Yes, for some of your students' online tasks, and nobody outside your building can tell you which. An AI agent is software that operates a web browser the way a person does: it logs in, reads the page, clicks, types and submits. Faculty at California community colleges, a major learning-platform vendor and several university technology teams have all reported that these agents can sit inside a student's learning platform and finish quizzes, discussion posts and written assignments. What none of them has published is a controlled test. So the first job for a principal is not to buy a detector or write a ban. It is to find out what is true of your own platform.
Can an AI agent really log in and do a student's online work?
Reports say it can, and the reports come from people with reason to know. A white paper from the California Virtual Campus, published in November 2025, states that faculty at California community colleges "report that these tools can log in to Canvas and complete quizzes, discussions, and assignments on behalf of students". It names Perplexity Comet and ChatGPT Agents among the tools. Blackboard's February 2026 position statement says agents can complete "assignments, discussions, and more" once a student shares credentials, and concedes that AI agents "cannot be identified or blocked by vendors of learning technology working in isolation".
The sharpest example came in February 2026, when Inside Higher Ed reported on Einstein, a tool whose launch copy promised that it logs into Canvas daily, watches lectures, writes papers, joins discussions and submits homework automatically. The University of Missouri System's academic technology team is more measured. Its guidance for faculty says agents can take tests and complete some kinds of assignments, and also that they may hallucinate, run slowly and get stuck.
Read those sources closely and a pattern appears. Every capability claim rests on faculty reports, vendor statements or demonstrations. I found no published test with a method, a sample and completion rates, and the reporting I read concerns higher education and online programs. None of it measures a secondary school's homework platform. That is the honest state of the evidence, and it is why the test below matters more than any article, including this one.
What is the Agent Audit?
The Agent Audit is a three-step check I suggest a leadership team runs before changing any assessment policy: first, test what an AI agent can actually complete on your own learning platform, using a test account and no real student data; second, sort every graded task by whether it needs the student present, needs process evidence, or needs only a submitted file; third, move the marks that matter to the first two groups. A school that has run the first step knows what is true of its own platform. A school that has not is relying on vendor demos and opinion. This is my suggested way of thinking, not a validated instrument.
Step one: test your own platform
The test takes about thirty minutes and one conversation with your IT lead first. The University of Missouri guidance advises against using agents on institutional accounts without consulting IT, and I would go further: build a dummy course with a dummy student account, and put no real names, grades or records anywhere near it.
Set five tasks in that course: an auto-marked quiz, a discussion post, a short written submission, a file upload, and a timed task. Give a current agentic browser the plainest instruction you can, something like "complete this assignment," and watch. Record for each task whether the agent finished it unaided, finished it with prompting, or failed. Note how long it took, and note whether your platform's logs showed anything unusual.
Do not generalize from one run. Agents change monthly, so write the date and the product version beside your results and repeat the test each term. Whatever you find is hypothetical until you have run it; do not take anyone's word for your platform, including mine.
Step two: sort every graded task
Your results will sort tasks more cleanly than a policy debate will. Put each graded task into one of three groups.
| Group | What the task needs | Examples | Does an agent defeat it? |
|---|---|---|---|
| Presence | The student in the room, speaking or performing | Oral defense, practical, in-class write-up, live discussion | Not by logging in, because there is no login to use |
| Process | A visible route to the answer | Drafts with version history, a two-minute recorded explanation, teacher check-ins | Harder, because the route has to exist, not just the file |
| File or click | Only a submitted file or a quiz answer | Auto-marked quiz, forum post, uploaded essay | This is the group your test should examine first |
The third group is not a problem in itself. It is a problem when marks that decide something sit wholly inside it. A practice quiz exists to teach, and if an agent completes it, the student has simply skipped their own learning. A mark that feeds a report, a placement or a qualification is different.
Step three: move the marks that matter
Move high-stakes marks toward presence or process, and leave low-stakes practice where it is. Blackboard's statement points to Harvard pairing AI-integrated tasks with an oral defense and to Vanderbilt using localized tasks and personal reflection. You do not need to match a university's scale. One short conversation about a submitted essay changes what the essay is evidence of.
What I see in practice
The mistake I see most often is a leadership team answering a technical question with a policy. Across the leadership teams I work with, the first reaction to a story like Einstein is to look for something to buy that detects it, or something to write that bans it. Neither tells them what happened on their own platform, and the learning-platform vendor that has commented says it cannot identify agents working alone. As a former Director of Digital Strategy in further education, I learned to put one question to any digital policy: what does the system actually do when a student breaks the rule? A rule the platform cannot enforce is a hope.
