AI agents can already operate inside authenticated employee browsers, but many security teams cannot tell whether a browser action was performed by a person or by software acting on that person’s behalf. Agents can access browsers through remote debugging interfaces, browser extensions, dedicated agent browsers, and emerging standards such as WebMCP. Each method changes what the agent can access, how it acts, and whether existing security controls can detect it.
As AI moves from answering questions to taking actions, organizations need visibility into which agents are running in their browsers, what permissions they have, and what data they can access.
1. Remote debugging lets applications control the browser
One way AI agents interact with browsers is through the Chrome DevTools Protocol (CDP), a technology that predates the current wave of AI tools.
CDP was designed to help developers inspect, debug, and automate Chromium-based browsers. It provides programmatic access to navigation, page content, network activity, and user interactions. Tools such as Playwright and Puppeteer have used CDP for years, and AI agents can use the same approach to navigate websites, extract information, fill out forms, and interact with web applications.
The automation does not have to run inside the browser itself. External applications can connect to a browser with debugging enabled and control its open tabs. If the browser already has an authenticated session, the automation may be able to use that access.
To many security tools, a browser launched with debugging enabled and signed in to a corporate application looks like any other authenticated browser session.
Security teams should ask which applications can launch or connect to a debuggable browser, whether organizational policy allows that activity, and which corporate sessions those applications can access.
2. AI extensions and agent browsers
A second approach places the AI agent directly inside the browser.
Extensions such as Claude for Chrome can read pages, switch tabs, click buttons, and complete multistep workflows. To do this, they may require powerful permissions, including scripting, tab access, and debugger APIs. Those permissions enable the extension’s features while also expanding the data and browser activity it can access.
Agent browsers such as Perplexity Comet and ChatGPT Desktop take the concept further by integrating AI directly into the browsing experience. Because these capabilities are not necessarily governed by browser-extension permissions, existing extension controls may not apply.
Without an inventory of browsers and extensions across the organization, security teams may not know which agents are running. Two risks are particularly important.
The agent operates under the user’s identity
When an agent downloads a document or changes settings in an internal application, that application sees an authenticated user making an authorized request.
Without additional telemetry, neither the application nor its audit logs may be able to distinguish an agent’s actions from those of the employee.
The agent treats web content as input
A browser displays pages that a person can interpret. An agent reads that content and decides what to do next. This creates a risk of prompt injection, in which instructions embedded in a website, document, or email attempt to redirect the agent’s behavior.
As a result, software may interpret untrusted content while operating with trusted permissions.
Security teams should ask which AI extensions and agent browsers are running across their fleet, what access they have, and whether their actions can be distinguished from employee activity. Learn more about monitoring generative AI activity.
Once an AI agent is operating inside an authenticated tab, endpoint and network tools may not be able to determine what the agent is reading or executing.
Keep Aware monitors AI activity within the browser and enforces data protection policies before sensitive data leaves the tab.
3. WebMCP lets websites expose tools directly to agents
The third approach changes how websites and agents interact.
WebMCP is an emerging web standard developed through the W3C Web Machine Learning Community Group in collaboration with Google and Microsoft. Instead of interpreting pages and simulating clicks, agents can invoke structured tools exposed directly by websites.
For example, an agent could call a tool to create a support ticket rather than opening a support portal and filling out a form. Chrome introduced an early preview in 2026, and the specification continues to evolve.
However, WebMCP also creates new reliability and security concerns. A website does more than provide content: it defines the actions agents can perform.
The tool’s name, description, and input schema guide what an agent calls. Because those definitions come from websites, they should not automatically be treated as reliable instructions. A compromised or malicious site could use misleading descriptions or features to influence an agent’s behavior.
Each tool operates within a website’s security context, but an agent working across multiple sites may move information between them. The concern is not only what a tool does, but also what data the agent sends when calling it.
Organizations should ask what company data agents can pass to website tools, where that data is sent, and whether they can control which tools agents use.
What this means for browser security
All three approaches share a central characteristic: the software operates on websites using access tied to the user’s browser session.
Browser security can no longer assume that a human is behind every click. Endpoint, network, and application controls remain essential, but they are generally designed to observe processes, traffic, and logins—not what an agent reads, decides, and does inside an authenticated tab. That is the gap.
The goal is not to prevent employees from using AI agents. These tools are likely to become a regular part of how work gets done. The goal is to ensure that the security controls expected in the browser continue to apply when an agent is interacting with it.
See what is making your browser work
Jamf gives security teams visibility and control over where people and AI agents operate: in the browser. Organizations can discover AI-enabled browsers and extensions, monitor AI activity across their workforce, and help enforce data protection policies before sensitive information leaves a tab.
Want to see which agents are already running in your environment? Request a demo from the Keep Aware team.
Sponsored and written by Keep Aware.
Source: www.bleepingcomputer.com