TL;DR: Agentic browsers can read web content, navigate SaaS tools, and act on behalf of users, which creates a new enterprise attack surface that traditional security tooling cannot easily quantify, according to Zenity. The governing problem is not malware but ungoverned autonomy across managed and unmanaged devices, where browser agents can reach sensitive data, tokens, and identity systems before teams notice.
At a glance
What this is: Zenity examines how agentic browsers extend user-like access into enterprise systems and why that creates a new governance and attack-surface problem for IAM teams.
Why it matters: IAM, PAM, and identity security teams need to understand where browser agents inherit access, because their actions can touch SaaS, identity systems, and local secrets without the control points used for normal user sessions.
Context
Agentic browsers are browser-based AI systems that can interpret instructions, read web content, and perform actions in SaaS applications as if they were a person using the browser. That matters to IAM because the access they use is often inherited from a user session, but the actions are machine-paced and far less predictable than conventional human activity.
The governance gap is not just visibility. These tools can live on managed and unmanaged devices, appear informally inside the enterprise, and reach identity systems, cloud sessions, local files, and private portals before standard monitoring or access review processes can meaningfully classify them.
In identity terms, the question is whether browser-mediated autonomy should be treated as another user workflow or as a separate non-human execution layer that needs its own inventory, policy, and response model. The answer changes how teams think about trust, authorisation, and containment.
Key questions
Q: What breaks when agentic browsers inherit a user's enterprise session?
A: The boundary between human activity and machine execution breaks down. Browser agents can act inside a valid session while reading content, calling tools, and modifying systems faster than normal monitoring or access review processes can classify. That means session ownership no longer tells you who decided the action, only which context was used.
Q: Why do agentic browsers increase risk for enterprise data even when users are legitimate?
A: Agentic browsers can execute user-directed actions and interpret page content, which expands the attack surface beyond normal browsing. If a malicious page can influence the agent through prompt injection, it may redirect the browser, expose unintended data, or trigger unsafe actions. The core risk is that trust is extended to software that can be manipulated through content.
Q: How can security teams tell whether agentic browser governance is actually working?
A: Look for attributable audit trails, approved access scopes, visible policy enforcement on consequential actions, and discovery of unmanaged installs. If you can only describe a policy but cannot prove which sessions were constrained, the governance model is not operating as intended.
Q: Should organisations treat agentic browsers like ordinary browsers or like non-human identities?
A: Treat them as non-human execution layers that can inherit human sessions but do not behave like normal browsing. Ordinary browsers are mostly passive clients, while agentic browsers can interpret instructions and take actions. That distinction changes inventory, policy, monitoring, and incident response expectations.
Technical breakdown
How agentic browsers inherit and extend enterprise access
Agentic browsers sit between the user, the web, and downstream enterprise tools. They can read arbitrary content, interpret instructions in real time, and then trigger actions in SaaS platforms, developer tools, identity systems, and local environments. The technical problem is that they often operate inside an existing user context, so the browser agent appears to be just another session while actually acting as an execution layer. That makes normal browser telemetry and IAM session logs incomplete as governance evidence, because the most risky behaviour happens after access has already been granted.
Practical implication: Treat browser agents as separate execution subjects in inventory and policy, not as ordinary user browsing.
Indirect prompt injection and action chaining in browser workflows
Indirect prompt injection occurs when a webpage, document, or interface element contains instructions that an agent follows even though the user did not intend them. In an agentic browser, that can lead to actions such as opening internal tools, modifying tickets, changing permissions, or interacting with untrusted domains. Once one action succeeds, the browser agent can chain into connected systems where identity context and delegated access amplify the impact. The core issue is not a single malicious page, but the agent's willingness to treat external content as executable guidance.
Practical implication: Block or flag untrusted content paths that can steer agent actions into privileged enterprise workflows.
Why local secrets and cloud sessions become high-value targets
Zenity's article highlights access to local files, environment variables, tokens, cloud sessions, and internal portals. Those artefacts are valuable because they let an attacker move from the browser agent's current context into broader infrastructure without needing fresh authentication. In practice, a compromised browser agent can become a bridge from human-authored intent to machine-executed privilege, which is why local secrets and session material matter as much as the browser itself. The risk is compounded when the same agent can operate across SaaS, developer tools, and identity platforms.
Practical implication: Assume tokens, session material, and environment variables reachable by agentic browsers can become escalation paths.
Threat narrative
Attacker objective: Exploit browser-mediated autonomy to reach sensitive enterprise data, privileged systems, and downstream identity or SaaS actions through the user's existing access.
- Entry begins when an employee installs or uses an agentic browser on a managed or unmanaged device, or when a webpage delivers indirect prompt injection to the running agent.
- Credential and session material are exposed when the browser reads local files, environment variables, cloud sessions, or tokens that unlock adjacent enterprise tools.
- Escalation occurs when the agent uses those privileges to modify issues, edit code, change permissions, or interact with internal systems at machine speed.
