Bugun xodimlaringizning brauzerlarida qaysi AI agentlari harakat qilishi mumkin? Agar agent bugun ertalab brauzerda ishlay boshlagan bo'lsa, bu xodim emasligini bilarmidingiz? Aksariyat xavfsizlik jamoalari hali bu savollarga javob bera olmaydi. Bu sa'y-harakatning yetishmasligi emas. Bu AI savollarga javob berishdan harakat qilishga qanchalik tez o'tganining belgisidir.
AI agentlari endi autentifikatsiyalangan ilovalar ichida brauzerlarni boshqaradi va ular turli yo'llar bilan u yerga kiradi: nosozliklarni tuzatish interfeyslari, kengaytmalar, agentik brauzerlar va WebMCP kabi yangi standartlar. Har biri agent nimaga kirishi mumkinligini, uning harakatlari qanday bog'lanishini va mavjud nazoratlar ularni ko'ra olishini o'zgartiradi.
- Masofaviy nosozliklarni tuzatish: Ilovalar brauzerni boshqaradi
AI agentlari brauzerlarni boshqarishning bir usuli umuman yangi emas. Bu Chrome DevTools Protocol (CDP).
CDP ishlab chiquvchilarga Chromium-ga asoslangan brauzerlarni tekshirish, nosozliklarni tuzatish va avtomatlashtirishga yordam berish uchun yaratilgan. U navigatsiya, sahifa mazmuni, tarmoq faoliyati va foydalanuvchi o'zaro ta'sirlariga dasturiy kirish imkonini beradi. Playwright va Puppeteer kabi vositalar yillar davomida undan foydalanib kelgan. AI agentlari ham xuddi shu yondashuvdan veb-saytlar bo'ylab harakat qilish, ma'lumot olish, shakllarni to'ldirish va veb-ilovalar bilan o'zaro ta'sir qilish uchun foydalanadi.
Asosiy farq: avtomatlashtirish brauzer ichidan boshlanishi shart emas. Tashqi ilova nosozliklarni tuzatish yoqilgan brauzerga ulanishi va uning yorliqlarini boshqarishi mumkin. Agar bu brauzerda autentifikatsiyalangan sessiyalar bo'lsa, avtomatlashtirish bu kirishdan foydalanishi mumkin.
Ko'pchilik xavfsizlik vositalari uchun nosozliklarni tuzatish yoqilgan va korporativ ilovalarga kirgan brauzer har qanday boshqa autentifikatsiyalangan brauzer sessiyasiga o'xshaydi.
So'rash kerak bo'lgan savol: Qaysi ilovalar nosozliklarni tuzatish mumkin bo'lgan brauzerlarni ishga tushirishi yoki ulanishi mumkin? Sizning siyosatlaringiz bunga ruxsat beradimi va bu ilovalar qaysi korporativ sessiyalarga kirishi mumkin?
- AI kengaytmalari va agentik brauzerlar
Ikkinchi yondashuv agentni to'g'ridan-to'g'ri brauzer ichiga joylashtiradi.
Chrome'dagi Claude kabi kengaytmalar sahifalarni o'qishi, yorliqlarni almashtirishi, tugmalarni bosishi va ko'p bosqichli ish oqimlarini bajarishi mumkin. Bu skriptlash, yorliq kirishi va nosozliklarni tuzatish API kabi kuchli ruxsatlarni talab qiladi. Bu ruxsatlar funksionallikni ta'minlaydi, lekin kengaytma nimaga kirishi mumkinligini ham kengaytiradi.
Perplexity Comet va ChatGPT Desktop kabi agentik brauzerlar yanada oldinga borib, AI-ni to'g'ridan-to'g'ri brauzer tajribasiga kiritadi. Bu imkoniyatlar kengaytma ruxsatlari bilan boshqarilmasligi mumkin, shuning uchun mavjud kengaytma nazoratlari qo'llanilmasligi mumkin.
Sizning flotingiz bo'ylab brauzerlar inventarizatsiyasiz qaysi agentlar ishlayotganini bilmasligingiz mumkin. Ikki xavf ajralib turadi.
Agentlar foydalanuvchi shaxsi bilan harakat qiladi. Agent hujjatni yuklab olganda yoki ichki ilova sozlamasini o'zgartirganda, ilova autentifikatsiyalangan foydalanuvchi ruxsat etilgan so'rovni amalga oshirayotganini ko'radi.
Qo'shimcha telemetriyasiz na ilova, na uning audit jurnallari agent harakatlarini xodim harakatlaridan ajrata olmaydi.
Biri xodim edi. Biri o'sha xodimni taqlid qilgan AI agenti edi. Ilova ikkalasini ham bir xil tarzda qayd etdi.
