thehackernews.com
We Built An Agent That Broke All of Our Security Rules. Here’s What We Learned.
Token created an AI browser agent named Rehearsal that intentionally violated its own security guidelines—no distinct identity, unrestricted access, and no traceability—to expose weaknesses in agent protection. The agent operated within users’ authenticated sessions, performing tasks like opening pages and filling forms, making its actions indistinguishable from human clicks. By analyzing this failure, Token identified gaps in current practices and highlighted the need for separate agent lanes, identity tagging, and scoped permissions. The company outlined how emerging [...]