Vendor builds browser agent that breaks its own security rules

A security vendor has published an account of building an AI agent that violated all three of the controls it normally tells customers to apply. In a post dated 11 November 2026, Token described constructing a browser agent in-house and finding that, by default, it broke each of the firm's own rules for securing agents.

The company said it tells customers three things about securing AI agents: that agents need their own identities, that their access should fit the job they are given, and that their activity should be traceable separately from any human's. Token said this advice applied to the company itself as well as to its customers. The agent it built, the firm said, broke all three by default.

The root of the problem, according to Token, is the way a browser agent operates. When such an agent acts inside a user's authenticated session, it is working through credentials that already belong to a person. That means it does not have a distinct identity of its own. It also inherits whatever access that person holds, rather than the narrower set of permissions matched to the task it has been asked to carry out. And because the actions appear under the user's session, the trail left behind is not cleanly separable from the human's own activity.

The company framed the exercise as a learning one. Building the agent, it said, helped it think through how agents of this kind should be defended. That framing matters because browser agents are a common pattern: rather than calling an application programming interface with its own credentials, the agent drives a browser that is already logged in as the user, which is often the quickest way to get an agent working against systems that were never designed for machine callers.

Token's three principles map onto long-standing identity practice. Giving an agent its own identity means it can be enrolled, authenticated and revoked independently of the person who deployed it. Scoping access to the job means that if the agent is compromised or misled, the blast radius is limited to the task rather than the full extent of the user's rights. Separate traceability means that, after an incident, an investigator can tell which actions were taken by a human and which by software. A browser agent riding on a user's session defeats all three at once.

The published account does not describe a breach, an exploited flaw or an affected customer. It is a vendor write-up of an internal build and the lessons the company drew from it. Token did not, in the material published, set out a complete remedy or claim that the problem was unique to its own implementation.

The post is notable mainly because it comes from a firm that sells identity controls and is describing the gap between its own advice and the behaviour of a tool it built. Organisations deploying browser agents face the same structural issue: the convenience of reusing an existing authenticated session is also what strips the agent of a separate identity, scoped access and an independent audit trail.