Token Exposes Security Gaps in AI Agents

Token's browser agent Rehearsal inherited a human session without a distinct identity, scope, or delegation record, exposing security gaps in how AI agents are secured, the company reported. The incident serves as a concrete example of what can go wrong when AI agents operate without proper identity and delegation controls.

Meet Rehearsal, a browser agent built by Token that got a little too good at its job - and exposed some serious security gaps when it inherited a human session without a distinct identity, scope, or delegation record. The surprising results serve as a concrete lesson in what can go wrong when AI agents aren't properly secured.