Token says browser agent Rehearsal broke its own identity rules
Original title: We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
The vendor says apps cannot see an agent inside a user session and lists controls to use before standards land.
Token describes Rehearsal, a browser agent that answers questions by opening pages, setting filters, and filling forms inside a user’s authenticated session on the Token platform. The company says the application then sees the user, not the agent, the delegation, or the task scope. Because Token owns both sides, it limited Rehearsal and recorded its actions. It argues outside agents in other apps lack those signals, and that drafts such as WebMCP and Web Bot Auth do not yet connect identity, delegation, and narrower scope.
- Rehearsal is kept to read-only dashboards and cannot save without user approval.
- Chrome auto-browse requires approval for payments or mass emails and limits sites.
- Microsoft lets admins enable agentic browsing per site and pause before secrets.
- Web Bot Auth, an IETF draft, names the agent but does not cover delegation.
- 1.Inventory browser agents and extensions that act through authenticated sessions and map them to users.
- 2.Require step-up authentication before sensitive or irreversible application actions.
- 3.Ask SaaS vendors whether audit logs distinguish agent activity from human activity.
From the original article
4 min read at thehackernews.com
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.