Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Browser Use Cloud Record Your Sessions?
Only where a project records: Browser Use's cloud documentation states that "Zero Data Retention (ZDR) projects never record, even when recording is requested," and every other project settles what the file holds. Ask what a payroll recording contains, who can read it and how long it stays.
For a security team, a cloud run leaves two artifacts: the actions the agent took, and the screens it read on the way. The second is what that team opens after a change nobody can explain, and it is the least often specified when a tool is chosen. Browser Use Cloud records sessions, and its documentation names the case where it does not: a project on zero data retention never records, even when a recording is requested (Browser Use, Secrets, 2026). Between them sits everything a buyer has to establish, from the setting that starts a recording to the people who can open the file afterward. The gap matters most where the screen is worth stealing. A payroll portal shows an employee's name, bank account number, gross pay and deduction lines on one view, and a run that changes a direct deposit reads all of it. Once recorded, the run leaves a copy with permissions of its own, so a reviewer who never had a payroll login can watch one run on repeat. The answer to the title question is a condition rather than a word, and the buyer should state that condition in writing before an agent touches a live account.
Key findings
- A recording is only as safe as the screen it captured, so a keepable payroll record is one where the values were replaced with consistent tokens such as PAYEE_014 before any model read the page (What Is Render-Layer Tokenization?).
- It also takes a named person approving each change and a record of what the model saw, so the artifact carries an approval trail beside a screen of tokens (What Is an AI Control Record?).
- Browser Use's cloud documentation settles one case and leaves the rest open: the page describes the zero-data-retention project, and the pages reviewed do not state a recording default, a retention period or who can read the file (Browser Use, Secrets, 2026).
- The open-source template tells developers to "Set use_vision=False to prevent screenshot leaks," which closes one path from a page to a model and says nothing about what a cloud recording keeps (Browser Use, Sensitive Data, 2026).
- A measured evaluation of web agents found they "are prone to inadvertent use of unnecessary sensitive information," which is the class of data a recording collects in full (Zharmagambetov et al., 2025).
- Palo Alto Networks states that its browser can "automatically redact sensitive data in prompts before they leave the enterprise environment," which covers the prompt and not the session file (Palo Alto Networks, 2026).
Does Browser Use Cloud record every run?
Recording is a feature of a cloud project rather than of every run, and the documentation states the exception in one sentence: a project on zero data retention never records, even when a recording is requested (Browser Use, Secrets, 2026). Read plainly, it makes two claims: a recording exists to be requested, and one class of project never produces one. The same task, run twice in two projects, can therefore leave two different artifacts, and an incident review depends on knowing which one it has. Everything else is left to the operator, from the default for a new project to the list of who may open the file.
The rest of that page concerns credentials. It states that aliases "do not guarantee that the agent cannot see the value," and that allowed domains "restrict where that credential may be typed" (Browser Use, Secrets, 2026). Both govern a value an agent types into a form, and neither describes the screen a run reads or the file a run leaves.
A team that wants no provider-side record can run the agent against a local Chrome profile, which moves the problem rather than closing it: the profile and any file the run writes stay on the machine, under whatever backup rules apply (Is It Safer to Run a Coding Agent on My Laptop or in the Cloud?).
What does a recording of a payroll run hold?
A payroll portal is the clearest case: one screen shows a name, bank routing and account numbers, pay and deduction lines, none of which a payroll team would put in a shared folder. The record for this page is a direct deposit change for one employee, and the task is to change one field on a live account. Browser Use is one of the 9 of 15 AI agents whose pages document keeping passwords or credentials away from the model, and 0 of the 15 describe doing the same for the customer data a working page displays, so a recording of the run can hold the payroll values the model read (Do AI Agents Ask Before Making a Payment?).
Whatever the model reads is in the run, and a recording is a copy of what the screen held. The open-source template treats that copy as a known path: it tells developers to "Set use_vision=False to prevent screenshot leaks," which closes the screenshot route from a page to a model (Browser Use, Sensitive Data, 2026). The setting belongs to the library and says nothing about the recorder.
The agent also reads more than the task needs. A measured evaluation found web agents "are prone to inadvertent use of unnecessary sensitive information," so a run asked to change one field can carry the salary and the deduction history with it (Zharmagambetov et al., 2025).
