For the past year, a quiet but serious debate has been running inside IT and risk teams at large companies: can you trust an AI agent to browse the internet on behalf of your business, and if so, how do you stop it doing something catastrophic?
The concern is not theoretical. Security researchers found in 2025 that malicious instructions hidden inside web pages can trick AI agents into leaking private data or taking actions the user never asked for. One vulnerability discovered in a widely used browser automation library affected over 1,500 separate AI projects at once. By December 2025, Gartner was formally advising chief information security officers to block consumer-grade AI browsers from their environments altogether.
Amazon's response, released in March 2026 through its AgentCore platform, is to let organisations apply the same browser control rules that IT teams already use to manage employee laptops. These are known as Chrome enterprise policies, a set of over 100 configurable rules built into the Google Chrome browser. With this update, a company can tell an AI agent: you may only visit these specific websites, you may not save any passwords, you may not download files, and you may not access developer tools. Those rules are enforced at the browser itself, not just written into the agent's instructions. An agent cannot reason its way around them.
This distinction matters enormously. Telling an AI agent in its prompt not to visit social media is like telling a new employee not to visit social media on their work laptop but never blocking the sites. The new approach is the IT equivalent of actually blocking them.
AWS launched the broader AgentCore platform in July 2025 and made it generally available in October 2025. The Chrome policy controls and the ability to connect agents to internal corporate networks are the latest additions, now live across 14 regions worldwide, covering North America, Europe, and Asia-Pacific.
The internal network piece is the less-discussed but equally important part of this update. Many organisations run internal systems, from HR portals to finance tools to procurement platforms, on private networks using security certificates that were not issued by a public authority. Any outside system trying to connect to those internal tools gets a security error and cannot proceed. AgentCore now lets organisations upload their internal security credentials so that agents can reach those systems without disabling security checks entirely. For an invoice processing agent that needs to talk to an internal vendor portal, this is the difference between working and not working.
Regulators are paying attention to all of this. The EU AI Act, which came into force in 2025, requires organisations to categorise their AI systems by risk level and document how high-risk ones are controlled. An AI agent that can browse freely is much harder to document and defend to an auditor than one with a defined whitelist of permitted sites and a full session recording showing exactly what it visited. That audit trail is now built into the AgentCore platform.
The broader race among cloud providers to offer governance-ready AI agent infrastructure is intensifying. Microsoft, Google, and AWS are all competing to be the platform that organisations trust enough to run production agents on, rather than just experiments. The organisations most likely to benefit from these controls in the near term are those in financial services, insurance, healthcare, and manufacturing, where agents could add enormous value on routine web tasks, but where compliance teams have blocked deployment precisely because no one could answer the question: what happens if the agent goes somewhere it should not?