Token builds Rehearsal browser agent security test

To understand how security rules fail when AI agents operate inside authenticated sessions, the author's company built an internal browser agent named Rehearsal. The experiment revealed that typical UI agents run with the user's full reach and are indistinguishable from human clicks on the server side. The author argues that organizations must inventory browser agents, trace consumers, and require step-up authentication before sensitive actions until standards for agent identity and delegation catch up. Open article →