Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can a Government Agency Allow Comet on Case Files?
Not on case files: Comet reads the page it opens, so a benefits record with a Social Security number and address reaches a consumer assistant whose retention and agency terms are not described. Allow it on public pages, and settle what the model receives, who approves a case action and what record the run leaves.
An agency weighing Comet starts with its benefits case file, which holds a name, a Social Security number, a street address, a benefit amount and the notes that explain a decision. On the screen where a caseworker reviews it, all of that renders at once, and an agent asked to summarize the file reads the screen rather than the two fields the task needs. Comet is a consumer browser with an assistant inside it, sold on what the assistant can do with a page, and its vendor's account of the defenses covers what happens before the agent acts, not what the model holds once the page opens. That difference decides the question an agency faces, because a Privacy Act record carries the identifiers that make a case file worth protecting, and the agency, not the browser vendor, answers for what happens to them. Public pages can be handed to an assistant without a second thought. A case file cannot, until three things exist in writing: a token in place of each value before the model reads the screen, a named person approving every action that changes the case, and a record of what the model received that the agency can produce.
Key findings
- For Comet to be allowed on a case file, the rendered page would have to show the model a token in place of the Social Security number and the address, so the agent works on CASE_014 and the values stay behind the render (What Is Render-Layer Tokenization?).
- It would also require a named person approving each case action and a record of what the model received, held by the agency rather than the vendor (What Is an AI Control Record?).
- The gap sits on the page: Perplexity's account of Comet's defenses describes detection and confirmation before an action, and says nothing about the values a rendered case page puts in front of the model (Perplexity, 2026).
- Brave's researchers showed that an attacker can "hide prompt injection instructions in images using a faint light blue text" that a screenshot-reading agent acts on, so a scanned notice can carry one into a case file (Sahib and Chaikin, 2025).
- In a logged-in browser, once injected instructions run, "same-origin policy (SOP) or cross-origin resource sharing (CORS) are all effectively useless," which is how a scanned notice reaches a case file (Chaikin and Sahib, 2025).
- Web agents "are prone to inadvertent use of unnecessary sensitive information," and one case page draws a dozen fields the task never needed (Zharmagambetov et al., 2025).
What does Comet read when it opens a benefits case file?
The record is a benefits case file: a name, a Social Security number, a street address, a benefit amount and the notes that explain the decision. A caseworker opens it in a case management system that draws every field the role permits. An agent asked to draft a summary opens the same page in the same signed-in session, and the browser hands the rendered page to the model. Comet is one of the 15 AI agents reviewed, and none of the 15 describes replacing the customer data a working page shows, such as the SSN and address in a case file, with tokens the agent can work with (Do AI Agents Ask Before Making a Payment?).
What the model receives is the page as drawn, not the two fields the task needs. A student account summary already behaves this way: it shows a balance, any holds and a payment link on one page, and whoever opens it reads all three (North Carolina Central University, 2026). A case page adds the identifiers a Privacy Act record carries, and the model reads them beside the amount.
The session is the other half of the exposure. Brave's test of Comet found that the AI "operates with the user's full privileges across authenticated sessions," so a page an attacker writes into a public form is read with the authority of the caseworker's own account (Chaikin and Sahib, 2025). A person opens a case file to answer one question and skips the rest. The model reads the page, so the skipped fields stay in its context, which is how What Is Indirect Prompt Injection and How Does It Reach AI Agents? applies to a case file.
Does Comet's prompt-injection handling make a case file safe?
Perplexity's write-up of Comet's defenses is specific about what happens before an action. The agent pauses for confirmation "regardless of whether our systems detect suspicious activity" whenever it needs details it does not hold, and the confirmation screen "provides clear context about what action Comet is attempting to perform and why" (Perplexity, 2026).
Neither measure changes what the model holds. The page describes detection, logging and confirmation, and it does not describe hiding page content or credentials from the model (Perplexity, 2026). A confirmation arrives after the page has been read, so by the time the caseworker sees the prompt, the Social Security number and the address are already in the context the model used to draft its summary.
