Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Does an AI Agent Browse With My Real Browser Profile?

Often yes: an extension agent such as Claude in Chrome works inside the browser you are already signed into, and a framework agent uses whichever profile its configuration points at. Launch the agent in a fresh profile signed into the narrowest account the task needs, and ask what the model is shown on each page it opens.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A browser profile is the folder that holds a person's sessions, saved passwords, autofill entries, extensions and history, and an agent that opens pages through that profile inherits all of it. Whether a given agent does so depends on where it runs. An agent installed as a browser extension acts inside the browser that hosts it, which is the one its owner uses all day. An agent that launches a browser from code uses the profile its configuration names, which can be a fresh one or the daily one. The vendor pages reviewed here document controls on what the model receives and where it may navigate, not a default profile, so the choice sits with whoever sets the agent up. This page takes one record type as its example, an employee record in an HR portal reached through a daily profile and again through a fresh one. Through the daily profile the agent reaches every session, password and autofill entry its owner holds, while a fresh profile limits it to the account it was given, so the person who sets the agent up decides the organization's exposure and should choose and record that profile before the agent runs. Can a Browser Agent Read My Session Cookies? takes the cookie itself; this page takes the profile around it.

Key findings

  • Browser Use's sensitive data template states that "the LLM only sees placeholders (x_user, x_pass)" and that "real values are injected directly into form fields after the LLM call," a control on typed values that does not choose which profile the browser opens with (Browser Use, Sensitive, 2026).
  • Skyvern's credentials documentation says "the model that drives the browser gets placeholders, not your values" and that connected vaults are read at run time, which governs the login step and not the saved logins a daily profile already holds (Skyvern, 2026).
  • Anthropic's help center states that Claude in Chrome sees what is on the page, can act on it and can request logins from 1Password, so it works in the browser the person is signed into (What Can Claude in Chrome Access in Your Browser?).
  • A study of browsing agents reports findings that include "prompt injection, domain validation bypass, and credential exfiltration," and shows "how untrusted web content can hijack agent behavior," the risk a daily profile amplifies (Mudryi et al., 2025).
  • A governed environment replaces values chosen by policy with consistent tokens before any model reads the screen, so an agent working in any profile sees EMP_001 where the employee's name and account number were (What Is Least Exposure?).
  • In that control class, real values resolve only at the approved destination at the moment of an approved action, which keeps the profile's saved values out of the model's context whichever profile the agent uses (What Is a Tethered Agent?).

Which browser does an AI agent use, and whose profile is it?

There are two kinds of browser agent, and the title question has a different answer for each. An extension agent is installed into a browser and acts on the tabs that browser opens, so it works in the profile that hosts the extension, which for most people is the daily one. Anthropic's help center states that Claude in Chrome sees what is on the page, can act on it, and can request logins from 1Password, which places it in the signed-in browser with a password manager at hand (What Can Claude in Chrome Access in Your Browser?). A framework agent launches a browser from code, and the profile it opens is whichever one the configuration names. A fresh profile starts empty. An attached daily profile starts with every session, saved password and extension the person has accumulated.

The scope of this page is the rendered page. A governed browser environment covers what an agent reads and does on a page, including dashboards, consoles, settings pages and sign-up forms, and does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. The profile question lives inside that scope, because the profile decides which pages open signed in and which values the browser offers to fill.

The record type for this page is one employee record in an HR portal. Opened through a fresh profile, the agent must sign in, and the login is the moment the vendor controls below apply. Opened through the daily profile, the portal is already signed in, the browser offers to fill the employee's details, and the agent is one tab away from the mailbox and the payroll provider. A tethered agent goes anywhere its supervisor could go and does real work there at machine speed; the daily profile is where that reach is widest.

What do the vendors themselves say?

Browser Use's sensitive data template says "the LLM only sees placeholders (x_user, x_pass), we filter your sensitive data from the input text," which protects a typed value and does not select the profile (Browser Use, Sensitive, 2026). It advises "Set use_vision=False to prevent screenshot leaks" and "Use Browser(allowed_domains=[...]) to restrict navigation," settings that matter more in a daily profile, where a screenshot shows a signed-in page. Its cloud credentials guidance states that "Zero Data Retention (ZDR) projects never record, even when recording is requested," a control on storage after the run and not on what the profile exposed (Browser Use, Secrets, 2026).

Skyvern's credentials documentation says "the model that drives the browser gets placeholders, not your values," that "a typed value can still show up in later screenshots and page text, so turn on Mask Secrets in an agent's settings to hide it there too," and that connected vaults are read at run time, all of which govern a login the agent performs, not one a profile holds (Skyvern, 2026). Which profile either framework launches with is not described in the pages reviewed.

A coding agent's sandbox answers a different question: OpenAI's Codex documentation says "By default, the agent runs with network access turned off" and that its sandbox limits what the agent can touch, which bounds files and network and says nothing about a browser profile (OpenAI, 2026).

