Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Can ChatGPT Work Handle Cardholder Data Without Expanding PCI Scope?
No. A card number on a checkout page ChatGPT Work reads passes to the model and sits inside the cardholder data flow whatever plan the company bought, so ask where the number is replaced before the model sees it, who approves the payment, and what record of the screen survives the 30-day log.
A checkout page is the shortest record in a purchase: a merchant, an order total, a card number, an expiry date, a security code and a billing address. A person reads it once and types. ChatGPT Work is built to work the pages a person would otherwise work through, so it reads the same screen and decides the next step from it. That is where the PCI question begins, because the scoping test asks which systems store, process or transmit the card number, not which systems were designed for payments (Can an AI Agent Handle Cards Without Wider PCI Scope?). A checkout page rendered into a model puts the number inside a system the assessor will ask about, and the plan named on the contract does not move it out.
A number in the model's context can be repeated in a summary or carried into the next page the agent opens. What decides the answer is whether anything stands between the rendered page and the model, so the three things to check are whether the value is replaced before the model reads it, who approves the payment, and what record of the screen survives the month.
Key findings
- For ChatGPT Work to handle a checkout without widening PCI scope, the card number would have to be replaced with a consistent token before the model reads the screen, with the real digits resolving only at the approved payment (What Is Render-Layer Tokenization?).
- It would also require a named person approving each payment the agent prepares, and a record of what the model received on the checkout screen, exported to the organization's own monitoring (Can an AI Agent Handle Cards Without Wider PCI Scope?).
- The pages reviewed describe a workspace, its connected apps and its logs, and they do not state that values on a checkout page are replaced before the model reads them; no plan setting is described that changes what the model receives (OpenAI, Work admin, 2026).
- OpenAI's help page for ChatGPT agent, the product it retired in favor of ChatGPT Work, says that with connected apps the agent can access sensitive data like emails, files, or account settings, an access rule rather than a filter on the page (OpenAI, ChatGPT agent, 2026).
- OpenAI retired the Atlas browser in August 2026, and the help page for its agent mode said the agent could use "sites you're already signed in to", so a merchant's checkout page opened in the session a staff member already held, with no separate identity for the agent (OpenAI, Atlas retirement, 2026; OpenAI, agent mode, 2026).
- Mireshghallah et al. found that GPT-4 and ChatGPT "reveal private information in contexts that humans would not" in 39% and 57% of cases, the risk a card number carries once it is in the model's context (Mireshghallah et al., 2024).
What does the agent read on a checkout page?
The record is one checkout page: the merchant name, the order total, a card number, an expiry date, a security code, the cardholder name and a billing address. The task needs four of them: the amount, the payee, the card type and the last four digits for the receipt. The page draws all of them, and a model reading the page receives what it draws.
OpenAI's help page for ChatGPT agent says that with connected apps the agent can access sensitive data like emails, files, or account settings, a statement about what the agent can reach, not about what the page may show it (OpenAI, ChatGPT agent, 2026). The Atlas help page said agent mode could use "sites you're already signed in to", so the checkout page opened inside the session that already held the account (OpenAI, agent mode, 2026). Neither page describes a field-level filter between the rendered page and the model.
A sign-in helper is not a card control: the safety document for a related agent product says secure sign-in "sends your credentials directly to the browser environment and submits them without exposing them to the model's context" (Can OpenAI Dots Handle Cardholder or Bank Data?). A card field on a checkout page is not a login.
OpenAI's research post on Atlas called prompt injection, much like scams and social engineering on the web, "unlikely to ever be fully 'solved'", so a page that carried a card number could not rest on the agent recognizing a hostile instruction (OpenAI, Hardening, 2025). Nothing after the read can take the value back (How Do I Capture a Token the Moment It Appears on Screen?).
Does a plan or workspace tier change what the model reads?
No. A plan changes who administers the workspace and how long its logs are kept; OpenAI's administrator FAQ says the Compliance Logs Platform "retains data for 30 days" for the workspace (OpenAI, Work admin, 2026). It does not change what a rendered page hands the model, and none of the pages reviewed describes a plan setting that filters a checkout page before the model reads it. The control is not one the products reviewed describe: across 15 AI agents and 86 AI security products, not one describes giving an agent tokens it can work with in place of the customer data it reads on a screen; ChatGPT Work was outside that set (Do AI Agents Ask Before Making a Payment?, How Many AI Security Products Control What an AI Agent Sees?).
