiring user approval for high-risk actions and limiting sites an agent may visit.
However, the standards remain fragmented. None yet combines agent identity, verifiable delegation to a human principal, and task-scoped permissions into a single signal that applications can use for authorization. Security teams are therefore urged to start discovering agentic browsers and extensions, mapping them to users, tracing consumer agents, and requiring step-up authentication before sensitive operations.
