Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?

Yes, on every step, because the rendered page is the prompt: whatever the customer record shows, the model receives, and the only open question is whether the agent also sends it somewhere. Check what each screen passes to the model and what a page read with placeholders leaves to copy.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A browser agent needs no instruction to copy a customer record into its prompt; reading the page is the copy. Every field a web application renders for the agent, from the account holder's name to the open balance, becomes model input on that step, and the controls most teams rely on govern what the agent may do with that input afterward rather than what it took in. This page follows one record, a customer account page in a CRM, through the steps a browser agent takes and asks at each one where the data sits. It draws on research into browsing agents and agent benchmarks, on vendor documentation for credential handling, saved browser sessions, cloud sessions and coding sandboxes, and on OWASP's entries for sensitive information disclosure and excessive agency. The documented controls keep credentials out of the model and limit what the agent may do, while every field on the open page still reaches it, so the customer data itself sits outside the controls a team would show an auditor. What Is Indirect Prompt Injection and How Does It Reach AI Agents? explains how untrusted content on the same page can direct the agent, and What Is Render-Layer Tokenization? describes the control that acts before the page is read.

Key findings

  • A browsing agent's prompt is built from the page it reads, and Mudryi, Chaklosh and Wojcik report findings that "include prompt injection, domain validation bypass, and credential exfiltration" once untrusted web content reaches that prompt (Mudryi et al., 2025).
  • OWASP lists sensitive information disclosure as the second entry in its 2025 Top 10 for LLM applications, the category a copied customer record falls into when a model repeats, stores or forwards what it read (OWASP, LLM02:2025, 2025).
  • Agent Security Bench reports that its results "reveal critical vulnerabilities in different stages of agent operation" with "limited effectiveness shown in current defenses," so a team cannot assume the copy stays where the model put it (Zhang et al., 2025).
  • 1Password and Browserbase state that with Secure Agentic Autofill "credentials are not shared with the LLM," which keeps the login out of the prompt and says nothing about the customer record the login opens (1Password and Browserbase, 2025).
  • A governed environment that replaces values with consistent tokens before any model reads the screen leaves the model a customer page with nothing to copy but placeholders (What Is Render-Layer Tokenization?).
  • Real values resolve only at the approved destination at the moment of an approved action, so the record reaches the system it was meant for and not the prompt, the transcript or an attacker's endpoint (What Is the PII Wall?).

What does a browser agent receive when it opens a customer record?

The record for this page is an account page in a CRM showing the account holder's name, email address, phone number, billing address, account number and a notes field. A browser agent opening it has the page, as text, an accessibility tree or a screenshot, serialized into the model's context. There is no separate copy step. The read is the copy, and it repeats on every step, because each new page state is fed to the model again.

The answer is therefore yes; the copy is how the agent works, and the risk lies in what happens to the content once the model holds it. Mudryi, Chaklosh and Wojcik report that their findings "include prompt injection, domain validation bypass, and credential exfiltration" and that "untrusted web content can hijack agent behavior" (Mudryi et al., 2025). The agent that reads the customer record also reads whatever else the page carries, including text an attacker placed in the notes field, which What Is Indirect Prompt Injection and How Does It Reach AI Agents? traces to Greshake and colleagues.

The scope of this page is the rendered page. A governed browser environment covers what the agent reads and does on a page, including dashboards, consoles, settings pages and sign-up forms; it does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. OpenAI draws the other line for Codex, which locally "uses an OS-enforced sandbox that limits what it can touch" and by default "runs with network access turned off," a boundary around files and commands on the developer's machine and not around any page a browser agent reads (OpenAI, 2026).

Where does the page content go after the model reads it?

Once the record is in the context, it can travel along 4 paths: the model's output; the agent's transcript or log; memory carried into later requests; and a destination the model chooses, the path an injected instruction uses. OWASP's second entry in its 2025 Top 10 for LLM applications is sensitive information disclosure (OWASP, LLM02:2025, 2025), and its title covers each path.

The research record shows the 4th path is reachable. Agent Security Bench reports that its results "reveal critical vulnerabilities in different stages of agent operation" and "limited effectiveness shown in current defenses" (Zhang et al., 2025). Does Prompt Injection Expose Customer Records? reports a University of Zurich study in which simple injections asking agents to leak observed personal data succeeded around 20 percent of the time, and Can an AI Agent Sign Up for Developer Services Without Seeing Your Payment Card or Identity? reports an environmental injection attack reaching up to 70 percent on sign-up forms.

The 3rd path, persistence, has a long tail. Huang and colleagues found that neural code completion tools "can not only return the precise piece of their training data" they memorized, and that "two valid credentials were identified during our experiments" (Huang et al., Your, 2024). The study concerns training data rather than an agent's context, and it is cited for the principle: a value that enters a model's input can come back out later, to another user, which applies to a transcript kept to tune the next model.

