Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can an AI Agent Submit a W-9 on Your Behalf Without Reading It?
Yes, when the upload page keeps the W-9 opaque: the agent attaches the file and submits it without the EIN or the signature entering its context. Check the three places a portal can turn the file back into text, the preview pane, the TIN field and the confirmation page.
A supplier's W-9 arrives as a file, and filing it is the work of moving that file into a vendor portal. The vendor master team opens the supplier record, finds the tax page, attaches the form, answers the fields beside it and submits. None of those steps requires the person doing them to read the EIN on line 1 or the signature on the certification, which is why the task looks delegable.
The file is dense with the values a finance team protects for the rest of the year. Form W-9 carries the legal name, the business name, the taxpayer identification number and the certification the supplier signs (IRS, 2024). A model that reads the page holds all of it in the same context as the task, and the measured record on data an agent observes while it works is not reassuring (Alizadeh et al., 2025).
A vendor master team depends on two operations a portal can treat as one. Attaching a file is a selection: a path, a name and a size. Reading a file is a render: a page drawn from its bytes. Whether the agent can submit without reading turns on which of the two the portal does after the selection, and on whether the page asks the agent to type a value only the file holds. That is decided by what the model receives from the screen, not by the portal role or the approval prompt.
Key findings
- For an agent to submit a W-9 without reading it, the upload page has to treat the file as an object: a picker that returns a name and a size, and no pane that draws its pages, so the model receives a filename instead of the EIN (What Is Render-Layer Tokenization?).
- It also requires a named person approving the submission and a record of what each screen showed the model, because the same flow can begin rendering the file on the confirmation page (What Is an Approved Destination for AI Agent Output?).
- The supplier-portal pages reviewed cover the fields a person fills and leave the file after the picker outside what they record (Coupa, 2026; Workday, 2023).
- The form makes the exposure concrete: line 1 is "Name of entity/individual. An entry is required.", and Part I warns that the TIN "must match the name given on line 1 to avoid backup withholding" (IRS, 2024).
- Workday's supplier request asks for "Tax Authority Form Type", a "TIN Type" of SSN, ITIN or EIN, and a "Justification", the tax identity entered as fields on a page dated June 2023 (Workday, 2023).
- An injection that asks an agent to leak personal data seen during a task reached "average attack success rates (ASR) around 20 percent" in a University of Zurich study, the exposure a rendered W-9 creates (Alizadeh et al., 2025).
What does the portal ask the agent to read?
The record is one supplier portal's tax page with a W-9 attached unrendered. A value there comes from the file or from a field, and the agent's exposure depends on which one the page makes load-bearing.
MIT Sloan's review defines this class as "autonomous software systems that perceive, reason, and act in digital environments to achieve goals on behalf of human principals" (MIT Sloan, 2026).
Workday's Create Supplier Request takes a "Tax Authority Form Type", a "TIN Type" (SSN, ITIN or EIN) and a "Justification", and its tax-form list is 1042-S, 1099 MISC and TDS, with no W-9 named (Workday, 2023). Suntory's questionnaire asks the supplier to choose "Organization" for an EIN or "Individual" for a US Social Security number, and states that "Bank account information must be included" before payment (Suntory Global Spirits, 2025). Coupa's payment method form adds that "The fields marked with a red asterisk are mandatory" (Coupa, 2026), and Intuit's answer for the bank step says "You'll need the account number for the vendor" (Intuit, 2021).
| What the tax page asks for | Where the value sits | What the agent must hold |
|---|---|---|
| Legal name | W-9 line 1 | The string, or a token for it |
| Taxpayer identification number | W-9 Part I | Nine digits, or a token such as TIN_001 |
| The form itself | The file | A path and a filename |
The form itself is an object the page can list without opening, so the unrendered attachment is the one row where the agent needs nothing from inside the file. The TIN row is the opposite: a portal that asks the agent to type the number has asked it to read the W-9,. A fill that places values into fields while the model works from placeholders is the documented version of the second route (Can a Browser Agent Fill In a Form Without Seeing the Values?).
What does the agent receive when it attaches the file?
Attaching a file produces a small amount of text on the page: a filename, a size, a type, and a line that says the upload succeeded. That is all an agent needs to submit a W-9, and it is where many portals give the model more, because a file field can draw a thumbnail and a preview pane can render page 1.
