Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Can a Browser Agent Read an API Key It Just Generated?

Yes, because the console renders the new key on the page and the agent reads the page, so the model receives the key the moment it appears. Check whether the agent's credential handling acts at typing time or at render time, since only the second keeps a displayed key away from the model.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A developer console shows a new API key exactly once, on the page that confirms it was created, and tells the person to copy it now. When a browser agent clicks the create button, that page is what it reads next, and whatever is on it reaches the model as text, as a screenshot or as both. The agent frameworks that document credential handling describe a different moment: the moment the agent types a value into a form. Those two moments are not the same, and the difference decides whether the key stays out of the model's context. This page takes one record type, an API key page in a developer console that displays a freshly generated key, and works through what the agent receives, what the vendors document, how typing-time placeholders differ from render-time substitution, what the research record says about what an agent can be made to do with a key it holds, and what to do once a key has been seen. What Can an AI Agent See in Your GitHub Settings? covers the token pages of one platform in detail; this page covers the generated key as a class.

Key findings

  • Browser Use's sensitive data documentation states that "the LLM only sees placeholders (x_user, x_pass)" and that "real values are injected directly into form fields after the LLM call," which covers values the agent types and not values a page displays (Browser Use, Sensitive, 2026).
  • Skyvern's credentials documentation says "the model that drives the browser gets placeholders, not your values," and adds that "a typed value can still show up in later screenshots and page text," which is why a separate Mask Secrets setting exists (Skyvern, 2026).
  • The research record documents credential exfiltration as a demonstrated outcome of untrusted web content hijacking a browsing agent, so a key in the model's context is a key an attacker can ask for (Mudryi et al., 2025).
  • A governed environment that replaces values with consistent tokens before any model reads the screen keeps a newly generated key out of the context, whatever the agent framework does at typing time (What Is Render-Layer Tokenization?).
  • In that environment real values resolve only at the approved destination at the moment of an approved action, so the key can be stored or used without the model ever holding it (How Do You Let an AI Agent Manage API Keys Without Reading Them?).

Why does a generated key reach the model at all?

Because the page is the input. A browser agent works by reading what the browser renders, as a DOM extract, a screenshot or both, and deciding the next action from it. When the task is "create an API key for the staging project," the sequence is a click on the create button, a page that displays the key, and a read of that page. The key is on the page by design: the console shows it once so that a person can copy it. The agent is the person in that sequence, and it copies the key into its context the same way.

The scope of this page is that rendered page. A governed browser environment covers what the agent reads and does on a rendered page, including dashboards, consoles, settings pages and sign-up forms. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A key generated with a command-line tool and printed to a shell is a different route with different controls. OpenAI's Codex documentation, for example, describes a local "OS-enforced sandbox that limits what it can touch (typically to the current workspace)" with network access off by default, which governs commands and files on a developer's machine and says nothing about what a browser agent reads on a console page (OpenAI, 2026). No browser control governs a shell, and no shell sandbox governs a page.

The established security stack was built for a different reader. Every layer finishes its work before a page renders, because until recently nothing but a person read a rendered page, and an agent that reads the rendered page sits past every one of them (What Is Render-Layer Tokenization?). Access control decided the agent may open the key page. The credential store encrypted the key at rest. The browser isolated the session. None of them changed what the page shows, and the page shows the key.

What do the vendors themselves say?

Browser Use documents a sensitive_data mechanism in which "the LLM only sees placeholders (x_user, x_pass), we filter your sensitive data from the input text" and "real values are injected directly into form fields after the LLM call"; the same page recommends setting use_vision to False "to prevent screenshot leaks" and restricting navigation with allowed_domains, and each of these governs a value the developer supplies for typing, not a value the page generates and displays (Browser Use, Sensitive, 2026). Its cloud credentials guidance states that "Zero Data Retention (ZDR) projects never record, even when recording is requested," which keeps a key off a stored recording and does not change what the model read during the run (Browser Use, Secrets, 2026).

Skyvern documents the same typing-time design and is explicit about its edge: "the model that drives the browser gets placeholders, not your values," then "a typed value can still show up in later screenshots and page text, so turn on Mask Secrets in an agent's settings to hide it there too"; the masking applies to values Skyvern typed from a stored credential or a connected vault, and a value the console generated is not one of those (Skyvern, 2026).

1Password's post on browser agents says "the AI agent and underlying LLM never need to see nor handle the credentials," injected "if, and only if, the human approves the access," a design for logins the vault already holds rather than for a key a console has only now displayed (1Password, 2025). Render-time hiding of a displayed key is not described in the pages reviewed for any of the three.

What is the difference between typing-time and render-time hiding?