Detection is a judgment about a page, and the attacks that matter on a case file are built to survive judgment. The vendor expects the attempts to continue: "Determined bad actors will continue to probe for weaknesses and new attack vectors will surface" (Perplexity, 2026). A control that decides what the model may read does not depend on winning that contest, which is the argument Is It Safe to Let AI Agents Read External Web Pages? makes about untrusted content generally. What matters is what an injection collects when detection misses.
What do the vendors themselves say?
Perplexity documents Comet's defenses in a vendor post: a pause for confirmation, a confirmation screen that explains the action, and detection logged for model improvement (Perplexity, 2026). Each acts on an action the agent proposes or on a page the vendor judges unsafe, and none is described as changing the content of a page the agent may read (Perplexity, 2026).
Brave's two posts describe the attacks those defenses face. The first shows instructions hidden in an image as "a faint light blue text" that a screenshot-reading agent follows (Sahib and Chaikin, 2025). The second shows that a logged-in browser hands injected instructions the user's privileges, which leaves "same-origin policy (SOP) or cross-origin resource sharing (CORS)" useless as a boundary (Chaikin and Sahib, 2025).
A student information system vendor documents the control an agency already runs. Its catalog states that "All SSNs initially display as XXX-XX-XXXX," that viewing the full number needs SSN rights and calendar rights together, and that administrators should "Review User Groups and Suggested Tool Rights as a starting point" while treating them as suggestions (Infinite Campus, 2026). Role rights decide what a person may open, and every page here assumes a person is opening it; an agent in the caseworker's session inherits the role, so the masking depends on what the page draws.
Who should approve an agent's action on a case record?
Comet's confirmation is a question put to whoever is using the browser, and on a case file that person is the caseworker whose session the agent borrowed (Perplexity, 2026). What it cannot do is name a person with authority over the record.
Approval an agency can defend sits with someone accountable for the decision: in a benefits office, a supervisor or a named officer for the actions that change a case. What Is Supervised Delegation? sets out the pattern: the person who delegates the work answers for the agent that performs it.
A queue of prompts is not that approval. A systematic review of automation bias describes "the tendency to over-rely on automation" as studied across several fields (Goddard et al., 2012), and a caseworker who clears forty summaries before lunch is that reviewer.
A signature against a case action is the evidence an agency produces when a decision is challenged. How Can Agencies Use AI on Privacy Act Records? records that M-25-21 directs agencies to accelerate AI use through governance, risk management and public trust, and Can Agencies Use OpenAI Dots on Privacy Act Records? shows that a consumer launch does not establish suitability for a specific deployment.
What should an agency ask for in writing, and what record should it hold?
Four answers belong in the agreement, and each is a question a vendor answers in a sentence. What does the model receive from a rendered screen, and are the values on that screen replaced before it reads them? Who approves an action that changes a record? Where does a real value resolve, and what proves it resolved nowhere else? What record of the run does the agency receive?
De-identification is the alternative an agency knows, and its limits are documented. The HIPAA Privacy Rule describes "two methods that can be used to satisfy the Privacy Rule's de-identification standard," Expert Determination and Safe Harbor (HHS Office for Civil Rights, 2012). The same guidance warns that both methods "yield de-identified data that retains some risk of identification," and it is written for health records rather than for a Privacy Act case file that the agency must keep identified to decide the case.
A render-layer control leaves the record complete in the case system and lets the model read a token set while a named person approves each action against the real record. How to Prevent AI Agents From Oversharing Data Between Apps puts the principle plainly: an agent that never holds the value cannot overshare it. An access log shows the caseworker's session, not what the model read, so the agency also needs a per-run record that pairs each screen with the action and the name against the approval.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values a policy names are replaced with consistent tokens for the whole run, so a case page renders as CASE_014 and ADDR_003 while the case system keeps the real ones. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each action that changes a record, and every screen as tokens, every action and every approval is written to a record the agency exports to its own monitoring.
For this page's question the change is what an agency can permit. A caseworker can hand an assistant a file whose identifiers never entered the model's context, so the review a supervisor signs describes the record rather than a transcript.
Blocking the assistant everywhere protects the case file and gives up the work it does well; allowing it everywhere leaves the case file to a caseworker's judgment. A rendered-screen control separates the two by record type rather than by site, so the policy an agency writes names the screens rather than the vendor.