The scoping test is functional: a system that stores, processes or transmits cardholder data is in scope, and so is a system able to affect the security of one that does (Can an AI Agent Handle Cards Without Wider PCI Scope?). A model that reads a checkout screen is processing the values on that screen, and the contract tier is not a variable in that test.
The product lineage does not help either. PPC Land reported that OpenAI killed the Atlas browser and folded it into the new ChatGPT Work agent, so the browsing behavior a checkout task used was the Atlas lineage rather than a separate control (PPC Land, 2026).
The standard's own rendering rule is narrower than it sounds. PCI DSS v4.0.1 states that the PAN "must be rendered unreadable according to PCI DSS Requirement 3.5.1", a storage rule that says nothing about a checkout screen an agent reads (PCI Security Standards Council, 2024). Unreadable at rest and unread by the model are different properties.
What do the vendors themselves say?
OpenAI documents the session and the limits around it, and Chase documents the approval mechanics a finance team already uses.
The Atlas help page said agent mode "cannot run code in the browser, download files, or install extensions", limits on what a page could make the agent do rather than on what the page contains (OpenAI, agent mode, 2026). It added that the agent "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions", a checkpoint before the payment rather than a limit on what the checkout page showed (OpenAI, agent mode, 2026).
Chase's business banking overview says an administrator can "Assign your employees varying levels of access" and "Require a second approver on transactions with Dual Control", controls on who moves money inside the bank's own tool rather than on what a model reads from a page (Chase, 2025).
| Dimension | OpenAI, per its documentation | What a buyer should verify |
|---|---|---|
| Session | Agent mode uses sites the person is already signed in to | Whether the checkout page opens in a staff member's session |
| Connected apps | With connected apps the agent can access sensitive data like emails, files or account settings | Which apps are connected and what they return |
| Browser limits | No code execution in the browser, downloads or extensions | That the limit covers movement, not page content |
| Sensitive sites | A pause before actions on specific sensitive sites | What the model read before the pause appears |
| Logs | Compliance Logs Platform retains data for 30 days | Where the record lives after 30 days |
Read together, the rows describe an agent that may go many places and a log that ends after a month. The approval sits inside the banking portal, and the reading that produced the payment is recorded in neither place.
What record is there of what the model read?
OpenAI's administrator FAQ states that its records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, Work admin, 2026). A team that needs to answer an assessor's question about a checkout page therefore has a log of events, not a record of the screen, and the difference is the whole question.
The failure mode is not hypothetical. A DAPLab review calls these failures "the predictable consequence of deploying agents that can write to systems designed only to be read by careful humans" and records that "a zero-click ChatGPT vulnerability silently exfiltrated Gmail data from within OpenAI's own cloud infrastructure" (Columbia DAPLab, 2026). A checkout page combines both a write and a read.
The record a scope review needs is narrower than the log: the screen the model was shown, the values on that screen, the action the agent took, and the name of the person who approved it. An approval without the screen answers who, not what. A log without values answers when, not what. An exported record with those four fields is what an assessor can read. The record that answers the assessor is kept outside the product whose 30-day window it outlives, which is the argument in Is It Safe to Let ChatGPT Work Access Sensitive Company Data?.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on CARD_001 rather than the sixteen digits. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action, and a payment is one. Every screen as tokens, every action and every approval is written to a record exported to the organization's own monitoring.
For the checkout page, the number renders as CARD_001 on the form, on the receipt and on any order history page the agent opens afterward. The approval attaches to the token and to a named person, so the payment is released at the page that person approved rather than at any page the agent reaches. The record carries the screen as the model saw it.
The substitution does not cost the task. A study of consistent pseudonyms found that replacing identifiers and restoring them after the model has done its work reduces semantic utility errors by a factor of five compared with baseline techniques (Does Masking Data on Screen Break Browser Agents?).
The scope is the rendered page; a card passed to an API from a terminal or a script is outside it. Where the two approaches sit is set out in RedactSure vs ChatGPT Work: 2026 Comparison & Alternative: the workspace decides which session the agent may use, and a render-layer control decides what the model reads inside it.
