As reported by The Hacker News, identity security firm Token built an internal browser agent called Rehearsal that inadvertently exposed a structural flaw in how modern web applications handle AI-driven automation: when an agent operates within a user's authenticated browser session, the server cannot distinguish between human and machine actions. This isn't a vulnerability in the traditional sense — it's an architectural blind spot that the industry has been quietly ignoring as AI agents proliferate across enterprise environments.

AI Security Alert: As reported by The Hacker News, identity security firm Token built an internal browser agent called Rehearsal that inadvertently exposed a structural flaw in how modern web applications handle AI-driven automation: when an agent operates within a user's authenticated browser session, the server cannot distinguish between human and machine actions.

The core problem is one of identity delegation. Session cookies carry the user's identity, not the actor's. When Rehearsal clicks, filters, or fills forms, the application sees only the authenticated human. There is no protocol-level signal that says "an agent is driving this session," no scope declaration that says "this agent may only read dashboards," and no audit trail that separates agent actions from user actions. For security teams, this should set off immediate alarm bells.

Why This Matters Beyond Token

Token had the luxury of controlling both sides — the agent and the application — so they could implement internal controls: dimming the UI during agent control, enforcing read-only modes, blocking secret fields, and recording every action. But as Token themselves acknowledge, a third-party browser agent driving your CRM, cloud console, or financial platform has none of those guardrails. The application cannot detect the agent. The agent cannot detect which fields are sensitive. Neither side has a shared vocabulary for delegation, scope, or intent.

This is the AI agent equivalent of running a service account with domain admin privileges and no logging — except the account isn't even a separate identity. It's wearing the user's face.

The Three Gaps Defenders Must Close

Token's framework — agent identity, scoped access, and independent traceability — is a sound starting point. But most organizations don't control the agents their employees are deploying. Browser agents from startups, open-source projects, and LLM providers are already being used in production environments, often without security team awareness.

The Three Gaps Defenders Must Close
Identity attribution: Every agent action must be attributable to a non-human principal. If your application can't distinguish an agent click from a user click, you've lost the audit trail. Consider implementing secondary authentication signals, client headers, or agent registration flows that tag sessions with an actor type.
Scope enforcement: Agents should never inherit the full reach of the human user. Token's approach — read-only by default, no secret field interaction, human approval for writes — should be the baseline, not the exception. For third-party agents you don't control, this means enforcing least privilege at the application layer, since you can't enforce it at the agent layer.
Traceability separation: Audit logs must distinguish agent-initiated actions from human-initiated ones. If your SIEM can't answer "did a human or an agent perform this action," you cannot investigate incidents involving automation, and you cannot detect agent drift or compromise.

Who Is Most at Risk

Organizations with high-value browser sessions — SaaS admin consoles, cloud management platforms, financial systems, and healthcare EHRs — are the most exposed. The risk compounds in environments where users have broad standing access and where session hijacking or agent misconfiguration could lead to data exfiltration, unauthorized configuration changes, or destructive actions. Mid-market companies adopting AI agents without dedicated security review are particularly vulnerable, as are regulated industries where audit trail integrity is a compliance requirement.

Shield53 Recommendations

  • Inventory agent usage now. Survey your workforce for browser-based AI agents, automation extensions, and LLM-driven tools accessing production systems. You cannot defend what you haven't catalogued.
  • Implement session-level actor tagging. Where you control the application, add metadata to session tokens or headers that identify when a non-human actor is driving the session. Even a custom header like X-Agent-Actor: rehearsal-bot is better than no signal.
  • Enforce least privilege at the application layer. Since you likely can't control third-party agents, reduce the blast radius of compromised or misconfigured agents by tightening human session permissions. JIT access, time-bound elevation, and read-only default roles all limit what an agent can do when it inherits a user's session.
  • Build detection for anomalous session behavior. Agent-driven sessions often exhibit distinctive patterns — rapid page transitions, uniform click timing, access to pages the user rarely visits. Behavioral analytics can flag sessions that look automated even when the identity layer can't.
  • Track emerging standards. OAuth for agents, delegated authorization frameworks, and agent identity protocols are evolving. Assign someone to monitor these standards and pilot them before they become compliance requirements.
  • Establish an agent governance policy. Define who can deploy agents, which applications they may interact with, what approval is required, and what logging must be in place. Treat agents like service accounts — because functionally, that's what they are.

The industry is moving toward agent-specific identity and delegation standards, but waiting for standards is not a strategy. The agents are already in your environment. The question is whether you can see them — and whether you can stop them when they go wrong.