An authenticated browser session is a live browser state where the user is already logged in and the site recognizes the browser as trusted. The session usually carries cookies, tokens, or other credentials that let the browser act as that user without re-entering a password.
This matters because attackers may target the session instead of the password. If malicious content, a browser extension, or an AI browser agent can issue actions inside an authenticated session, it may send messages, change settings, or access data with the user’s authority. In practice, this creates a session-abuse risk: the account is not “broken into” in the classic sense, but it can still be misused while the session remains valid. Defenders reduce the danger by shortening session lifetimes, requiring step-up approval for sensitive actions, limiting permissions, and treating untrusted page content as hostile input.