Three Ways AI Agents Operate in Browsers

AI agents can already work inside authenticated browsers, where their actions may be difficult to distinguish from those of employees. A report by Keep Aware, a Jamf company, describes three ways agents operate and the security questions each raises.

First, agents can use the Chrome DevTools Protocol (CDP), an interface built for inspecting, debugging, and automating Chromium-based browsers. Tools such as Playwright and Puppeteer use it, and an external application can connect to a browser with debugging enabled. If that browser has an authenticated session, automation may use the same access.

Second, agents can operate from inside browsers. Extensions such as Claude in Chrome can read pages, switch tabs, click buttons, and complete workflows. Agentic browsers, including Perplexity Comet and ChatGPT Desktop, build AI into browsing. Keep Aware says these agents can act under a user's identity, while audit logs may not distinguish their actions from an employee's. Agents can also encounter prompt injection: untrusted content in pages, documents, or emails that tries to redirect their behavior.

Third, the emerging WebMCP standard lets agents call structured tools exposed by websites instead of interpreting pages and simulating clicks. The W3C Web Machine Learning Community Group is developing the standard with contributions from Google and Microsoft. Chrome introduced an early preview in 2026, and the specification is still evolving. Website-provided tool descriptions and schemas may themselves be misleading or malicious.

Keep Aware argues that existing endpoint, network, and application controls may not show what agents read and do inside authenticated tabs. It says browser security should continue applying its controls when agents operate browsers.