Which AI agents can act inside your employees' browsers today? If an agent started browsing this morning, would you know it wasn't the employee? Most security teams can't answer those questions yet. That's not a failure of effort. It's a sign of how quickly AI moved from answering questions to taking action.

AI agents now operate browsers inside authenticated applications, and they get there in different ways: debugging interfaces, extensions, agentic browsers, and emerging standards like WebMCP. Each changes what an agent can access, how its actions are attributed, and whether existing controls can see them.

1. Remote Debugging: Applications Controlling the Browser

One way AI agents operate browsers isn't new at all. It's the Chrome DevTools Protocol (CDP).

CDP was built to help developers inspect, debug, and automate Chromium-based browsers. It provides programmatic access to navigation, page content, network activity, and user interactions. Tools like Playwright and Puppeteer have used it for years. AI agents use the same approach to navigate websites, extract information, fill forms, and interact with web applications.

The key distinction: automation doesn't have to originate inside the browser. An external application can connect to a browser with debugging enabled and control its tabs. If that browser has authenticated sessions, the automation can use that access.

To most security tools, a browser launched with debugging enabled and signed into corporate applications looks like any other authenticated browser session.

The question to ask: Which applications can launch or connect to debuggable browsers? Do your policies permit this, and which corporate sessions can those applications access?

2. AI Extensions and Agentic Browsers

The second approach puts the agent directly inside the browser.

Extensions such as Claude in Chrome can read pages, switch tabs, click buttons, and complete multistep workflows. This requires powerful permissions, including scripting, tab access, and the debugger API. These permissions enable the functionality but also expand what the extension can access.

Agentic browsers like Perplexity Comet and ChatGPT Desktop go further, building AI directly into the browsing experience. These capabilities aren't necessarily governed by extension permissions, so existing extension controls may not apply.

Without an inventory of browsers across your fleet, you may not know which agents are operating. Two risks stand out.

Agents act with the user's identity. When an agent downloads a document or changes an internal application setting, the application sees an authenticated user making an authorized request.

Without additional telemetry, neither the application nor its audit logs may distinguish the agent's actions from the employee's.

Agents treat content as input. A browser displays a page for someone to interpret. An agent reads that page and decides what to do next. This introduces prompt injection risks, where instructions embedded in websites, documents, or emails attempt to redirect its behavior.

The result is software interpreting untrusted content while operating with trusted permissions.

The question to ask: Which AI extensions and agentic browsers are running across your fleet, what access do they have, and can you distinguish their actions from an employee's?

3. WebMCP: Websites Exposing Tools Directly to Agents

The third approach changes how websites interact with agents.

WebMCP is an emerging web standard developed through the W3C Web Machine Learning Community Group, with contributions from Google and Microsoft. Rather than interpreting pages and simulating clicks, agents can call structured tools exposed directly by websites.

For example, instead of navigating a support portal and filling out forms, an agent could call a tool to create a ticket. Chrome introduced an early preview in 2026, and the specification continues to evolve.

But this introduces a new trust problem. Websites aren't just presenting content. They're defining actions agents can take.

Tool names, descriptions, and input schemas guide what an agent invokes. These definitions come from the website and shouldn't be treated as trusted instructions. A compromised or malicious site could use misleading descriptions or functionality to influence an agent's behavior.

Each tool operates within its website's security context, but agents working across multiple sites can move information between them. The concern isn't just what a tool does, but what data the agent provides when calling it.

The question to ask: What corporate data can agents pass to website tools, where does that data go, and can you control which tools they use?

What This Means for Browser Security

All three approaches share one thing: software is acting on websites with the access tied to a user's browser session.

That's why browser security can't assume a human is behind every click anymore. Endpoint, network, and application controls still matter. But they were built to see processes, traffic, and logins, not what an agent reads, decides, and does inside an authenticated tab. That's the gap.

The goal isn't to stop employees from using AI agents. Agents are going to become a normal part of how work gets done. The goal is to make sure the controls you already expect in the browser keep applying when an agent is the one operating it.

See What's Operating Your Browsers

Keep Aware, a Jamf company, gives security teams visibility and control where people and AI agents actually work: the browser. We help you discover AI-enabled browsers and extensions, monitor AI activity across your workforce, and enforce data protection policies before sensitive information leaves the tab.

Want to see which agents are already operating in your environment? Request a demo with our team, and we'll walk you through it.

Sponsored and written by Keep Aware.