- Impact is lateral movement and unintended enterprise action across identity, SaaS, and developer environments before monitoring or governance processes can react.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic browsers create a browser-layer identity problem, not just a new endpoint problem. The security issue is that a browser agent can inherit a human session and then act with machine speed across SaaS, identity, and developer tools. That collapses the old assumption that browser activity is either human-driven or easily attributable to a single user action. Practitioners need to treat browser-based execution as a distinct identity surface, not as a browser hardening problem.
Ungoverned autonomy is the real control failure. Zenity's article correctly shifts attention away from malware and toward browser agents that can take actions no security team explicitly approved. The failure mode is not merely that the tool exists, but that its access, behaviour, and escalation paths are often outside inventory and policy. This is the kind of shadow AI that turns ordinary SaaS access into a hidden automation layer.
Identity blast radius becomes larger when the browser is the automation hub. If an agent can touch Jira, GitHub, Confluence, identity systems, and cloud sessions from one interface, then compromised browser behaviour can propagate quickly across connected services. That is a governance challenge for IAM and IGA because the blast radius is no longer bounded by a single application or a single sign-in event. Teams should re-evaluate where delegated access begins and where it actually ends.
Least privilege assumptions weaken when the tool that holds the session is also the tool that acts. The access review model was designed for sessions that can be observed and certified after use. Agentic browsers turn that into a moving target because the same session can read, decide, and act before reviewers can separate intent from execution. The implication is that browser-mediated access needs real-time policy and explicit scope control, not retrospective certification alone.
What this signals
Agentic browsers turn the browser into a privileged automation hub. That changes the governance question from browser hardening to execution control. For IAM and IGA teams, the practical issue is whether the organisation can inventory, authorise, and revoke browser agents with the same discipline it applies to other non-human execution layers.
Shadow AI is now a browser problem as much as an application problem. When employees can adopt these tools informally on managed or unmanaged devices, the first control gap is usually discovery, not prevention. Security programmes should assume that visibility into AI use will lag actual adoption unless browser-level inventory becomes part of the identity operating model.
For practitioners
- Inventory browser agents as a separate identity surface Identify where agentic browsers are installed, who approved them, and which managed or unmanaged devices they can run on. Map their reachable SaaS, identity, and local-data surfaces so policy is based on actual exposure rather than assumed browser normality.
- Restrict access to secrets and session material reachable by agents Classify environment variables, tokens, cloud sessions, and local files that an agentic browser can access, then remove unnecessary exposure paths. The goal is to prevent browser-mediated access from becoming a shortcut into broader privilege.
- Add guardrails for untrusted content and indirect prompt injection Use policy to block or flag actions triggered by external pages, embedded instructions, or untrusted domains when those actions would reach internal tools. Separate read-only browsing from action-taking wherever the agent can affect permissions or records.
- Route agent activity into incident response workflows Feed browser-agent detections into SOC and governance processes so suspicious behaviour is triaged as identity and access risk, not only as endpoint activity. That is especially important when the same agent can touch SaaS, identity, and developer workflows.
Key takeaways
- Agentic browsers blur the line between user session and non-human execution, which makes standard IAM visibility incomplete.
- The main risk is not malware, but browser-mediated autonomy that can move through SaaS, identity systems, and local secrets.
- Security teams need inventory, guardrails, and incident workflows that treat browser agents as a distinct identity surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Agentic browsers can be steered into unintended tool actions through prompt injection and unsafe content. |
| ASI03 — Identity & Privilege Abuse | The article centres on browser agents acting with inherited session privilege across enterprise systems. | |
| Recommendation — Constrain browser-agent tool use and block unsafe action paths in untrusted content flows. Limit inherited privilege and monitor browser-agent actions that exceed intended scope. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Browser agents can inherit broad access to identity systems, SaaS tools, and local files. |
| NHI-10 — Human Use of NHI | Employees are informally adopting browser agents that execute on their behalf without clear governance. | |
| Recommendation — Inventory browser-agent access and reduce any privilege that is not explicitly required. Govern browser agents as non-human execution layers rather than casual user productivity tools. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about controlling what browser agents can reach and do inside enterprise systems. |
| Recommendation — Review and limit agent-access entitlements to the minimum necessary scope. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Zenity describes token extraction and cross-system propagation as key attack outcomes. |
| Recommendation — Map browser-agent abuse to credential access and lateral movement detection logic. | ||
Key terms
- Agentic Browser: An agentic browser is a web browser with an embedded AI assistant that can interpret page content and take actions on the user’s behalf. It combines browsing, reasoning, and execution in one interface, which creates new governance requirements for identity, data handling, and approval boundaries.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Browser-mediated privileged access: Browser-mediated privileged access is elevated access that is granted and used through a web browser instead of a direct administrative client or local session. It typically routes privileged actions through controlled web interfaces, where authentication, session recording, policy checks, and command restrictions can be enforced to reduce exposure of credentials and limit unmanaged access paths.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org