Token's Rehearsal demo inherits the user cookie; no CVE and no external victim

Token's November 2026 essay, carried by The Hacker News, describes Rehearsal, an in-browser agent that opens pages, sets filters, and fills forms inside a logged-in Token session. The session cookie names the human, not the driver. That is a confused-deputy condition, the same class as cross-site request forgery: the server authorizes the cookie, not the intent. Token says it can name the driver, lock the UI, log blocked actions, and keep dashboards read-only only because it owns both the agent and the application. A third-party agent in a CRM or cloud console has none of those hooks.

The evidence trail is the essay, not an incident report. No CVE, no CVSS, no indicator of compromise, no named tenant loss. The line about breaking every security rule is a product narrative from an identity vendor whose thesis is separate agent identities, job-scoped access, and audit trails that are not the human's. Split the record: Token asserts Chrome auto-browse gates payments, Microsoft can pause agentic browsing before secrets, a W3C WebMCP draft labels actions read-only or consequential, and an IETF Web Bot Auth draft lets a site verify which agent signed a request. Those citations are not an exploit finding.

What the emotional framing misses is that the failure is old and the buyer is new. OWASP's generative-AI risk list already flags excessive agency: tools that inherit a user's full reach and act without a bounded task. Cookie-based apps have never encoded who is driving the browser. Issuing an agent identity at the identity provider does not, by itself, change what the origin authorizes if the request still carries the human session. That is the internal inconsistency. Security teams that log only the user principal will not see the agent in the SIEM.

Three partial views never meet at the authorization decision. The browser knows an agent is driving. The app knows which action is consequential. A signed request can name the agent. No published binding requires those facts to travel together. Until an origin can demand an agent principal narrower than the human cookie, UI agents will keep spending the user's session. If WebMCP calls still run as the user, and Web Bot Auth only names the bot without an enforced scope, non-human-identity procurement will outrun the control.