RedactSure vs Perplexity Comet: 2026 Comparison & Alternative sets out where each control acts on a page. A detection decides whether an agent may act on a page. A rendered-screen control decides what that page shows the model in the first place.
What the record shows
An agency deciding this question needs three answers: what the model receives when a case screen renders, who approves a change and what the agency can produce. On a benefits case file the agent reads the name, the Social Security number and the address in a session the caseworker already holds, and the vendor's page describes detection and confirmation without describing any change to the page the model reads (Perplexity, 2026). So the agency can allow Comet on public pages and keep it out of the case system until those answers exist in writing and in a run record. The test needs one case and one task: name the case screen, ask the agent to summarize the file, then compare what the screen shows with what the run reports the model received and who approved the change.
Methodology and limitations
This page rests on Perplexity's vendor post on Comet's defenses, two Brave security posts on Comet, a knowledge base page for a student account summary, a student information system vendor's rights catalog, HHS guidance on de-identification and a review of automation bias, read between October 21, 2026 and October 22, 2026. Public documentation read in full gives a sound view of where each product applies its control.
No product named here was tested for this article, and where a page is described as not stating something, the statement covers the pages read on those dates. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The benefits case file describes a record type, not an organization, and determinations about whether an agency's use meets the Privacy Act belong to counsel, assessors and the agency's own compliance officers; nothing here replaces a pilot on the agency's own screens.
Frequently asked questions
Can a government agency allow Comet on case files?
No, not on case files. Comet works through the browser session the caseworker is signed in to, and the vendor's page describes detection and confirmation around an action without describing any change to what the page hands the model (Perplexity, 2026). A benefits record carries a Social Security number, an address and the notes behind a decision, so the read itself is the exposure. Allow it on public pages, and keep it off the case system until the model sees tokens and a named person approves each change.
What does Comet send to the model when it opens a case?
The rendered page, with every field the caseworker's role draws. A student account page already renders a balance, any holds and a payment link on one screen (North Carolina Central University, 2026), and a case page adds the identifiers a Privacy Act record carries. The model receives all of it whether or not the summary task needs it, because the page is the unit the browser hands over. Reading is not selective the way a person's is.
Does Comet's prompt-injection detection protect a case file?
No. Detection and confirmation act on an action the agent proposes, after the page has been read (Perplexity, 2026). A caseworker who confirms a summary has already sent the record through the model that drafted it, so the prompt cannot undo the read. Detection still does work against a page the vendor judges unsafe, and it says nothing about what the model holds once a case screen opens.
Who approves an action that changes a case record?
A named person outside the model, with authority over the record. Comet's confirmation goes to whoever is using the browser, which on a case file is the caseworker whose session the agent borrowed (Perplexity, 2026). An agency needs the approver named in advance for each action that changes a case: an address update, a recalculation, a notice sent. A prompt that arrives after the read documents a click, not a decision.
What record should the agency keep of an agent's reading?
A per-run record the agency owns, not the vendor's detection log. The vendor's page states that detection is logged for model improvement (Perplexity, 2026), which is a vendor artifact rather than a statement of what a case screen handed the model. Ask for each screen as it reached the model, each action taken and the name against each approval, exported to the agency's own monitoring before the pilot starts.
Can an agency let Comet read public pages?
Yes, for pages the agency publishes. A public benefit page, a form or a notice carries no Privacy Act record, and an assistant reading it changes nothing the agency answers for. The distinction is the record type, not the site. The same browser will open a case file if the caseworker leaves the session available, so the policy has to name the systems it excludes.
How RedactSure Keeps a Case File Off the Agent's Screen
Blocking the assistant loses public-page work, and letting it read a case file hands over every identifier on the screen.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the model read the case screen as the caseworker sees it, with the number and the address beside the summary task. Inside the governed environment the case renders as CASE_014 and ADDR_003, the agent drafts from those tokens, and the supervisor approves the address update before the real value resolves.
RedactSure is deploying now with enterprise and government customers. One evaluation of web agents found them "prone to inadvertent use of unnecessary sensitive information."
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A case screen shows identifiers that no summary needs, and the model reads all of them. Bring one case file and see, with test values, what the model receives and who approves the change. Book a demo