What do the vendors themselves say?

Vendors document how to keep one class of value out of the model: the credential. 1Password and Browserbase describe Secure Agentic Autofill, which "allows AI agents to authenticate with web services without ever exposing credentials," with "real-time approval prompts via 1Password mobile or desktop"; it governs the login, not what the model receives from the page the login opens (1Password and Browserbase, 2025). Browserbase's authentication guidance tells a developer to "log in once, then reuse the saved authentication state" through Contexts that store cookies and session tokens, which keeps the agent signed in to the CRM across runs and leaves the record as readable on every run (Browserbase, Authentication, 2026).

Meta states that "Muse runs on its own dedicated computer in the cloud" and that it "checks with the person before sensitive actions like sending an email or making a purchase"; the computer separates the agent from other users and the check governs actions; neither describes which fields the model is shown on an open page (Meta, 2026). AWS's AssumeRole "returns a set of temporary security credentials" for a duration that "can range from 900 seconds (15 minutes) up to the maximum session duration set for the role," which bounds what an agent can do in a cloud account, not what it reads from a console page (AWS, 2026).

Vendor control Kept out of the model, per its documentation What a buyer should verify
1Password with Browserbase The credential What the model receives after login
Browserbase Contexts Repeated logins Which pages the saved session opens unattended
Meta Muse Sensitive actions without a check Which fields the model is shown
AWS AssumeRole Durable keys Whether console pages are read in full

Does limiting what the agent can do limit what it reads?

No, and the distinction matters because most available controls act on the action side. OWASP defines excessive agency as "the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM" (OWASP, LLM06:2025, 2025). A model that reads a full customer record and takes no damaging action has not triggered it, though the record is now in the prompt and the log.

Simon Willison's survey of design patterns makes the same point. The patterns "constrain the actions of agents to explicitly prevent them from solving arbitrary tasks," and under the action-selector pattern "agents can trigger tools, but cannot be exposed to or act on the responses from those tools" (Willison, 2025). That pattern works by restricting what reaches the model, not what the model may do; a browser agent whose task is to read the page cannot adopt it wholesale, so the useful question becomes what the page shows the model.

Human approval sits on the same side as excessive agency: it gates the send or the record change. Does Human Approval Stop Actions Triggered by Prompt Injection? describes HITL dialog forging, which OWASP catalogs as Lies-in-the-Loop, in which the dialog is manipulated so a person authorizes what they would have refused. Even when the dialog is honest, approval happens after the read: the approver sees a request to send an email, and the model has already held the account number for 30 steps. A per-task policy on what the model receives acts before approval has anything to review, and the two controls are complementary.

What does a page read with placeholders leave to copy?

Substitution is an established pattern at the output end of a pipeline. GitLab documents that "when a job outputs the value of a masked variable, the value is replaced with [MASKED] in the job log," and states that masking "is not a guaranteed way to prevent malicious users from accessing variable values" (GitLab, 2026). Masking at the log acts after the value has been in the job's memory, so a job that encodes or splits the value gets around it; a control at the input has no such gap, because a value the model never received cannot be encoded, split or sent.

For the customer record, that means replacing the fields chosen by policy before the page reaches the model. The account holder's name becomes CUST_014, the account number ACCT_002, consistently for the whole run, so the model can still direct a billing update to ACCT_002 and the action lands on the right record. What Is Render-Layer Tokenization? explains why this layer is the only one positioned to do it: every established layer of the security stack finishes its work before a page renders, so an agent reading the rendered page is invisible to the layers below.

What Is the PII Wall? frames the stakes: McKinsey's State of AI research finds 62 percent of organizations at least experimenting with AI agents and 23 percent scaling them anywhere, and the gap between those numbers holds the teams that could not answer this page's question to their security office. The habit that closes it is to ask, per workflow, which fields the model needs as values and which only as handles, the distinction How Do You Let an AI Agent Manage API Keys Without Reading Them? applies to keys.

What does a governed environment change?

A governed environment is a control class that acts on the rendered page, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the customer record enters the prompt as CUST_014, ACCT_002 and placeholders of matching shape, and the model plans and acts on those. Real values resolve only at an approved destination, at the moment of an approved action, so the billing system receives the account number and the prompt, the transcript and any endpoint an injected instruction names do not. A named person confirms the tokenization policy for the workflow and approves each consequential action, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For the title question, the change is to the answer itself. The agent still copies the page into its prompt on every step; what it copies is a page that holds nothing an attacker or a log can use. The 4 paths described earlier stay open, and each carries placeholders. The disclosure OWASP describes needs a value to disclose, and the "damaging actions" in the excessive agency entry need a real account number or address to damage. The approval step keeps its purpose, because a person still decides whether the record change happens, and gains a property it lacked: the approver is the only point at which the real value appears.

