Analysis
We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
First reported thehackernews.com
Page published
Earliest dated coverage: 11 Nov 2026 · First observed: 11 Nov 2026 · Latest dated coverage: 11 Nov 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Browser agents using human sessions can undermine least-privilege enforcement and accountability when applications cannot identify the agent or the intended scope of its task.
Token discusses identity-security lessons from building its Rehearsal agent. The excerpt highlights how browser agents operating within a user's authenticated session can lack distinct identities, task-scoped access, and separate audit trails, leaving applications unable to distinguish human activity from delegated agent actions.