What the model receives in the second case is the screen. A computer-use agent that works from screenshots reads the rendered page as an image, and what enters its context is everything visible: the fields the task uses, the fields it does not, and any text on the page regardless of who put it there (What Does an AI Agent See in a Screenshot?). A preview of a W-9 carries the legal name, the address, the nine digits of the TIN and the signature. The agent did not open the file; the page opened it for the agent (Does an AI Agent See Everything on Your Screen?).
A filter on an API call sees the fields an integration sends, not an upload through a rendered page (Screen-Level Tokenization vs API Filtering for AI Agents). The control that reaches the file's preview has to act where the page is drawn, before the model reads it.
What do the vendors themselves say?
Each vendor page describes the form around the file rather than the file.
Coupa's supplier portal page covers the payment method form, from "Select the Add Payment Method dropdown option on the top left corner of the page" to the note that "The fields marked with a red asterisk are mandatory", and it stops at the payment method, leaving the tax form outside the page (Coupa, 2026).
Workday's supplier request takes a "Tax Authority Form Type", a "TIN Type" of SSN, ITIN or EIN and a "Justification", and its tax-form list is 1042-S, 1099 MISC and TDS, on a page last updated in June 2023 that names no W-9 (Workday, 2023).
Suntory's questionnaire asks the supplier to choose "Organization" for an EIN or "Individual" for a US Social Security number and states that "Bank account information must be included" before payment, a form that captures the tax identity in its own fields and never asks for the file (Suntory Global Spirits, 2025).
Intuit's community answer describes the bank step that follows the tax form and says "You'll need the account number for the vendor", a moderator's reply from 2021 that names no field labels (Intuit, 2021).
Stripe's dispute page treats an uploaded file as an object with limits, "one file per type of evidence" and a "combined maximum of 4.5 MB", and allows "only one opportunity to submit your response", limits on the submission rather than on what the file contains (Stripe, 2026).
| Dimension | Coupa, per its documentation | Workday, per its documentation | What a buyer should verify |
|---|---|---|---|
| Tax identity | No tax field on the page | Entered as a field, not as a W-9 | Whether the TIN comes from the file or a store |
| The file | No upload on the page | No W-9 upload named | What the portal draws after the picker |
How a selected file is handled after the picker is not described in the pages reviewed, and the tax values the pages do collect are the ones an agent has to supply.
Where does the answer change on the rendered page?
Four page states turn an opaque upload into a read. The first is a preview pane that draws page 1 of the PDF, so the model receives the bytes as an image. The second is an extraction step, a portal that says it read the form and offers the values for confirmation, at which point the values are text on the page. The third is an error that forces the file open, a password-protected PDF or a form the portal does not recognize. The fourth is the receipt, which can reprint the TIN and the legal name. The record gap is wider than the upload: 36 of the 86 AI security products reviewed describe recording what the model was shown, and every record is a prompt, a conversation or a request payload at the product's own gateway or pipeline; none describes recording the rendered screen an agent read (How Many AI Security Products Control What an AI Agent Sees?).
There is a second path to the same exposure, and it does not need a preview. If the portal requires the TIN in a field, the agent has to get the number from somewhere. When the only source is the W-9, the agent reads the file to fill the field, and the page never had to render anything. The same question appears where an agent configures a webhook secret: the value can be submitted without the model holding it (Can an AI Agent Configure Webhook Secrets Without Reading Them?).
A W-9 from a new supplier is content the agent did not write. A line placed in the file can redirect the task, which the research calls task drift (Abdelnabi et al., 2025), and an injection aimed at the data an agent saw during its work reached "average attack success rates (ASR) around 20 percent" (Alizadeh et al., 2025). A portal role or an approval prompt governs whether the submission proceeds; neither changes what the page already drew.
What does a governed environment change?
A governed environment is a control class that acts where a page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the agent works with placeholders such as TIN_001, and the SSN and other personal values in the file are tokenized if it is opened. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For this page's question the class changes two things. The file is attached by reference from a store, so the page draws an object and a name, and the preview pane, where one exists, draws the SSN and other personal values in the file as tokens. The TIN field, where the portal asks for one, is filled from the same store, so the model works on TIN_001 and the nine digits travel to the portal's field only at the approved submit. The agent still finds the tax page, selects the file and fills the fields the page marks mandatory.
