If an agent started browsing this morning, would you know it wasn't the employee? Most security teams can't answer those questions yet. That's not a failure of effort.
It's a sign of how quickly AI moved from answering questions to taking action. AI agents now operate browsers inside authenticated applications, and they get there in different ways: debugging interfaces, extensions, agentic browsers, and emerging standards like WebMCP. Each changes what an agent can access, how its actions are attributed, and whether existing controls can see them.
One way AI agents operate browsers isn't new at all. CDP was built to help developers inspect, debug, and automate Chromium-based browsers. It provides programmatic access to navigation, page content, network activity, and user interactions.
Tools like Playwright and Puppeteer have used it for years. AI agents use the same approach to navigate websites, extract information, fill forms, and interact with web applications. The key distinction: automation doesn't have to originate inside the browser.
An external application can connect to a browser with debugging enabled and control its tabs. If that browser has authenticated sessions, the automation can use that access.