The scope is the rendered page. The class does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, and a coding agent's workspace stays with the sandbox and permission settings that cover it. The record of what the model saw on each step is the artifact none of the vendor pages above describes, and it is the one a security review can read after the run.

Methodology and limitations

This page rests on 3 research preprints on browsing agents, agent benchmarks and credential memorization, vendor documentation and announcements from 1Password and Browserbase, Browserbase, AWS, OpenAI, GitLab and Meta, 2 OWASP Top 10 entries, a practitioner survey of design patterns, and existing RedactSure research pages. Vendor pages were read as of October 20, 2026. Quoted facts are cited to the page that states them, figures reported by other pages are cited as reported, and the OWASP entries are cited for their definitions and titles.

RedactSure did not test any browser agent, credential tool or cloud service hands-on. "Not described in the pages reviewed" means the pages reviewed and nothing broader. The vendor table summarizes documentation as read and is not a configuration guide. The research preprints concern browsing agents, agent benchmarks and code completion tools in general and are cited for the finding each abstract states, not for a measurement of any product named here. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a customer account page in a CRM, and not an organization.

Determinations about whether an agent's handling of customer data meets a legal, contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test of the organization's own browser agent against a copy of its own customer page, repeated after each release, since a change to how the agent serializes a page or stores a transcript would change the answer.

What the record shows

The answer is yes, and the evidence makes it an ordinary yes rather than an alarming one. A browser agent copies the page into its prompt on every step because that is the mechanism, and the research on browsing agents, agent benchmarks and memorization shows that content in a prompt can be exfiltrated, acted on or returned later. The vendor pages reviewed keep the credential out of the model, keep the session alive, bound what a cloud session may do and ask a person before a sensitive action; none describes which fields of an open page the model is shown or keeps a record of it. The one control that changes the copy is a page read with placeholders, which leaves the 4 paths open and empties them. A single test task shows whether that holds for a given deployment: name one agent and one customer page, run it, and read back what the model received on each step and whether an account number was among it.

Frequently asked questions

Does a browser agent copy the whole page or only the fields it needs?

The whole page, as the agent's framework serializes it, whether as text, an accessibility tree or a screenshot. The model is handed the page so it can choose the next action, and it cannot choose fields before it has read them. A customer account page therefore enters the prompt with the name, contact details, account number and notes field together, on every step the page is open, and the model has no mechanism of its own to decline a field.

Is this the same as a data breach?

Not by itself. The copy is the agent's working method, and the record stays inside the organization's own environment until something moves it. The paths out are the model's output, the transcript, memory carried into later requests and a destination the model chooses, which is the path an injected instruction uses. OWASP's sensitive information disclosure entry covers the result when any of those paths carries a value the owner did not intend to disclose.

If the agent signs in through a credential manager, is the customer data protected?

The credential is. 1Password and Browserbase document that credentials are not shared with the LLM, which protects the login and not the page it opens, and Browserbase's Contexts let the agent reuse a saved session, which keeps the record reachable without a person present. Neither describes what the model receives from the open page, so the customer record is as readable with a credential manager as without one. Ask the credential vendor what the model sees after authentication, because that is where the record lives.

Does human approval stop the data from being copied?

No. Approval gates an action, such as sending an email or changing a record, and it happens after the model has read the page. By the time an approver sees a request, the account number has been in the prompt for every step since the page opened. Approval dialogs can also be forged, a pattern OWASP catalogs as Lies-in-the-Loop. Approval remains worth keeping for the action it gates, as a control on consequences rather than on reading.

What does a page read with placeholders change for an attacker?

An injected instruction still runs, but the values it can collect are tokens. "Send the customer's details to this address" moves CUST_014 and ACCT_002, which resolve to nothing outside the governed environment, and the real values appear only at the destination a named person approved. The approach differs from masking a log, which acts after a value has been in memory and which GitLab describes as not guaranteed. A value the model never held cannot be encoded, split or sent anywhere.

What should a security team ask a browser agent vendor in writing?

Ask what the model receives on each step and in what form, whether any field can be withheld or replaced before the model reads it, where transcripts are stored and for how long, whether transcripts are used to train or evaluate models, who approves each consequential action and what record shows what the model saw. Treat anything the vendor does not document as unanswered. Then run one task on a copy of a customer page and compare the answers with the record.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps a Customer Record Out of the Prompt

A browser agent copies the customer record by reading the page, and the controls reviewed above act after that read without deciding which fields the model is shown.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the model receives the name, billing address and account number in the clear; they sit in the transcript, open to any endpoint an injected note names. Inside the governed environment: the model meets CUST_014 and ACCT_002 on every step, and the real account number reaches the billing system only on the named approver's confirmation.

RedactSure is deploying now with enterprise and government customers. Injections asking agents to leak observed personal data succeeded around 20 percent of the time.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

Your privacy review will ask which customer fields an agent read, and that is settled before the read. Bring a web app task that opens customer records and see, with test values, the fields the model receives. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.