The scope is the rendered page. A TIN typed into a shell, a CSV built by a script or a direct API call to the portal sits outside this control and stays with the sandbox and the credential store a team configures for those paths. The page is where the W-9 becomes visible, so the page is where the control has to sit.
What the record shows
The answer turns on one page state: what the upload screen draws after the file is chosen. An opaque file field, a name and a size leave the EIN and the signature outside the model's context; a preview, a thumbnail, an extraction step or a receipt that reprints the TIN puts them inside it, and no role or approval setting changes what the model already read. The supplier pages reviewed document the fields a person fills and leave the file after the picker unrecorded, so the load-bearing question is the render and not the permission. A team can settle it with one run: open the portal's tax page with a test W-9, attach it, capture every screen the agent receives, then repeat on the page after the submit and compare where the digits first appear.
Methodology and limitations
This page rests on the IRS form W-9, supplier-portal documentation from Coupa, Workday, Suntory Global Spirits, Intuit and Stripe, two preprints on prompt injection and task drift, and one industry analysis, with the RedactSure research pages linked above. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page.
None of the products on this page was tested for this page. "Not described" means the pages reviewed, not a claim about what a product does. Vendor features change and the page carries its date, so a later release is unreviewed until the run is repeated. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a W-9 attached unrendered on a supplier portal's tax page, not an organization. Determinations about whether a tax-form handling process meets a contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Can an AI agent submit a W-9 on your behalf without reading it?
Yes, when the upload page keeps the file opaque. The agent selects the file, the page lists a name and a size, and the submission proceeds without the EIN or the signature entering the model's context. The answer changes the moment a preview pane, an extraction step or a receipt renders the file's contents. Ask which of those the portal does, and run one submission with a test form whose digits you can watch.
Does an approval step stop the agent from reading the W-9?
No. An approval governs whether a submission proceeds, and it does not change what the page drew before the approver saw it. An agent that opened the tax page and read a preview holds the EIN whatever the approver decides next. Approval is still the right control for the submit, because a person should release a tax filing that carries a signature, but it answers who sent the form and not what the model read.
What does the agent see if the portal opens a preview?
Everything the preview draws. A computer-use agent receives the rendered page as an image, so page 1 of the W-9 arrives with the legal name, the address, the TIN and the signature in the same frame as the submit button. If the portal extracts the values and shows them for confirmation, the model receives the extracted text and the exposure is the same. The version that avoids it is a page that lists the file and never draws its contents.
Can the agent fill the TIN field without reading the file?
Only if the value comes from somewhere other than the file. A portal that asks for a TIN has asked for nine digits, and the agent must receive them, from the file it read, from a person who typed them, or from a store that fills the field while the model sees a placeholder. The first route is the one this article is about. The third is the control-class answer: the agent works on TIN_001 and the real digits reach the portal at the approved submit.
What record should the team keep of the submission?
The screens the agent received, the values that were tokenized, the action it took and the name of the person who approved it. A record of the final form alone shows that a W-9 arrived and nothing about what the model saw on the way. For a tax document the useful record answers three questions: did a preview render, did the agent read the TIN, and who released the submission. Export it to the team's own monitoring so the answer survives the next vendor renewal.
Which vendors document how they handle an uploaded tax form?
None of the supplier pages reviewed describes the file after the picker. Coupa's page covers the payment method fields, Workday's request takes the tax identity as fields and names no W-9, Suntory's questionnaire asks for an entity type and a bank account, and Intuit's answer covers the bank step. Each documents the form a person fills. What a model receives is outside what they record, which is the gap one test closes.
How RedactSure Files a W-9 Without Rendering It
The task looks delegable until the portal draws the file, and then the EIN and the signature sit in the model's context. A University of Zurich study measured injections that ask agents to leak personal data at around 20 percent attack success (Alizadeh et al., 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the model received page 1 of the W-9 in a preview, EIN and signature included. Inside the governed environment the file is attached by reference, the page lists a name and a size, the TIN field fills from the store as TIN_001, and a named person approves the submit before the digits resolve at the portal.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A W-9 submission is settled by one question: where the page first draws the EIN. Bring one supplier form and see, with test values, what the model reads, who approves the submit and what the record holds. Book a demo