A security firm built a deliberately dangerous AI agent to learn how to protect you

A security company named Token built a deliberately 'bad' AI agent called Rehearsal to understand the vulnerabilities inherent in AI assistants. The agent, designed to answer questions by performing actions, runs inside a user's browser session, making its actions indistinguishable from the user's own clicks. This exposes a fundamental flaw: applications cannot see the agent, the delegation, or the intended scope of its task.

By controlling both the agent and the application, Token demonstrated specific defenses: dimming and locking the UI while the agent works, recording all actions, and strictly limiting the agent's permissions to read-only. The key lesson is that without the company's insider control, external AI agents operating inside your CRM or cloud console are invisible and uncontrollable. The path forward requires new identity standards to make AI agents visible and accountable.