Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Do AI Agents Ask Before Making a Payment?
Only 6 of 15 AI agents reviewed document asking a person before they complete a payment or purchase, and two of the six hedge. 9 keep passwords away from the model, but none does the same for the customer data on the screen. Nine of the 15 launched in the last 18 months.
Six of fifteen. That is how many of the AI agents reviewed for this report say, in their own documentation, that they ask a person before completing a payment or purchase, as read on October 27, 2026. Two of the six hedge: one says the agent "will try" to pause, the other that it will "generally" pause. The other nine do not describe asking at all. Most of these agents are new, and the controls a finance or security team would expect are uneven from one product to the next.
Key findings
- Only 6 of 15 AI agents reviewed document asking a person before completing a payment or purchase. Two of the six hedge, and one rests on a rule that every browser action requires approval (vendor documentation, 2026).
- 0 of 15 AI agents reviewed describe protecting the customer data on a working page, such as account numbers or patient records, by replacing it with tokens the agent can work with (vendor documentation, 2026).
- The same gap runs through the security tools meant to govern these agents. Of 15 AI agents and 86 AI security products reviewed, none describes replacing the customer data an agent reads on a screen with tokens it can work with (How Many AI Security Products Control What an AI Agent Sees?).
- 9 of the 15 keep passwords or credentials away from the model, against 0 for the customer data on the screen. One offers placeholders for login credentials only, as an opt-in feature (vendor documentation, 2026).
- Only 1 of the 15 documents asking a person by default before every consequential action, such as payments, messages, form submissions and deletions (vendor documentation, 2026).
- 5 of the 15 document a per-action record an administrator can export (vendor documentation, 2026).
- 9 of the 15 launched in the last 18 months, and 3 in the last three months (vendor announcements, 2026).
How does each agent handle payments, screens and records?
| Agent (vendor) | Launched | Asks a person before a payment | What the model sees from the screen | Passwords kept from the model | Per-action record for admins |
|---|---|---|---|---|---|
| OpenAI Dots (OpenAI) | Sep 2026 | Not described | Not described | Yes | Yes |
| Meta Muse (Meta) | Sep 2026 | Yes | Some values removed (email codes and reset links) | Yes | User history only |
| Grok Bot (xAI) | Aug 2026 | Not described | Not described | Yes | Yes |
| Dia (The Browser Company) | Oct 2025 | Not described | Some fields hidden (passwords) | Yes | User history only |
| Cursor browser agent (Anysphere) | Sep 2025 | Yes (every browser action requires approval) | Not described | Not described | User history only |
| Claude in Chrome (Anthropic) | Aug 2025 | Yes (purchases blocked; a person completes them) | Whole sites excluded | Partly | Yes |
| Comet (Perplexity) | Jul 2025 | Yes | Whole sites excluded | Yes | Not described |
| Opera Neon (Opera) | May 2025 | Yes ("generally") | Some values kept on device (passwords, cards) | Yes | User history only |
| Gemini in Chrome (Google) | May 2025 | Yes ("will try") | Whole sites excluded | Yes | User history only |
| Codex (OpenAI) | Apr 2025 | Not described | Not described | Yes (cloud secrets) | Yes |
| Manus (Manus) | Mar 2025 | Not described | Not described | Not described | Not described |
| Claude Code (Anthropic) | Feb 2025 | Not described | Not described | Not described | Yes |
| Browser Use (Browser Use) | Nov 2024 | Not described | Placeholders for credentials (opt-in) | Yes | User history only |
| Claude Computer Use (Anthropic) | Oct 2024 | Not described (left to the developer) | Not described | Not described | User history only |
| Devin (Cognition) | Mar 2024 | Not described | Not described | Not described | User history only |
Agents are listed newest first. "Yes" means the vendor's documentation describes the control; quoted words show where the vendor hedges. "Partly" means a narrower version. "User history only" means the person using the agent can review what it did, but the documentation describes no record an administrator can export. "Not described" means the pages searched do not describe it, never that the product cannot do it. Each linked name goes to the agent's RedactSure comparison page.
