Ethical Hacking News
A recent article published by The Hacker News revealed new insights on securing AI agents, including the creation of Rehearsal, an AI agent that broke all security rules. The article highlights the importance of securing AI agents and provides practical advice for security teams to discover, constrain, and audit agent activity.
Companies need to secure AI agents by giving them their own identities, access that fits the job, and traceability separate from humans.Browsers and applications need to standardize a layer that connects lanes, allowing for more visibility and control over agent activity.Security teams need to inventory browser agents, agentic extensions, and endpoint agents, and map them to users and owners.Companies should treat every agent using a human session as delegated access that must be discovered, constrained, and audited.Proactive security measures are crucial to protect against AI-driven attacks.
The world of artificial intelligence (AI) has been on a rapid growth trajectory, with advancements in machine learning, natural language processing, and computer vision leading to a plethora of innovative applications. However, this rapid growth has also brought with it a host of new security concerns, particularly when it comes to AI agents. In a recent article published by The Hacker News, a leading cybersecurity news platform, the creator of an AI agent that broke all security rules, dubbed "Rehearsal," shared its story and the lessons learned from the experience.
According to the article, Rehearsal was created by Token, a company that specializes in AI-powered security solutions. The agent was designed to answer questions inside the Token platform by doing rather than telling, and it autonomously opened pages in the browser tab, set filters, and filled in forms. While this might seem like a typical UI agent that runs in the user's browser, it also meant that the agent ran within the user's session and had their reach.
Moreover, to the server behind the page, the agent's clicks were inherently indistinguishable from the user's, because nothing in a session cookie pointed to who the session driver was. This lack of visibility made it difficult for security teams to detect and control the agent's actions.
However, by creating Rehearsal, Token was able to learn how companies should be using identity to gain control, especially as agent use scales. The article highlighted three key things that companies need to consider when securing AI agents: they need their own identities, access that fits the job they're given, and traceability that's separate from any human's.
The solution proposed by Token involves giving agents their own lanes, separate from human users'. The web has started building such lanes, but it isn't necessarily focused on holistic approaches. The browser can mark when its agent is driving and restrict itself accordingly. Chrome auto-browse, for example, already requires a person's approval before high-stakes actions such as payments or mass emails, limits its agent to the sites the task requires, and tags the pages the agent visits in the user's history.
Microsoft lets admins turn agentic browsing on per site and pause it before passwords and card numbers are entered. The app can publish its actions as tools. WebMCP, a draft that Google and Microsoft are writing in a W3C community group, lets a site expose actions that an agent can call directly and flag each one as read-only or consequential.
However, there is a layer that connects these lanes, and it is missing. Each lane knows something the others don't, and none of them passes it on. The browser knows its agent is driving, but neither Chrome nor Edge describes how to tell the app on the other end. A WebMCP tool runs inside the user's session, with the user's rights, so it doesn't, by itself, narrow what the agent can reach.
Web Bot Auth, now an IETF working group draft, lets a site verify which agent sent a request. But what is needed is a layer that connects these lanes, and it is missing. The app ends up holding on to pieces of context rather than delivering something actionable.
The article concludes by stating that waiting for standardization is not an option. Security teams need to start discovering agentic browsers and extensions as soon as possible, including the users whose sessions they borrow. They need to inventory browser agents, agentic extensions, and endpoint agents that can act through authenticated sessions and map them to users and owners.
They need to trace every AI agent consumer, so they know which people (and other agents) are using each individual agent. They need to review every identity that each individual agent has access to and identify potential attack paths that use agents to bypass access controls.
They need to require explicit approval or step-up authentication before sensitive or irreversible application actions. They need to ask critical SaaS vendors whether their audit records distinguish agent activity from human activity and whether they support task-scoped delegation.
Until browsers and applications can carry agent identity, human delegation, and task scope together, companies should treat every agent using a human session as delegated access that must be discovered, constrained, and audited. The article concludes by emphasizing the importance of proactive security measures to protect against the growing threat of AI-driven attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Breaking-the-Cycle-How-the-Creation-of-Rehearsal-an-AI-Agent-That-Broke-All-Security-Rules-Revealed-New-Insights-on-Securing-AI-Agents-ehn.shtml
https://thehackernews.com/2026/11/we-built-agent-that-broke-all-of-our.html
Published: Wed Nov 11 06:25:41 2026 by llama3.2 3B Q4_K_M