Agentlar mazmunni kirish ma'lumotlari sifatida qabul qiladi. Brauzer sahifani kimdir talqin qilishi uchun ko'rsatadi. Agent esa bu sahifani o'qiydi va keyin nima qilishini hal qiladi. Bu veb-saytlar, hujjatlar yoki elektron pochta xabarlari ichiga joylashtirilgan ko'rsatmalar uning xatti-harakatini yo'naltirishga urinishiga olib keladigan tezkor in'ektsiya xavflarini keltirib chiqaradi.
Natija: ishonchli ruxsatlar bilan ishlaydigan dasturiy ta'minot ishonchsiz mazmunni talqin qiladi.
So'rash kerak bo'lgan savol: Sizning flotingiz bo'ylab qaysi AI kengaytmalari va agentik brauzerlar ishlamoqda, ular qanday kirish huquqiga ega va siz ularning harakatlarini xodim harakatlaridan ajrata olasizmi?
- WebMCP: Veb-saytlar agentlarga to'g'ridan-to'g'ri vositalarni ochib beradi
Uchinchi yondashuv veb-saytlar agentlar bilan qanday o'zaro ta'sir qilishini o'zgartiradi.
WebMCP Google va Microsoft hissasi bilan W3C Web Machine Learning Community Group orqali ishlab chiqilayotgan yangi veb-standartdir. Sahifalarni talqin qilish va bosishlarni simulyatsiya qilish o'rniga, agentlar veb-saytlar tomonidan to'g'ridan-to'g'ri ochib berilgan tuzilgan vositalarni chaqirishi mumkin.
Masalan, qo'llab-quvvatlash portalida harakat qilish va shakllarni to'ldirish o'rniga, agent chipta yaratish uchun vositani chaqirishi mumkin. Chrome 2026-yilda erta ko'rinishni taqdim etdi va spetsifikatsiya rivojlanishda davom etmoqda.
Ammo bu yangi ishonch muammosini keltirib chiqaradi. Veb-saytlar endi faqat mazmunni taqdim etmaydi. Ular agentlar bajarishi mumkin bo'lgan harakatlarni belgilaydi.
Vosita nomlari, tavsiflari va kirish sxemalari agent nimani chaqirishini yo'naltiradi. Bu ta'riflar veb-saytdan keladi va ishonchli ko'rsatmalar sifatida qabul qilinmasligi kerak. Buzilgan yoki zararli sayt agent xatti-harakatiga ta'sir qilish uchun chalg'ituvchi tavsiflar yoki funksionallikdan foydalanishi mumkin.
A sayti vosita tavsifi agentga B saytidan ma'lumot olishni jimgina ko'rsatadi.
Har bir vosita o'z veb-saytining xavfsizlik kontekstida ishlaydi, lekin bir nechta saytlar bo'ylab ishlaydigan agentlar ular o'rtasida ma'lumotni ko'chirishi mumkin. Muammo faqat vosita nima qilishi emas, balki agent uni chaqirganda qanday ma'lumotlarni taqdim etishi hamdir.
So'rash kerak bo'lgan savol: Agentlar veb-sayt vositalariga qaysi korporativ ma'lumotlarni o'tkazishi mumkin, bu ma'lumotlar qayerga boradi va siz qaysi vositalardan foydalanishlarini nazorat qila olasizmi?
Bu brauzer xavfsizligi uchun nimani anglatadi
Uchta yondashuv ham bitta narsani baham ko'radi: dasturiy ta'minot foydalanuvchining brauzer sessiyasiga bog'langan kirish bilan veb-saytlarda harakat qilmoqda.
Shuning uchun brauzer xavfsizligi endi har bir bosish ortida inson bor deb taxmin qila olmaydi. Endpoint, tarmoq va ilova nazoratlari hali ham muhim. Ammo ular jarayonlar, trafik va kirishlarni ko'rish uchun yaratilgan, agent autentifikatsiyalangan yorliqda nimani o'qishi, hal qilishi va bajarishini ko'rish uchun emas. Bu bo'shliq.
Maqsad xodimlarning AI agentlaridan foydalanishini to'xtatish emas. Agentlar ish qanday bajarilishini normal qismiga aylanadi. Maqsad siz allaqachon brauzerda kutadigan nazoratlar agent ishlayotganida ham qo'llanilishini ta'minlashdir.
Brauzerlaringizni nima boshqarayotganini ko'ring
Keep Aware, Jamf kompaniyasi, xavfsizlik jamoalariga odamlar va AI agentlari haqiqatan ishlaydigan joyda — brauzerda — ko'rinish va nazorat beradi. Biz sizga AI yoqilgan brauzerlar va kengaytmalarni aniqlash, ishchi kuchingiz bo'ylab AI faoliyatini kuzatish va sezgir ma'lumotlar yorliqdan chiqib ketishidan oldin ma'lumotlarni himoya qilish siyosatlarini qo'llashda yordam beramiz.
