Which AI agents can operate in your employees’ browsers today? If an agent started browsing this morning, would you know it wasn’t the employee? Most security teams can’t answer these questions yet. This is not a failure of effort. This is a sign of how quickly AI has moved from answering questions to taking action.
AI agents now leverage browsers within authenticated applications, and they do this in a variety of ways: debug interfaces, extensions, agent browsers, and emerging standards like WebMCP. Each changes what an agent can access, how its actions are assigned, and whether existing controls can see them.
1. Remote debugging: applications controlling the browser
The way AI agents exploit browsers is not new at all. This is the Chrome DevTools Protocol (CDP).
CDP was designed to help developers inspect, debug, and automate Chromium-based browsers. It provides programmatic access to navigation, page content, network activity and user interactions. Tools like Playwright and Puppeteer have been using it for years. AI agents use the same approach to navigate websites, extract information, fill out forms, and interact with web applications.
The key distinction: Automation doesn’t have to come from the browser. An external application can connect to a browser with debugging enabled and control its tabs. If this browser has authenticated sessions, the automation can use this access.
For most security tools, a browser launched with debugging enabled and connected to enterprise applications looks like any other authenticated browser session.
The question to ask: Which applications can launch or connect to debuggable browsers? Do your policies allow this and which enterprise sessions can these applications access?
2. AI Extensions and Agent Browsers
The second approach places the agent directly in the browser.
Extensions like Claude in Chrome can read pages, switch tabs, click buttons, and perform multi-step workflows. This requires powerful permissions, including scripting, tab access, and the debugger API. These permissions enable the functionality but also expand what the extension can access.
Agent browsers like Perplexity Comet and ChatGPT Desktop go further by integrating AI directly into the browsing experience. These features are not necessarily governed by extension permissions, so existing extension controls may not apply.
Without an inventory of the browsers in your fleet, you may not know which agents are operating. Two risks stand out.
Agents act with the user’s identity. When an agent uploads a document or changes an internal application setting, the application sees an authenticated user making an authorized request.
Without additional telemetry, neither the application nor its audit logs can distinguish the agent’s actions from those of the employee.
Agents treat content as input. A browser displays a page that someone can interpret. An agent reads this page and decides what to do next. This introduces risks of rapid injection, where instructions embedded in websites, documents or emails attempt to redirect its behavior.
The result is software that interprets untrusted content while operating with trusted permissions.
The question to ask: What AI extensions and agent browsers are running on your fleet, what access do they have, and can you distinguish their actions from those of an employee?
Once an AI agent is in an authenticated tab, endpoint and network tools lose track of what it is reading and doing.
Keep Aware monitors AI activity in the browser and applies data protection policies before sensitive data leaves the tab.
3. WebMCP: Websites exposing tools directly to agents
The third approach changes the way websites interact with agents.
WebMCP is an emerging web standard developed by the W3C’s Web Machine Learning community group, with contributions from Google and Microsoft. Rather than interpreting pages and simulating clicks, agents can rely on structured tools exposed directly by websites.
For example, instead of navigating a support portal and filling out forms, an agent could call a tool to create a ticket. Chrome introduced a first version in 2026 and the specification continues to evolve.
But this introduces a new trust problem. Websites don’t just present content. They define the actions that agents can take.
Tool names, descriptions, and input patterns guide what an agent calls. These definitions come from the website and should not be considered reliable instructions. A compromised or malicious site could use misleading descriptions or features to influence an agent’s behavior.
Each tool operates within the security context of its website, but agents working across multiple sites can move information between them. The concern is not only what a tool does, but also what data the agent provides when calling it.
The question to ask: what business data can agents transmit to website tools, where does that data go, and can you control which tools they use?
What this means for browser security
All three approaches share one thing: the software operates on websites whose access is tied to a user’s browser session.
This is why browser security can no longer assume that a human is behind every click. Endpoint, network, and application controls are still important. But they were designed to see processes, traffic and connections, not what an agent reads, decides and does in an authenticated tab. This is the gap.
The goal is not to prevent employees from using AI agents. Agents will become a normal part of how work is done. The goal is to ensure that the controls you already expect in the browser continue to apply when an agent operates it.
Find out what makes your browsers work
Keep informed, a Jamf companygives security teams visibility and control where people and AI agents actually work: the browser. We help you discover AI-enabled browsers and extensions, monitor AI activity across your workforce, and enforce data protection policies before sensitive information leaves the tab.
Want to see which agents are already operating in your environment? Request a demo with our teamand we will guide you through it.
Sponsored and written by Stay informed.