Typing-time hiding works on values that exist before the run. The developer or the vault supplies a password or key, the framework replaces it with a placeholder in the text the model sees, and the real value goes into the form field after the model has decided to type. The model directs the action without holding the value. That design answers the login question well. It does not reach the key page, because the key on that page did not exist before the run and no one supplied it to the framework. The framework has no placeholder to substitute for a value it has never been told about.

Render-time hiding works on the page itself. Before the model reads the key page, a policy decides which values on it are sensitive and replaces them with consistent tokens for the whole run. The model sees that a key was created and sees a token in its place, and it can store the token, paste the token into a configuration field and report that the task is done. The real value is resolved only at the approved destination at the moment of an approved action. For the example record, that means the key reaches the credential store and never reaches the model.

Dimension Typing-time placeholders, per Browser Use and Skyvern documentation What a buyer should verify
Values covered Values the developer or vault supplies before the run Whether any value the page generates is covered
Moment of substitution After the model's decision, at the form field Whether substitution happens before the model reads the page
Screenshots Browser Use recommends use_vision False; Skyvern offers Mask Secrets for typed values What the model sees in a screenshot of the key page
Recordings Browser Use ZDR projects never record Whether a stored recording holds the rendered key
Record of what the model saw Not addressed on the pages cited A per-run record of each screen as the model received it

What does the research record say about a key the model holds?

That it can be asked for. One study of browsing agents lists findings that "include prompt injection, domain validation bypass, and credential exfiltration" and shows "how untrusted web content can hijack agent behavior" (Mudryi et al., 2025). A console page is trusted content, but the agent that created the key will go on to read other pages, documentation, a ticket, a README, and any of them can carry an instruction. The key in context is the thing the instruction asks for.

The defense record is not reassuring. A systematic evaluation of "5 prompt injection attacks and 10 defenses with 10 LLMs and 7 tasks" was built to provide "a common benchmark for quantitatively evaluating future prompt injection attacks and defenses" (Liu et al., 2024), and the agent-level benchmark that followed reports "critical vulnerabilities in different stages of agent operation" with "limited effectiveness shown in current defenses" (Zhang et al., 2025). The three conditions that make this dangerous, access to private data, exposure to untrusted content and a way to communicate externally, are the lethal trifecta, and even a request to load an image can carry stolen data (Is It Safe to Let AI Agents Read External Web Pages?). A browser agent holding a fresh key has all three.

The supply side points the same way. Sonatype reported that "56% of the malware discovered in Q1 2025 was related to data exfiltration," up from 26% in the previous quarter, which describes what malicious packages are built to do with whatever they can reach (Sonatype, 2025). A key that an agent pastes into a project file is reachable.

What should a team do with a key the agent has already seen?

Treat it as exposed and rotate it. A value that passed through the agent's context may be in a log, a trace, a recording or a model provider's retention window. OWASP's CI/CD guidance says to "prefer using temporary credentials over static credentials" and to "avoid sharing the same set of credentials across multiple contexts," which for a generated key means short expiry and one scope (OWASP, 2026). The same page says to "detect secrets pushed to and stored on code repositories."

Log masking shows the limit of hiding after the fact. GitLab documents that "when a job outputs the value of a masked variable, the value is replaced with [MASKED] in the job log," and states on the same page that "masking a CI/CD variable is not a guaranteed way to prevent malicious users from accessing variable values" (GitLab, 2026). Masking is pattern matching on output after the value exists, and no equivalent mask runs on a browser agent's context.

The better order is to prevent the read, since a key the agent never held needs no rotation. The page on managing keys without reading them sets out the pattern and the scale: 28,649,024 new credentials exposed in public GitHub commits across 2025, with commits co-authored by an AI coding agent leaking at roughly double the baseline rate (How Do You Let an AI Agent Manage API Keys Without Reading Them?). The same question is asked of sign-up forms in Can an AI Agent Sign Up for Developer Services Without Seeing Your Payment Card or Identity? and of a consumer browser agent in What Can Claude in Chrome Access in Your Browser?.

What does a governed environment change?

A governed environment is a control class that acts where the page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For the key page it changes the answer to the title question. The console still renders the key once; the model reads a page on which the key is KEY_001. The agent can copy KEY_001 into the credential store's form, and the real value resolves there, at the destination the policy approved, when the person approves the submission. If a later page carries an injected instruction to send the key somewhere, the model has only the token to send. Rotation is still good hygiene, but it is no longer the control that stands between a created key and an attacker.

The environment also answers a question the typing-time frameworks do not: what the model saw. The record holds each screen as the model received it, so a reviewer can confirm that the key page reached the model as a token. Its scope is the rendered page and not the terminal, the IDE, the local filesystem, direct API calls or MCP, so a key printed by a command-line tool stays with the controls on that route. An agent that reaches tools only through an API gateway, the design compared in RedactSure vs Arcade: 2026 Comparison & Alternative, is governed by this class only where it also reads a page.