What the record shows
Control over this question sits at the screen: what the checkout page hands the model, who approves the payment the agent prepares, and what record of the screen survives the run. OpenAI's pages describe a workspace, a connected-app surface and a 30-day log, and they do not describe a filter between a rendered checkout page and the model, so the plan tier answers a procurement question, not the assessor's one. A merchant can check its own case by running one test checkout with a test card, comparing the fields the page rendered with the values the run reports having read, and asking who signed off on the payment.
Methodology and limitations
This page rests on OpenAI's help pages and administrator FAQ, a privacy preprint, Chase's business banking overview, a DAPLab position paper, PCI DSS v4.0.1 and the RedactSure pages cited above. Vendor pages were read between October 21, 2026 and October 27, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
None of these products was tested hands-on; they are described from their public documentation and none was tested for this page, and RedactSure is deploying now with enterprise and government customers. Where a behavior is not described in the pages reviewed, it means the OpenAI and Chase pages listed in Sources. Vendor features change and the page carries its date, the example describes a record type, not an organization, and the same limit applies to all.
Determinations about PCI scope belong to counsel, assessors and the organization's own security and compliance officers, and nothing replaces a pilot of one checkout workflow on the organization's own screens. The Chase page is a Wayback snapshot of October 9, 2025, and the live URL now returns a not-found page.
Frequently asked questions
Can ChatGPT Work handle cardholder data without expanding PCI scope?
No. A card number on a checkout page the agent reads is cardholder data inside the system the model works in, and the scoping test asks what a component stores, processes or transmits rather than what plan it runs under. OpenAI's pages describe a workspace, connected apps and a 30-day log; they do not describe a filter between the rendered page and the model. The control that changes the answer replaces the number before the model reads it.
Does the checkout page count as cardholder data the model processes?
Yes, if the page draws the number and the agent reads the page. A checkout form renders the card number, the expiry date and the cardholder name, and the model receives the rendered screen rather than a filtered version of it. The scoping test is functional, so a model that reads those fields is part of the flow that handles them. Whether that puts the workspace in scope is the assessor's call, made from the data flow the team can document.
Does a Business or Enterprise plan change what the model reads?
No. A plan changes who administers the workspace and how long its logs are kept, and OpenAI's administrator FAQ puts the log at 30 days. It does not change what a rendered checkout page hands the model, and none of the pages reviewed describes a plan setting that filters a page before the model reads it. A contract tier is an administrative boundary, and the scoping test looks at the data path.
What does the agent see on the checkout screen?
The fields the page draws: the merchant, the total, the card number, the expiry date, the security code, the cardholder name and the billing address. The task needs the amount, the payee and the last four digits, and the model receives the rest with them. Neither OpenAI's help pages nor its administrator FAQ describes a field-level filter between the rendered page and the model, so the buyer's question is what the page draws.
Who approves the payment the agent prepares?
No one, unless the workflow puts a person there. OpenAI documents a pause before actions on specific sensitive sites such as financial institutions, which asks the person watching to confirm an action; it does not name an approver in advance or attach a name and a time to the decision. Chase documents a second approver for dual-control transactions inside its own banking tool. An approval is a named person accepting a specific amount and payee.
What record exists of what the model read?
A 30-day compliance log that OpenAI says does not establish a complete audit trail for every browser interaction, tool call or approval. That log records events, not the screen the model received. A record that answers an assessor carries the page as the model saw it, the values on it, the action and the approving name, and it has to live outside the product whose retention window it outlives.
How RedactSure Keeps the Card Number Off the Checkout Screen
A finance team that lets an agent pay has no statement of what the checkout page handed the model. OpenAI's own research says prompt injection is "unlikely to ever be fully 'solved'", so the reading needs a bound.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the checkout page renders the sixteen digits, the expiry date and the security code, and the model keeps them for the run. Inside, the same page renders CARD_001, the agent prepares the payment on that token, the real number resolves only at the payment form a named person approved, and every screen and approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
One test checkout settles whether the card number reaches your agent. Bring a payment you would let an agent prepare and see, with test values, the page as the model receives it, the approval and the record. Book a demo