We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
- Published
- Record updated
Summary
Token built Rehearsal, a browser agent that runs inside a user's authenticated session and acts with the user's reach, and found that applications cannot tell the agent, its delegation or its task scope apart from the user. Because Token controls both the agent and the app, it can dim and lock the application, log every session move, and restrict Rehearsal to read-only dashboards that need user approval for saves. The article argues that broader fixes require agents to have their own lanes, pointing to browser controls, WebMCP tool declarations and Web Bot Auth request signing.
Mitigation
Token's steps for its own agent: while the agent moves, dim and lock the application and indicate who has control; record every move for each session, including blocked ones; reduce the agent's reach below the user's, keeping dashboards read-only, requiring user approval before saving, not filling secret fields, and never sending calls the platform refused. For the wider web, the source describes emerging standards (Chrome auto-browse approval and site limits, Microsoft per-site agentic browsing controls, the WebMCP draft, and Web Bot Auth) but does not state them as a complete fix.