{"id":4110,"date":"2026-11-11T12:45:04","date_gmt":"2026-11-11T12:45:04","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4110"},"modified":"2026-11-11T12:45:04","modified_gmt":"2026-11-11T12:45:04","slug":"we-built-an-agent-that-broke-all-of-our-security-rules-heres-what-we-learned","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4110","title":{"rendered":"We Built An Agent That Broke All of Our Security Rules. Here’s What We Learned."},"content":{"rendered":"
\n
<\/a><\/div>\n

We tell customers three things about securing AI agents: they need their own identities, access that fits the job they\u2019re given, and traceability that\u2019s separate from any human\u2019s. That was true for us at Token as well. Then, we built an agent that broke all three by default.<\/p>\n

This helped us think through how such agents should be defended. When a browser agent acts inside a user\u2019s authenticated session, the application may see the user but not the agent, the delegation, or the task\u2019s intended scope. By creating an agent that breaks all the security rules, Token learned how companies should be using identity to gain control, especially as agent use scales. Standards are coming, but there are steps security teams can take today.<\/p>\n

The agent we would have flagged<\/strong><\/h2>\n

The agent we created is named Rehearsal<\/a>. Its job is to answer questions inside the Token platform by doing rather than telling. It autonomously opens pages in the browser tab, sets filters, and fills in forms.<\/p>\n

From a security perspective, it\u2019s a typical UI agent that runs in the user\u2019s browser. That\u2019s what makes it useful. But it also means the agent runs within the user\u2019s session and has their reach.<\/p>\n

Moreover, to the server behind the page, the agent\u2019s clicks are inherently indistinguishable from the user\u2019s, because nothing in a session cookie points to who the session driver is.<\/p>\n

What controlling both sides made possible<\/strong><\/h2>\n

Because Token owns both the agent and the app it runs, we can close each gap from the inside. For example, Token knows who\u2019s driving the session because Rehearsal tells it who is.<\/p>\n

<\/p>\n

We learned that there are multiple best practices that you can apply when you control the AI agent itself:<\/p>\n