Detection fails for the same reason it failed with text. My article on whether AI detectors actually work sets out why a score cannot carry a decision about a child, and an agent that acts like a user is harder to catch than a pasted essay, not easier. The more useful move is the one I describe in what happens to assessment when AI can produce excellent work: treat any task whose only evidence is a finished artifact made out of your sight as having stopped being evidence.
Who else needs to be in the room?
Your IT or data protection lead, because an agent is a data question as well as an integrity one. An agent acting in a student's session sees whatever that session sees, and the University of Missouri guidance warns that agents need broad access to the browser and may reach restricted information such as a class roster. For adjacent evidence, a 2025 audit of ten popular browser-assistant extensions (a related but different technology, not agentic browsers) found that some sent full page content, and sometimes form inputs, to their vendors' servers. In the United States, the Family Educational Rights and Privacy Act (FERPA) applies to schools that receive federal education funds, and the Department of Education's student privacy site is the place to start with questions about education records. In England, the same conversation belongs with your data protection officer. My piece on whether staff can put student data into ChatGPT covers the staff side of the same problem.
Ask your IT lead three things: whether students can authenticate with shared or long-lived tokens, whether the platform can require stronger sign-in for high-stakes tasks, and whether anyone reviews timing patterns on assessments. The California Virtual Campus paper recommends eliminating student tokens where possible and reviewing sign-in policies, and notes that no single technical fix exists for every context.
What should you not do?
Do not move everything to the exam hall. The California paper warns that a shift to in-person proctoring or handwritten exams can harm access for adult learners, students with disabilities and fully online students. That caution bites hardest in colleges and online programs, and I cover those differences in AI in further education: what a college principal decides. Most secondary schools have the student in the building, so presence is easier for you to arrange than it is for an online college.
Do not treat any technical block as a catch-all either: if no vendor working alone can identify or block an agent, no single setting will settle the question for you. And do not skip the awarding body. For qualifications in England, the Joint Council for Qualifications (JCQ) guidance AI Use in Assessments, effective from September 2026, says teachers and assessors "must only accept work for qualification assessments which is the students' own", and that false declarations of authenticity can bring sanctions including disqualification. An agent that does the coursework is that problem arriving by a new route. My article for heads of department on AI and coursework turns the rule into a department statement.
What should you do this month?
Run the test, sort the tasks and move one high-stakes mark, in that order. Within the month, that means four actions.
- Ask your IT lead to set up a dummy course and student account, and agree the ground rules for testing.
- Run the five-task test, and write the date, the product and the results in one table.
- Sort every graded task into presence, process or file-or-click, and list the marks that sit wholly in the third group.
- Choose one of those marks and add a short oral or recorded check, then tell students and parents why.
Tell your students the rule as well. If your acceptable use policy does not yet say that letting software act as a student, with or without their login, counts as the same breach as submitting someone else's work, add that sentence. Policy cannot stop an agent, but it removes the excuse that nobody said.
The next step
If your leadership team is working through how to assess learning when software can act as the student, this is the kind of work I support through AI strategy sessions for schools and leadership briefings. If you are planning a conference or board session on the subject, my education keynotes cover it, and the newsletter tracks what changes.
Sources and further reading
- California Virtual Campus, "Safeguarding Academic Integrity in the Age of Agentic AI," white paper, November 2025. PDF.
- Blackboard (Anthology), "Responding to the Threat of AI Agents in Pedagogy," position statement, February 2026. Page.
- Kathryn Palmer, "Agentic AI Can Complete Whole Courses for Students. Now What?", Inside Higher Ed, February 26, 2026. Article.
- University of Missouri System, UM Academic Technology, "AI Agents: Guidelines and Concerns," undated, apparently late 2025. Page.
- Joint Council for Qualifications, "AI Use in Assessments: Your role in protecting the integrity of qualifications," effective September 2026. PDF.
- Vekaria et al., "Big Help or Big Brother? Auditing Tracking, Profiling, and Personalization in Generative AI Assistants," arXiv 2503.16586, June 2025 (v2). Abstract.
- U.S. Department of Education, Student Privacy Policy Office, "FERPA." Site.
Dan Fitzpatrick is the founder of The AI Educator, a Forbes contributor and the author of bestselling books on AI in education. Read more about Dan.