That is why the composition of the screen matters more than the composition of the file. Consistent pseudonyms, restored after the model's work, reduce semantic utility errors by a factor of five, so a tokenized screen does not break the task (Does Masking Data on Screen Break Browser Agents?).
What do the vendors themselves say?
Three vendor pages bear on the question, and none answers it for a recorded cloud run.
Browser Use's cloud page is the only one that uses the word recording, and its subject after that is credentials: aliases "do not guarantee that the agent cannot see the value," and allowed domains "restrict where that credential may be typed" (Browser Use, Secrets, 2026). OpenAI's ChatGPT Work overview governs where a run may sign in, stating that "Website sign-in through the cloud browser isn't available in Enterprise or Edu workspaces" (OpenAI, 2026).
An enterprise browser takes the opposite approach at the endpoint. Palo Alto Networks states that its browser can "automatically redact sensitive data in prompts before they leave the enterprise environment," a control on the prompt rather than on the session file (Palo Alto Networks, 2026). A team that reads only that sentence could conclude the screen is covered.
| Vendor | What its page states | What a buyer should verify |
|---|---|---|
| Browser Use, Secrets | A zero-data-retention project never records | Whether the plan under contract is the one that records |
| Browser Use, Sensitive Data | "Set use_vision=False to prevent screenshot leaks" (Browser Use, Sensitive Data, 2026) | Whether the cloud recorder follows that setting |
| OpenAI | "Allowing a website doesn't approve every action on that site" (OpenAI, 2026) | Which actions the record attributes to a person |
How long is a recording kept, and who can read it?
A retention period for a recorded project is not described in the pages reviewed, and neither is the list of people, in the customer's organization or the vendor's, who can open the file.
The run also happens without a witness. Agents pursue goals "without constant human oversight," which makes the recording the only account of what a run did (MIT Sloan Management Review, 2025). Once the file exists, its audience grows: an incident review, an audit, a support ticket. Each reader sees the payroll screen, and none needed a payroll login.
A recording also has a boundary that is easy to miss. A registry measurement of agent skills found extensions that "bundle natural language instructions and helper scripts that execute with full user privileges," a reach far wider than the page a run displays (USENIX Association, 2026), and the file shows only what the model read.
Retention is where agent programs stall, and What Is the PII Wall? puts that question at the center of a deployment that never ships. Hidden text and faint instructions are read by screenshot-taking agents, so a recording holds them as faithfully as it holds the payroll fields (Can Hidden Text on a Web Page Hijack a Browser Agent?).
What should a security team ask for in writing before a run is recorded?
Six answers belong in the contract before recording is switched on, and a vendor that cannot give them in writing has not settled the question.
Ask what the model receives from a rendered screen, and ask separately what the file keeps. The first answer describes the run, the second the artifact that outlives it, and inside a vendor's system they are different documents.
Then the retention terms: a period, a deletion path on request, and the system that holds the file. The fourth question is the scope of a zero-data-retention commitment, which Browser Use's cloud page states for recordings while treating credential handling separately (Browser Use, Secrets, 2026).
Access is the fifth. Who inside the vendor can open a recording, whether a customer administrator can narrow that list, and whether the file exports to the customer's monitoring are three questions one answer about authorized personnel does not settle.
The last is the identity the run uses. Coder's guidance is to "Be sure not to give agents full permissions on behalf of a user," which bounds what a run may do and not what a recording of its screens holds (Coder, 2026).
The design that answers both halves renders the page with tokens and resolves real values only at an approved destination (What Is a Protected Browser for AI Agents?).
What does a governed environment change?
A governed environment changes the input to a recording rather than the recording. The screen is rendered with tokens in place of the values a policy names, consistent for the whole run, so a payroll portal draws the payee as PAYEE_014 and the account as ACCT_022 before any model reads the page. The model works with those tokens, and a recording holds what the model saw rather than a copy of the portal.
The rest of the control class sits around that substitution. Real values resolve only at the approved destination, at the moment of an approved action, so the deposit form receives the account number and the file does not. A named person approves each payment, submission and record change, so the artifact is an approval trail as well as a screen, and every screen, action and approval is written to a record that exports to the organization's monitoring.
That is a different object from a session recording: a recording answers what the screen looked like, while a governed record answers what the model was shown, what it did and who approved. The comparison of the two browser designs sets out the difference for one vendor (RedactSure vs Browser Use: 2026 Comparison & Alternative).