Dimension Browser Use and Skyvern, per their documentation What a buyer should verify
Typed values Placeholders to the model What a screenshot shows
Navigation allowed_domains restricts the browser Whether every signed-in site is excluded
Profile Left to configuration Which profile each run launched with

What does the daily profile carry that a fresh one does not?

Four things, and each one changes what the model can be shown. Sessions: every site the person is signed into opens signed in, so the agent reaches the HR portal, the mailbox and the payroll provider without a login step, and no placeholder mechanism is involved because nothing is typed. Saved passwords: the browser offers to fill them on the sign-in forms it recognizes, which is convenient for the person and indiscriminate for an agent. Autofill: names, addresses, phone numbers and card details are offered on any form that asks. Extensions: whatever is installed runs on the pages the agent opens, with whatever access it was granted.

A fresh profile carries none of these. The agent signs in with the account it is given, reaches the sites that account can reach, and fills forms with the values it is handed. That is the practical reading of least exposure: least privilege governs actions and credentials, not the content of the screen an agent reads, so an agent can satisfy it in full and still hold every record it was shown. A fresh profile narrows the set of screens; it does not change what the model receives from the screens that remain.

The employee record shows the difference. Through the daily profile, the agent opens the record, and the browser's autofill, saved payroll login and open mailbox are one click away in the same window. Through a fresh profile signed into a portal account scoped to one employee, the record is the only thing on offer. Anthropic's pages describe Claude in Chrome's login step through 1Password, and the use of sessions already open in the browser is not covered in the same pages, so a team using an extension agent should assume the daily profile's sessions are in reach and sign out of what the task does not need (Does Claude in Chrome Use Your Saved Logins and Open Sessions?).

What can untrusted web content do with the profile the agent holds?

Direct it. A study of browsing agents reports findings that include "prompt injection, domain validation bypass, and credential exfiltration" and demonstrates "how untrusted web content can hijack agent behavior" (Mudryi et al., 2025). An agent reading an HR portal also reads whatever the page renders, and an instruction hidden in a comment field is read with the same attention as the task. In a fresh profile, a hijacked agent has the one account it was given. In the daily profile, it has the mailbox to send from, the payroll site to change, and the autofill to paste.

The pattern is not confined to browsers. A study of agentic coding editors reports that "attack success rates can reach as high as 84% for executing malicious commands" (Liu et al., Your, 2026), and a benchmark of prompt injection evaluates "5 prompt injection attacks and 10 defenses with 10 LLMs and 7 tasks" to give the field a common measure (Liu et al., Formalizing, 2024). A defense that sometimes fails fails daily at volume, and the profile decides what the failure yields.

The Model Context Protocol's security guidance states the principle for tokens: "MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server," and "poor scope design increases token compromise impact, elevates user friction, and obscures audit trails" (Model Context Protocol, 2026). A daily profile is a bundle of tokens issued to a person and spent by an agent, with the compromise impact its widest session allows. Sonatype reported that "56% of the malware discovered in Q1 2025 was related to data exfiltration," up from 26% the quarter before, a reminder that exfiltration is the usual goal and a profile full of sessions the richest target (Sonatype, 2025).

How should a team provision and record a profile for an agent?

Start with a fresh profile per task and a dedicated account per profile. The account is scoped to the records the task needs, and the profile is signed into that account and nothing else. Microsoft's Copilot Studio documentation draws the distinction to copy, author authentication where access is implicit and user authentication where access must be restricted; a daily profile is author authentication by accident, with the author's whole reach.

Keep administrator sessions out. AWS strongly recommends not creating access keys for the root user, and a daily profile with a root console session open is the browser form of the same mistake. Values the agent generates in the profile travel too: GitGuardian's data, as reported by Help Net Security, counted "28,649,024 new secrets exposed in public GitHub commits across 2025," with agent co-authored commits leaking at roughly double the baseline rate (How Do You Let an AI Agent Manage API Keys Without Reading Them?). GitHub's push protection "acts as a frontline defense mechanism by scanning code for hardcoded secrets at the time of the push," a catch at the repository for a value the agent copied from a page (GitHub, 2026).

Then record the profile per run: which profile the agent launched with, which account it was signed into, which domains were allowed, and which values the model was shown. A domain allowlist limits navigation but writes no record of what the pages displayed, and credential masking hides a typed value without recording which screens the model read. The record is what a reviewer asks for after an incident, and no profile setting produces it.

What does a governed environment change?

A governed environment is a control class that acts where the page is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on EMP_001 and ACCT_001 rather than the employee's name and account number. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this page's question it changes what the profile is worth. A fresh profile narrows which pages open; the governed environment narrows what the model receives from any page that does open, in a fresh profile or the daily one. If an agent in a daily profile is directed to the mailbox, the mailbox renders as tokens, and an injected instruction that asks for the employee's details collects placeholders. The two controls are complementary: the profile limits reach, and the render-layer substitution limits exposure. A team that uses both has closed two different routes, and the record shows which profile, which screens and which approvals were involved.

Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so a coding agent's sandbox and a framework's configuration file stay with the team that sets them. The profile choice remains the team's, and the governed environment makes the choice less costly to get wrong.

Methodology and limitations

This page rests on the public documentation of Browser Use, Skyvern and OpenAI, Anthropic's help center as summarized in existing RedactSure research pages, three research preprints on browsing agents, coding editors and prompt injection benchmarks, the Model Context Protocol security guidance, GitHub's push protection documentation, one vendor research release on malicious packages, and existing RedactSure research pages. Sources were read between October 20, 2026 and October 21, 2026. Quoted facts are cited to the page that states them, and the preprints for the findings their abstracts state. The description of what a profile holds, sessions, saved passwords, autofill and extensions, is standard browser behavior and comes from no vendor page.

RedactSure did not test Browser Use, Skyvern, Claude in Chrome or any other agent hands-on against a daily or a fresh profile. "Not described in the pages reviewed" means the pages reviewed and nothing broader; a vendor may document profile selection elsewhere or add a default later. Vendor features change, and the page carries its date. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, an employee record in an HR portal reached through two profiles, and not an organization. The coding editor and malicious package figures are cited for the class of risk and not as measurements of browser agents.

Determinations about whether a profile arrangement meets a legal or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test on the organization's own agent, with its own configuration, repeated after each release, since a change to a default profile setting would change the answer.

What the record shows

The vendor pages answer the title question by what they leave to configuration. Anthropic places Claude in Chrome in the signed-in browser with 1Password for logins; Browser Use and Skyvern document placeholders for typed values, domain limits and masking, and leave the profile to the person who launches the agent. The research record shows that untrusted page content can direct an agent, and the profile decides what a directed agent reaches: one scoped account in a fresh profile, or every session, password and autofill entry in the daily one. Substitution at render, before the model reads the page, is the control that limits what any profile yields, and it is the one RedactSure's design is built around. Testing one deployment means naming one agent and one task, noting which profile it launched with and what that profile was signed into, having it open one employee record, and searching its trace for the values the record displayed.

Frequently asked questions

Does an AI agent browse with my real browser profile?

An extension agent does, because it runs inside the browser that hosts it, which is the one you use all day. A framework agent such as Browser Use or Skyvern opens whichever profile its configuration names, so the answer is whatever the person who set it up chose. Check the launch configuration before the first run, and treat an attached daily profile as a decision to hand the agent every session and saved value that profile holds.

What is the difference between a fresh profile and my daily one?

A fresh profile starts empty: no sessions, no saved passwords, no autofill, no extensions. The agent signs in with the account it is given and reaches only what that account can reach. The daily profile starts with everything you have accumulated, so the agent opens signed-in sites without a login step and is offered your details on any form. The fresh profile narrows reach to one account, and the daily profile hands over the whole of yours, including sites the task never needed.

Do Browser Use's placeholders protect my saved passwords?

They protect the value the agent types. Browser Use documents that the model sees placeholders and that real values are injected into form fields after the model call, which covers a credential you hand the agent for a login. A password the browser already saved in an attached profile is filled by the browser, not typed by the agent, so the placeholder mechanism never sees it. Save nothing in the profile an agent uses, and let it type what it is handed.

Does Claude in Chrome use my open sessions?

Anthropic's help center describes Claude in Chrome seeing what is on the page, acting on it and requesting logins from 1Password, and the use of sessions already open in the browser is not covered in the pages reviewed for the related research page. Since the extension runs in your signed-in browser, assume open sessions are in reach, sign out of the sites the task does not need, and keep an administrator account out of that browser altogether.

What should I sign into a fresh profile for an agent?

One dedicated account scoped to the records the task needs, and nothing else. If the task is one employee record, the account should reach that record and not the whole directory, the mailbox or the payroll provider. Set the allowed domains to the sites the task uses, store any credential in a vault the agent reads at run time, and give the agent no administrator or root session under any circumstances.

What record should I keep of a run?

Which profile the agent launched with, which account it was signed into, which domains were allowed, which pages the model was shown and as what, and who approved each consequential action. Navigation limits and credential masking write no such record on their own, so the team either builds one from logs or runs the agent in an environment that produces it. Without that record, an incident review starts from a guess at what the agent might have reached, which is every site the profile was signed into.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Limits What Any Browser Profile Shows the Model

The profile decides which pages an agent opens signed in, and the controls reviewed above govern the login without deciding what the model receives from an open page.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent opens the employee record in the daily profile, reads name and account number, and an injected instruction can send them through the open mailbox. Inside the governed environment: the model meets EMP_001 on the record and the mailbox, and real values enter the record change only on the named person's approval.

RedactSure is deploying now with enterprise and government customers. Researchers documented browser agents exfiltrating credentials when untrusted pages instructed them to.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

Your everyday browser profile carries every account you are signed into while the agent works. Bring a task that opens a customer record and a mailbox and see, with test values, what the model reads on each. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.