AnalysisAI AgentsNovember 11, 2026

Token built a browser agent that broke its own security rules

Read original source →thehackernews.com

Token's Rehearsal agent runs inside the user's authenticated browser session, so servers can't distinguish its clicks from the user's — nothing in a session cookie identifies the session driver. Token's fixes: dim and lock the app while the agent moves, log every action including blocked ones, and give the agent read-only reach below the user's.

1 source

More stories today

Open the live feed