--- title: "What a Click Carries" canonical: "https://current.tinyfish.ai/issue/35/practitioners-corner/article/26389/what-a-click-carries" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" format: "Central Idea Piece" author: "Rina Takahashi" author_url: "https://current.tinyfish.ai/team/25" issue: 35 section: "practitioners-corner" section_name: "Practitioner's Corner" published: 2026-06-24 updated: 2026-06-25 description: "When agents perform clicks, the implicit human signals the web always assumed vanish, cascading into identity, authorization, and judgment gaps across infrastructure." word_count: 665 source_links: 11 --- # What a Click Carries *By [Rina Takahashi]()* *June 24, 2026* [Read on the website]() A person clicks a button on a webpage. Before that click fires, a lot has already happened. They loaded the page, read it (or skimmed it), understood roughly where they were, decided what they wanted to do, and accepted that the outcome is on them. The click is the only part of that sequence the infrastructure ever saw. Everything before it was invisible and assumed. The web never had to encode any of this because it was never in doubt. Session cookies, confirmation dialogs, terms-of-service checkboxes, login flows. Every one of these assumes a present, perceiving human. Nobody documented this as a deliberate design decision. It was a condition so obvious it functioned like gravity. You just lived in it. When an agent clicks the same button, the HTTP request is identical. The page updates the same way. The mechanical event reproduces perfectly, absent everything that gave it meaning. Benchmark results trace the outline of what's missing. [WebArena's](https://arxiv.org/abs/2307.13854) human baseline reaches 78.24% task completion; the [best reported agent](https://openai.com/index/computer-using-agent/) manages 58.1% on the same tasks. [TheAgentCompany](https://www.microsoft.com/en-us/research/publication/theagentcompany-benchmarking-llm-agents-on-consequential-real-world-tasks/), which simulates workplace tasks involving browsing and communicating with coworkers, reports its strongest autonomous agent completing roughly 30%. The gap shows up most clearly in exploration, failure recovery, contextual judgment. Exactly the things a human click implicitly signals. That gap cascades into infrastructure. The [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization) now requires access tokens to be validated as issued specifically for the server receiving them, and explicitly prohibits passing tokens through to upstream APIs. The spec names the risk: a confused-deputy problem, where downstream systems incorrectly trust a token because the entity presenting it looks authorized. These rules exist because when the clicker is an agent acting on behalf of a user acting through a tool chain three layers deep, "who authorized this" stops having a clean answer. But properly authorized agents still lack judgment about what to do with that authority. [OWASP classifies prompt injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) as a risk that scales with the agency the system has been given, independent of attack sophistication. An agent browsing a webpage can encounter instructions embedded in content and follow them, even when those instructions conflict with the user's original intent. [Anthropic's computer-use documentation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool) states this plainly: the model may follow commands found in content even when they conflict with user instructions. Their recommended mitigations are sandboxed containers, minimal privileges, domain allowlists, and human confirmation for consequential actions. Containment measures, because the click itself carries no judgment. OWASP's [Agentic Applications Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) names the structural version of this problem: an "attribution gap" created when agents operate through identity systems designed for humans, lacking distinct governed identities of their own. Their recommended principle is *least-agency*. Where least privilege limits what a system can access, least agency limits how much autonomous judgment a system should exercise. That distinction matters once you accept that an agent's click and a human's click are fundamentally different events, even though they produce identical network traffic. Nothing broke. The systems kept working. But the clicks carry less now than every downstream system expects them to carry. Every system that quietly relied on human presence has to decide what to do without it. ## Things to follow up on... - **Reliability across repeated trials:** Tau-bench's pass^k metric reveals how agent success rates decay sharply over multiple attempts, with [state-of-the-art agents dropping below 25% reliability](https://collaborate.princeton.edu/en/publications/%CF%84-bench-a-benchmark-for-tool-agent-user-interaction-in-real-world/) in retail tasks when measured across eight runs rather than one. - **Non-human identity risks:** OWASP's [Non-Human Identities Top 10](https://owasp.org/www-project-non-human-identities-top-10/) catalogs risks including secret leakage, overprivilege, and identity reuse that become sharper when agents inherit service accounts originally provisioned for background jobs. - **Observability naming agent internals:** OpenTelemetry's GenAI semantic conventions are beginning to [define span operations](https://github.com/open-telemetry/semantic-conventions-genai) like `invoke_agent`, `execute_tool`, and `plan` that would make agent decision traces auditable rather than opaque. - **Token audience and confused deputies:** MCP's security best-practices guide walks through the [confused-deputy scenario in detail](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices), showing how token passthrough breaks audit trails and lets downstream APIs incorrectly trust credentials they were never meant to see. ## More - [Practitioner's Corner — Issue 35]() - [Issue 35]() - [Publication guide]()