Its scope is the rendered page, and it does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP.
What the record shows
Security teams should treat a recording as a copy of the rendered screen, so the worth of the copy depends on what the screen held. Browser Use's cloud documentation states the exception a zero-data-retention project gets and then stops, leaving the default, the lifetime and the access list to the buyer (Browser Use, Secrets, 2026). The open-source template treats screenshots as a leak path and gives developers a setting to close it, which is a control on one route to a model rather than on the file a cloud project keeps. The question a retention policy has to answer is "what guarantees the environment that the agent executes within needs to provide" (Columbia DAPLab, 2026). The team should pick one recorded run against a test payroll account, read the file back field by field, and count the values that need a justification to store. Then repeat the run with a test value in place of the real account number and compare the two files; if the second is the one the team would keep, the control belongs at the render layer.
Methodology and limitations
This page rests on Browser Use's cloud and open-source documentation, the product page for one enterprise browser, OpenAI's overview of ChatGPT Work, Coder's guidance, one measured evaluation of web agents, one registry measurement of agent skills, two analyses of agentic systems and existing RedactSure research pages. Vendor pages were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control, and every quotation is the page's wording.
No product named here was tested for this page, and "not described in the pages reviewed" means the pages named in Sources and no others. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a payroll direct deposit change, and not an organization. Vendor features change and the page carries its date, so a later release is unreviewed until the check above is repeated. Determinations about whether a recording satisfies a contractual, records or privacy obligation belong to counsel, assessors and the organization's own compliance officers.
Frequently asked questions
Does Browser Use Cloud record every session?
No. A recording has to be requested for the project, and the cloud documentation states that a project on zero data retention never records, even when one is requested. What the same pages do not state is the default for a new project, how long a recording is kept, or who can open it. Treat those three as open questions until a vendor answer puts them in writing, and settle them before a payroll account is in the run.
What does a recording of a payroll portal show?
The screen the agent read: the employee's name, the bank routing and account numbers, the gross pay, the deduction lines, and the controls the agent clicked. If vision was on, the images the model received are part of it too. A measured evaluation found web agents "are prone to inadvertent use of unnecessary sensitive information," so expect the file to hold fields the task never needed (Zharmagambetov et al., 2025). Read the file back field by field before it is stored anywhere shared.
Do zero-data-retention projects record anything?
Not according to the cloud documentation, which states that a project on zero data retention never records, even when a recording is requested. The commitment covers recordings. The same page treats credential handling as a separate subject, so a team that needs both covered should have both named in the contract rather than assuming one follows from the other. Ask for the zero-data-retention term and its scope to appear in the agreement itself.
How long is a recording kept?
Not from the pages reviewed. Browser Use's cloud documentation states the zero-data-retention exception and gives no retention period for a project that records, no deletion path and no statement of where the file is stored. Ask for the period, the deletion route and the storage location in writing, and expect the answers to change with the plan the organization buys.
Who can read a recording of a run?
The pages reviewed do not name the people who can open a recorded session, either inside the customer's organization or inside the vendor's. That matters because readers accumulate: an incident review, an audit and a support ticket all pull the file, and none of those readers needs a payroll login. Ask for the access list and for the export path to your own monitoring.
Does turning off screenshots keep the model from reading a sensitive screen?
No. The setting removes images from what the model receives, and the model still reads the text the browser extracts from the page, which is where an account number sits. The open-source template offers the setting to close a screenshot route, and the screen's other values remain. Only substitution on the rendered page changes what the model holds, and with it what any recording of the run holds.
How RedactSure Keeps Payroll Values Out of the Recording
A recording is a copy of the screen, so a payroll run leaves the account numbers in a second place with its own access list. Browser Use's cloud documentation states that zero-data-retention projects never record, even when recording is requested, which leaves every other project to settle what the file holds.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent reads the bank account and salary on the payroll portal, and the recording keeps them. Inside the governed environment: the portal renders PAYEE_014 and ACCT_022, the recording holds the tokens, and a named person's approval releases the real values to the deposit form.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A payroll run recorded once is read many times, by people who never saw the portal. Bring one agent task from your workflow and see, with test values, what the screen shows the model and which approval the record names. Book a demo