Sizning muhitda qaysi agentlar allaqachon ishlayotganini ko'rishni xohlaysizmi? Jamoamiz bilan demo so'rang va biz sizga buni ko'rsatamiz.
Keep Aware tomonidan homiylik qilingan va yozilgan.
Which AI agents can act inside your employees' browsers today? If an agent started browsing this morning, would you know it wasn't the employee? Most security teams can't answer those questions yet. That's not a failure of effort. It's a sign of how quickly AI moved from answering questions to taking action.
AI agents now operate browsers inside authenticated applications, and they get there in different ways: debugging interfaces, extensions, agentic browsers, and emerging standards like WebMCP. Each changes what an agent can access, how its actions are attributed, and whether existing controls can see them.
- Remote Debugging: Applications Controlling the Browser
One way AI agents operate browsers isn't new at all. It's the Chrome DevTools Protocol (CDP).
CDP was built to help developers inspect, debug, and automate Chromium-based browsers. It provides programmatic access to navigation, page content, network activity, and user interactions. Tools like Playwright and Puppeteer have used it for years. AI agents use the same approach to navigate websites, extract information, fill forms, and interact with web applications.
The key distinction: automation doesn't have to originate inside the browser. An external application can connect to a browser with debugging enabled and control its tabs. If that browser has authenticated sessions, the automation can use that access.
To most security tools, a browser launched with debugging enabled and signed into corporate applications looks like any other authenticated browser session.
The question to ask: Which applications can launch or connect to debuggable browsers? Do your policies permit this, and which corporate sessions can those applications access?
- AI Extensions and Agentic Browsers
The second approach puts the agent directly inside the browser.
Extensions such as Claude in Chrome can read pages, switch tabs, click buttons, and complete multistep workflows. This requires powerful permissions, including scripting, tab access, and the debugger API. These permissions enable the functionality but also expand what the extension can access.
Agentic browsers like Perplexity Comet and ChatGPT Desktop go further, building AI directly into the browsing experience. These capabilities aren't necessarily governed by extension permissions, so existing extension controls may not apply.
Without an inventory of browsers across your fleet, you may not know which agents are operating. Two risks stand out.
Agents act with the user's identity. When an agent downloads a document or changes an internal application setting, the application sees an authenticated user making an authorized request.
Without additional telemetry, neither the application nor its audit logs may distinguish the agent's actions from the employee's.
One was an employee. One was an AI agent impersonating that employee. The application logged both the same way.
Agents treat content as input. A browser displays a page for someone to interpret. An agent reads that page and decides what to do next. This introduces prompt injection risks, where instructions embedded in websites, documents, or emails attempt to redirect its behavior.
The result is software interpreting untrusted content while operating with trusted permissions.
The question to ask:Which AI extensions and agentic browsers are running across your fleet, what access do they have, and can you distinguish their actions from an employee's?
- WebMCP: Websites Exposing Tools Directly to Agents
The third approach changes how websites interact with agents.
WebMCP is an emerging web standard developed through the W3C Web Machine Learning Community Group, with contributions from Google and Microsoft. Rather than interpreting pages and simulating clicks, agents can call structured tools exposed directly by websites.
For example, instead of navigating a support portal and filling out forms, an agent could call a tool to create a ticket. Chrome introduced an early preview in 2026, and the specification continues to evolve.
But this introduces a new trust problem. Websites aren't just presenting content. They're defining actions agents can take.
Tool names, descriptions, and input schemas guide what an agent invokes. These definitions come from the website and shouldn't be treated as trusted instructions. A compromised or malicious site could use misleading descriptions or functionality to influence an agent's behavior.
Site A's tool description quietly instructs the agent to pull data from Site B.
Each tool operates within its website's security context, but agents working across multiple sites can move information between them. The concern isn't just what a tool does, but what data the agent provides when calling it.
The question to ask: What corporate data can agents pass to website tools, where does that data go, and can you control which tools they use?
What This Means for Browser Security
All three approaches share one thing: software is acting on websites with the access tied to a user's browser session.
That's why browser security can't assume a human is behind every click anymore. Endpoint, network, and application controls still matter. But they were built to see processes, traffic, and logins, not what an agent reads, decides, and does inside an authenticated tab. That's the gap.
The goal isn't to stop employees from using AI agents. Agents are going to become a normal part of how work gets done. The goal is to make sure the controls you already expect in the browser keep applying when an agent is the one operating it.
See What's Operating Your Browsers
Keep Aware, a Jamf company, gives security teams visibility and control where people and AI agents actually work: the browser. We help you discover AI-enabled browsers and extensions, monitor AI activity across your workforce, and enforce data protection policies before sensitive information leaves the tab.
Want to see which agents are already operating in your environment?Request a demo with our team, and we'll walk you through it.
Sponsored and written by Keep Aware.