Abusing Agentic AI Browsers: An Exploit-Based Approach - Or Eshed | BSides Las Vegas 2026
Or Eshed (LayerX) — 25 min, The Tuscany
Photos only — this session was not recorded, and I caught two slides. Notes below cover only what those show.
The framing is exploit-based rather than theoretical: agentic browsers as an attack surface you can actually work against, not a category to worry about in the abstract.
What Agentic Browsers Break
The slide that stuck is a list of things that quietly stop working:
- Application tests
- Bot detections
- DDoS protection
- DLP
- Authentication & authorization
What links them is an assumption none of them state: that a browser is being driven by a person. Bot detection is the clearest case — an agentic browser acting for a real user is automated and legitimate simultaneously, so “is this automated?” stops being the question that separates good traffic from bad.
Which is the same conclusion the BSidesSF credential stuffing talk reached from the other direction: the game is no longer detecting automation, it is establishing authenticity.
Frequently Asked Questions
What breaks when users browse with agentic AI browsers?
The talk lists application tests, bot detection, DDoS protection, DLP, and authentication and authorization — controls that assume a human operating a browser, and that degrade when a legitimate user’s agent is doing the clicking.
Why is bot detection especially affected?
Because the distinction it relies on stops being meaningful. An agentic browser acting for a real user is automated and legitimate at the same time, so detecting automation no longer separates wanted traffic from unwanted.