{
  "id": 19491485,
  "title": "We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.",
  "url": "https://urgent.news/2026/11/11/we-built-an-agent-that-broke-all-of-our-security-rules-heres-what-we",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-11T12:01:59.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/we-built-agent-that-broke-all-of-our.html"
  },
  "original_language": "en",
  "account": "Token AI company built an agent named Rehearsal that broke their security rules by default. Initially, they told customers that AI agents needed their own unique identities, job-specific access, and traceability separate from human identities. Rehearsal proved this by acting within a user's authenticated session without revealing its own existence or purpose.\n\nThis experience taught Token how to defend against such agents. In a user's authenticated session, the application sees the user but not the agent, the delegation, or the task's intended scope. To address this, Token suggests giving AI agents their own lanes, separate from human users. Web browsers can mark when an agent is driving and restrict itself accordingly, while applications can publish actions as tools for agents to call.\n\nWebMCP, a draft by Google and Microsoft, and Web Bot Auth, an IETF working group draft, offer potential solutions. However, none of these standards yet cover delegation, which is crucial for AI agents. Until this gap is filled, companies should treat AI agents as delegated access that must be discovered, constrained, and audited.",
  "summary": "We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default. This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated",
  "key_points": [
    "Token AI built agent Rehearsal that bypassed security rules",
    "Rehearsal acted within user's authenticated session without revealing itself",
    "Token suggests AI agents need separate lanes and stricter delegation"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}