For thirty years, "user agent" has been one of the most boring terms on the web. RFC 1945, published in 1996, defined it as any program that sends requests to a website: your browser, a search crawler, whatever. It described a mechanical role. This software fetches pages. It said nothing about trust, loyalty, or what the software owes anybody.
Two drafts published this month at the W3C (the standards body that governs how the web works) are trying to change that. I read the first one over the long Columbus Day weekend, then read it again, because I wasn't sure I'd read it right the first time.
The first, a Group Note from October 8, redefines "user agent" as software that uses websites on your behalf, and then it assigns that software duties. Protection: keep you safe. Honesty: tell you what it did and what happened. Loyalty: put your interests ahead of its maker's, even when someone else is paying the bills. That last one stopped me. It reads less like a software spec and more like a fiduciary standard, the kind of obligation we usually attach to lawyers and trustees.
The second, from the TAG (a W3C group that reviews web architecture), landed October 14. It explains why those duties collide with how AI browser agents actually work.
When an AI agent browses for you, it carries everything your browser already has: your logged-in sessions, your saved payment methods, your history. The TAG calls this "ambient authority," meaning credentials the agent inherits just by running inside your browser. Meanwhile, the agent is also taking instructions from the websites it visits. Page content, button labels, tool descriptions all become input that shapes what it does next.
The TAG frames this as a "confused deputy" problem, and that's exactly the right name for it. The agent holds your power but takes direction from third parties whose interests may not line up with yours. Browsers have dealt with this for decades using hard technical boundaries: one site can't read another site's cookies or session data. Those boundaries are automatic and unconditional, and nobody has to decide anything for them to hold. The agent swaps them out for judgment. It decides what information to carry from one site to another, which instructions to follow, what to ignore. The TAG calls this an inversion of the web's security model, where the fixed wall becomes a discretionary call made by a language model.
If you've spent any time in infrastructure, you've seen this pattern. A system replaces a mechanical boundary with a policy decision, and the policy ends up broader than anyone meant it to be, because scoping it narrowly was harder to build and somebody had a deadline. Here, the "policy" is a language model predicting its next token, and the credentials at stake belong to someone who may not even know the agent is using them.
A language model's judgment is not a security boundary. The standard defense against confused-deputy attacks is keeping instructions separate from data, but as the TAG points out, that separation falls apart when everything the model processes is the same undifferentiated text. A legitimate website feature and a prompt built to manipulate the agent look identical in the input stream.
So Draft 1 says the agent must be loyal to you above all, and Draft 2 shows the agent is architecturally positioned to be steered by anyone whose content it reads. Both are right. The tension between them isn't sloppy drafting. It's a real property of software that holds your authority while wandering around an environment built by strangers.
Neither draft is an approved standard yet. The Group Note says outright that its duties need public discussion before they can become enforceable requirements. But the direction is clear: standards bodies are starting to define software by what it owes you, not only by which protocol it speaks.
If you build or evaluate software that acts for users inside a browser, the practical question is whether your architecture can deliver on what the label now claims. Can your agent tell a user what it did across origins (different websites, in browser terms), and why? When it hits conflicting signals, a user's stated goal pulling one way and a page's structure pulling another, is there a mechanical answer, or is it model judgment all the way down? My bet is that honesty is the most tractable of the three duties, so push on it first. Ask whether any agent you're building or buying can produce a legible account of its actions after the fact. If it can't, "user agent" is a promise the software isn't keeping.
- WebMCP's trust gap: The WebMCP proposal lets websites publish callable tools for browser agents, but its own security section concedes that a tool's declared purpose may not match its actual effects — structured interfaces reduce guesswork while introducing a new kind of interested claim.
- NIST on agent identity: Over 600 comments on NIST's agent identity concept paper showed broad support for extending existing identity standards rather than building a separate agent identity stack, but no consensus on how delegation chains or action-time authorization should actually work.
- Cross-origin proof of concept: University of Washington researchers tested seven browser-agent designs and demonstrated a complete cross-origin data-theft attack against one, with several others satisfying the preconditions if prompt injection succeeded.
- Private browsing under agents: The TAG draft raises unresolved questions about agent memory and private sessions — specifically whether agent context is mechanically partitioned between private and ordinary browsing, or whether the separation depends on a model's intention not to mix them.