What does the model see from the screen?
| What the documentation describes | Agents |
|---|---|
| Placeholders the agent can use without seeing the value | 1 (login credentials only, opt-in) |
| Some specific values removed or hidden | 3 |
| Whole sites or origins excluded | 3 |
| Not described | 8 |
| Customer data on the page replaced with tokens the agent can work with | 0 |
Removing or hiding a value and replacing it with a token are different controls. Masking decides whether an agent may see a value. Tokenization lets the agent do the work without seeing it. The three agents that hide values hide passwords, card numbers or one-time codes, which the agent should never need. None describes what an agent working a customer account needs: the account number, the patient record or the invoice amount replaced with a token it can still act on, while the real value stays in the system that owns it.
Why do payments and passwords tell the story?
The two controls vendors document most are the ones that protect their own users from obvious harm: keeping a password out of the model and asking before money moves. Even there, coverage is incomplete. Payment approval is described by fewer than half, and two of those descriptions are written as intentions rather than defaults.
The controls a business needs to let an agent work real accounts are rarer. Only one agent documents asking before every consequential action, and only five give administrators a record of each action they can export to their own systems. For a team that has to show who approved what, the gap is in the record as much as in the approval.
How new are these agents?
Nine of the fifteen launched after April 2025, and three launched in August and September 2026. Documentation for a product that is months old is often thin, and several vendors' pages describe intentions rather than defaults. The pace also means the list changes quickly: this review will be refreshed each quarter.
What do the numbers mean for finance and security leaders?
An agent that can complete a payment without asking, or that reads the real account number on every screen it works, puts the decision and the data in the same place. If a page carries injected instructions, both are exposed at once. The question for any agent is what the model sees, who approves the action, and what record is left behind.
The design that holds up keeps real sensitive values out of what the model reads, gives the agent tokens it can still work with, requires a named person to approve every payment and other consequential action, and records each step where the security team can see it.
Methodology and limitations
Fifteen agents were reviewed: OpenAI Dots and Codex (OpenAI), Meta Muse (Meta), Grok Bot (xAI), Dia (The Browser Company), Cursor's browser agent (Anysphere), Claude in Chrome, Claude Code and Claude Computer Use (Anthropic), Comet (Perplexity), Opera Neon (Opera), Gemini in Chrome (Google), Manus (Manus), Browser Use (Browser Use) and Devin (Cognition).
Each vendor's own help center, security, privacy, retention, trust center, administrator and release-note pages were read on October 27, 2026. 199 pages were searched and every page that supplied evidence was saved with its URL and read date; those pages are listed in the sources below. A control counts only where a vendor sentence describes it. Launch dates are the earliest public announcement by the vendor.
The review describes documentation, not tested behavior. OpenAI's help center refused automated reading, so the two OpenAI agents rest on OpenAI's other documentation pages, and several trust centers could not be read. Claude Computer Use is a developer tool, so approval steps are written by whoever builds the agent loop. One reviewer scored every agent. Counts describe the fifteen agents reviewed, not the market.
Frequently asked questions
Do AI agents ask before making a purchase?
Some do. Of fifteen AI agents reviewed, six document asking a person before completing a payment or purchase, and one blocks purchases so a person has to complete them. Two of the six describe it as something the agent "will try" or will "generally" do. Nine do not describe asking at all in the pages searched.
Can an AI agent see my passwords?
Nine of the fifteen agents reviewed document keeping passwords or credentials away from the model, for example by filling them from a secure store or keeping them on the device. Of the other six, one describes a narrower version and five do not describe it. Protecting the password does not protect the rest of the page: none describes replacing customer data on the screen with tokens.
What is the difference between masking and tokenization for AI agents?
Masking hides or removes a value, so the agent cannot see it and cannot use it. Tokenization replaces the value with a token the agent can still work with, while the real value stays in the system that owns it. Masking decides whether an agent may see a value. Tokenization lets the agent do the work without seeing it.
How RedactSure Keeps a Person on Every Payment
Most agents leave payment approval and screen data to chance or to the user's settings. RedactSure makes both part of the environment the agent works in.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent paying a vendor invoice reads the bank account number on the screen and submits the payment on its own. Inside the governed environment: render-layer tokenization shows the agent BANK_001 instead of the account number, the agent prepares the payment, and a named person approves it under Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
If an agent will touch payments, the approval and the record have to be built in. Bring one payment workflow and see, with test values, what the agent reads and who approves the payment. Book a demo