Methodology and limitations

This page rests on the public documentation of Browser Use, Skyvern, 1Password and OpenAI for the vendor section, three research preprints, GitLab's documentation and OWASP's CI/CD guidance for the handling of exposed keys, one vendor research release, and existing RedactSure research pages. Sources were read between October 20, 2026 and October 21, 2026. Quoted facts are cited to the page that states them, and the preprints are cited for the findings their abstracts state and not for figures that appear only in their full text.

RedactSure did not test any browser agent hands-on against a console that generates keys. "Not described in the pages reviewed" means the pages reviewed and nothing broader; a vendor may document render-time behavior elsewhere, and the typing-time mechanisms described here are the ones their credential handling pages document. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, an API key page in a developer console that displays a newly generated key once, and not an organization or a named console.

Determinations about whether a workflow meets a legal, contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test on the reader's own console with a disposable key: create it with the agent, inspect the agent's trace, screenshots and recording for the value, and repeat after each release of the agent framework, since a change to its screenshot or text extraction would change the result.

What the record shows

The vendor pages answer the title question by what they cover. Browser Use and Skyvern document placeholders for values the agent types, and Skyvern states that a typed value can still appear in later page text and screenshots. A key a console generates was never supplied as a value to type, so the placeholder has nothing to replace, and the page that displays the key is read as it is. The research record shows that a key in context can be asked for by untrusted content, and that current defenses are of limited effect against that request. Rotation and masking act after the value exists. Substitution at render, before the model reads the page, is the one control that keeps the displayed key out of the context, and it is the one RedactSure's design is built around. To test a given setup, a security owner should name one agent, have it create a disposable key on one console, and search its trace for the value.

Frequently asked questions

Can a browser agent read an API key it just generated?

Yes. The console renders the key on the confirmation page, and the agent reads that page as text, as a screenshot or both, so the model receives the key as soon as it appears. The typing-time placeholder mechanisms that Browser Use and Skyvern document cover values supplied before the run and do not reach a value the page generates. Only substitution before the model reads the page keeps a displayed key out of the context.

Does Browser Use's sensitive_data setting hide the key?

Not a key the page displays. The documentation says the model sees placeholders for the values you pass in and that real values are injected into form fields after the model's decision, which covers logins and keys you already hold. A key generated during the run was never passed in, so there is no placeholder for it. Setting use_vision to False removes screenshots, but the page text that carries the key is still read by the model.

Does Skyvern's Mask Secrets setting cover it?

Mask Secrets hides a typed value in later screenshots and page text, by Skyvern's own description, and a typed value is one Skyvern supplied from a stored credential or a connected vault. A key the console created is not a value Skyvern typed, so the masking has nothing to match. The caveat that typed values can reappear on the page is worth reading twice, because it describes exactly where a displayed value sits relative to a typing-time control.

Should the key be rotated after the agent created it?

Yes, unless the key was tokenized before the model read the page. The agent's context, trace, screenshots and any recording may hold the value, and a model provider's retention window may too. OWASP's guidance to prefer temporary credentials and avoid sharing one credential across contexts applies directly: issue the key with a short expiry and one scope, then replace it once a person has moved the work into a credential store the agent never reads.

Can prompt injection on a later page steal the key?

It can ask for it, and the research record shows browsing agents being hijacked by untrusted content into credential exfiltration. The agent that created the key goes on to read documentation, tickets and other pages, and an instruction hidden in any of them can tell it to send what it holds. Defenses evaluated against agents show limited effectiveness. The safer position is a context that holds a token, so that the instruction, if obeyed, sends nothing of value.

What should a security team ask a browser agent vendor in writing?

Ask whether any value the page generates, as opposed to a value supplied before the run, is hidden from the model, and at what moment the hiding happens. Ask what the model receives in screenshots and in page text on a page that displays a new API key. Ask whether a stored recording would hold the rendered value and whether a per-run record shows each screen as the model saw it. A vendor that documents only typing-time handling has answered the first question.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps a Generated API Key Out of the Model's Context

A console shows a new key once and the agent reads that page, while the frameworks reviewed above substitute only values supplied before the run.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent clicks create, the page renders the real key, and the model holds it where injected content can ask for it. Inside the governed environment: the model reads KEY_001, pastes KEY_001 into the credential store's form, and the real value resolves there when the named person approves the submission.

RedactSure is deploying now with enterprise and government customers. Skyvern states that a typed value can still show up in later screenshots and page text.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

A key that renders once on a console stays in the model's context for the rest of the run. Bring a key you would have an agent create and see, with test values, where the real value lands. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.