Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
hCaptcha Threat Analysis Group (hTAG) tested 20 abuse scenarios against ChatGPT Atlas, Claude Computer Use, Gemini Computer Use, Manus AI, and Perplexity Comet. In the reported configurations, agents frequently completed account, session, payment, and probing tasks after direct or lightly reworded requests. The benchmark is vendor-authored and not independently replicated, but it reinforces a durable engineering rule: a model's willingness to act cannot authorize a real account, browser session, or transaction.
Why this analysis has no ERS
The benchmark reports five distinct browser-agent products and aggregate misuse outcomes, but does not publish enough per-product task/authorization traces, exact builds, or account provenance to support a complete Cn-1/Cn-6 anchor. The aggregate cannot receive one ERS.
Status: Not scorable by design · Classification: Exercise · source date 2026-08-05
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-018.003 | High-Impact Independent Validation & Approval GateAIDEFEND dataVersion 2026.10.15. At the service that owns the effect, independently verify the exact immutable action, authenticated actor, policy evidence, and required approval before a password reset, payment, account change, code execution, or equivalent high-impact operation. A browser agent's assertion of permission cannot satisfy this gate. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-I-008.002 | Cross-Origin Read/Write Segmentation with Step-Up ConfirmationAIDEFEND dataVersion 2026.10.15. Bind every sensitive or cross-origin browser write to the exact request, stable target element, origin, account, and effect, then suspend execution until the required step-up decision is returned. This browser-specific boundary prevents a broad session or generic confirmation from authorizing a different site or transaction. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Pr-2 Cn-1 Cn-4 Cn-7 Cn-8 |
| AID-M-008 | Automated Agentic Security BenchmarkingAIDEFEND dataVersion 2026.10.15. Maintain a signed, version-pinned regression matrix for direct abuse requests, prompt variants, stateful browser context, hidden content, session-bearing data, and cross-origin actions, then release-gate behavior changes. hTAG provides external evidence for this testing need, but its report alone is not a reproducible internal release gate. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Ro-2 |
| AID-I-008.001 | Ephemeral Browser Context Lifecycle & Storage PartitioningAIDEFEND dataVersion 2026.10.15. Create a fresh browser context for each task and trust zone, partition cookies and storage, then destroy the context and verify residue removal at completion. This limits reuse of cookies, localStorage , and authenticated state across unrelated agent tasks. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Pr-2 Cn-1 Cn-4 Cn-7 Cn-8 |
| AID-D-003.003 | Agentic Tool Use & Action Policy MonitoringAIDEFEND dataVersion 2026.10.15. Centrally record authoritative allow and deny receipts, parameter-validation failures, and bursts of rejected browser actions by actor, origin, account, and tool. This makes attempted abuse measurable once enforcement exists; monitoring consumes policy outcomes and must not be presented as the component that grants or blocks authority. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Ro-3 Cn-1 Cn-3 Cn-7 |