Agents need somewhere to run.
That sentence is doing more work in enterprise security right now than most threat models acknowledge. On September 24, 2026, Island announced a $400 million Series F led by Evolution Equity Partners at a $6.4 billion valuation, more than double its 2024 mark. The company built its business on the enterprise browser and is now pushing outward into broader corporate systems, with AI agent security as the stated reason.
I want to look at why the browser, of all places, became the control point people are willing to pay this much for.
The execution surface nobody designed for autonomy
When we talk about agent architecture in research settings, we tend to talk about planning loops, tool schemas, memory layers, and evaluation harnesses. What we talk about far less is the substrate where those tool calls land. In an enterprise, that substrate is overwhelmingly the browser. Your CRM is a web app. Your ticketing system is a web app. Your HR portal, your billing console, your internal dashboards, your cloud admin panels — all web apps, all authenticated through session cookies and SSO tokens that live inside a browser profile.
The browser was designed around a specific trust assumption: a human is present, reading the page, deciding what to click. Nearly every security control layered on top inherits that assumption. Consent dialogs assume someone reads them. Phishing defenses assume someone notices the URL. Rate-limiting heuristics assume human-speed interaction. Step-up authentication assumes a person who can be prompted.
Take the human out and put a language model in the driver’s seat, and those assumptions do not degrade gracefully. They invert. An agent reads the page as instructions, not as content. The same session token that let Alice check one invoice now lets an autonomous process iterate through ten thousand of them in a minute. The consent dialog gets clicked because clicking things that look like progress is what the policy learned to do.
Why the control point matters more than the model
Most agent security discussion fixates on the model layer: better refusals, prompt injection classifiers, constitutional training, sandboxed tool definitions. Those matter. They are also insufficient in a structural way that I think deserves more attention.
Model-layer defenses are probabilistic. They reduce the rate of bad actions. They do not create enforceable invariants. And enterprise security is built almost entirely on enforceable invariants — this identity may touch this resource, this action requires this approval, this data class never crosses this boundary. You cannot express those as a system prompt and call it a control.
Which is why the interesting question is not “how do we make the agent behave” but “where do we put the wall.” A few candidate locations, each with tradeoffs:
- The model API. Easy to instrument, but blind to enterprise context. It does not know what your data classifications are.
- The network layer. Sees traffic, but modern web apps are opaque over TLS. Intent is invisible at the packet level.
- The application. Correct in principle, wrong in practice. You are not retrofitting agent-aware authorization into every SaaS vendor you use.
- The browser. Sits exactly where identity, session, rendered content, and user action converge.
That last position is unusually well placed. It is the only layer that simultaneously knows who is authenticated, what the page actually says after rendering, and what action is about to be taken. For agents, that triple is the whole ballgame. Detecting a prompt injection buried in a rendered support ticket requires seeing the rendered DOM. Deciding whether an action is permitted requires knowing the identity. Blocking it requires sitting in the execution path.
What doubling the valuation actually signals
Island’s expansion beyond the browser into broader corporate systems reads, to me, less like a pivot and more like an admission that agents do not stay in their lane. An agent that starts a workflow in a web console finishes it against an API, a file share, or a database. A control point that only covers one hop leaves the rest of the chain unguarded, and attackers optimize for the unguarded hop.
The funding number itself is the market pricing a problem it has decided is real. Enterprises are deploying agents faster than they are deploying any way to constrain them. The capability curve and the control curve have visibly diverged, and capital is flowing toward whoever can narrow that gap.
For those of us working on agent architecture, the design lesson is uncomfortable but clear. Autonomy is not a feature you add to a model. It is a property of a system that includes identity, session state, and an execution surface built for humans. Ship the agent without redesigning that surface and you have not deployed an assistant. You have handed a credential to a process that cannot be reasoned with.
đź•’ Published: