Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Fellou Protect Against Prompt Injection?
No, not on an account whose pages carry a bank account number: Fellou's policy requests "screenshot and screen record, accessibility" permissions and warns that it "may unwittingly collect other personal data," while asking users not to input sensitive information into the service. Ask what the model receives from a rendered screen, and who approves the action that follows.
A payables clerk's browser is already signed in when the portal draws the vendor, the account number and the routing number. A page that carries a message for the model carries it into the same request as those details, and the instruction needs no credential of its own while the session beside it holds one.
Fellou sells the agent as the browser. Every tier lists Browser Use and Computer Use, and the vendor's own index calls the product "the world's first agentic browser that automates complex tasks with Deep Action technology". Whether an injected sentence changes a bank detail depends on two things a buyer can check: what reaches the model when the page renders, and who approves the change. The worked example is a payables screen of the kind a QuickBooks Online help thread describes, where "To set up a vendor with open bills, select Set up Bank Transfers within the same line as the Payee" (Intuit, 2021). The thread's steps are written for QuickBooks Online bill pay, and the screen is the record type a browser agent works on.
Key findings
- For Fellou to be safe on an account whose pages carry a bank account number, the values on a page would have to be replaced with consistent tokens before the model reads it, so a hidden instruction collects a placeholder rather than the number (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
- It would also require a named person approving each payment or detail change and a record of what the model received on every screen, the "agent identifiers, real-time monitoring, and activity logging" a visibility study sets out (Chan et al., 2024).
- Fellou's published documentation does not state that values on a page are replaced before the model reads them; its pages describe screen permissions and a rule addressed to the person who types (Fellou, Privacy Policy, 2026).
- The privacy policy lists "screenshot and screen record, accessibility, file management, command line or other operating system-related permissions" among what the browser requests, which puts the rendered screen inside the agent's reach (Fellou, Privacy Policy, 2026).
- The same policy says "we may unwittingly collect other personal data that you voluntarily input into the Services," a category it says "may include the said sensitive information" (Fellou, Privacy Policy, 2026).
- Fellou's terms tell users "Do not include unauthorized sensitive or confidential information or personal data in your Input," and describe Output as "generated by artificial intelligence models" (Fellou, Terms, 2026).
What happens when a payables page carries a hidden instruction?
An instruction for the model can sit anywhere on a page a person reads past. The memo line on a vendor row, a vendor name, a note field or white text on white all arrive in the page text the model consumes, none of it obvious to the clerk who checks the total. The test results are not close: hidden page elements stole specific personal data in up to 70% of tests (How Often Do AI Agents Follow Injected Instructions?).
Indirect injection names the arrival. A survey of browsing agents reports that its authors "demonstrate how untrusted web content can hijack agent behavior," and lists "prompt injection, domain validation bypass, and credential exfiltration" among its findings (What Can a Hijacked Agent Leak If It Only Has Placeholders?). One page supplies the sentence and the open session supplies the reach.
On a bank details screen that reach is the point. An agent that reads a memo line telling it to ignore the payee on file can open the transfer form, replace the account number and press save with the session the clerk left open. The lethal trifecta names the combination: access to private data, untrusted content and a way to communicate externally (What Is the Lethal Trifecta for AI Agents?). A rule about what a person types does not reach this case: the clerk did not type the instruction, the portal rendered it (Is It Safe to Let AI Agents Read External Web Pages?).
What does Fellou read on a screen, and what does the model receive?
Fellou documents the browser as the agent: Browser Use and Computer Use appear on every tier, and the index describes "Deep Action technology" for "cross-platform workflow automation". The policy lists two permissions together, "screenshot and screen record, accessibility" (Fellou, Privacy Policy, 2026). One covers pixels, the other the page as elements, and a browser holding both reads a value whether it is drawn in a field or printed in a paragraph.
The terms add where that content comes from. "The web page content displayed in the search sources is created and provided by third parties," they warn (Fellou, Terms, 2026), the untrusted half of the problem stated by the vendor itself.
That leaves the title's question narrowed to one screen. A payables row renders a vendor name, an account number, a routing number and a total, and the model reads them to decide what to fill; a hidden instruction in the same row is page text, so it arrives with the numbers. The pages reviewed describe permissions, collection and outputs. None describes a step that replaces a value with a token on the rendered page before the model reads it, which is why an injection has an account number to collect rather than ACCT_001. A study of injection against agentic coding editors reports attack success rates as high as 84% for executing malicious commands (Does Prompt Injection Matter If the Agent Has No Credentials?).
What do the vendors themselves say?
The privacy policy is the page that speaks to this question, and it argues with itself in three sentences. It opens with a promise, "We will not collect sensitive information such as identification documents and numbers, bank accounts, passwords, etc." (Fellou, Privacy Policy, 2026). It continues with a concession: "due to technical limitations and the way you use our Services," "we may unwittingly collect other personal data that you voluntarily input into the Services," and that data "may include the said sensitive information". It closes with a rule on the reader, "For your security, please do not input sensitive information into our Services". None of the three governs what the model reads.
The terms take the same position. "Do not include unauthorized sensitive or confidential information or personal data in your Input," they say (Fellou, Terms, 2026), and output "is generated by artificial intelligence models". Input and Output are defined around what the user submits and what a model returns; which page values reach the model in between fits neither definition.
The marketing pages are thinner. The index promises "all with military-grade security" (Fellou, llms.txt, 2026) and names no control behind the phrase. The Eko README, a developer framework rather than the browser, lists "Access to private web resources" and warns, "DO NOT use API Keys in browser/frontend code!" because that "will expose your credentials and may lead to unauthorized usage" (Fellou, Eko, 2026).
| Dimension | Fellou, per its documentation | What a buyer should verify |
|---|---|---|
| What the model receives | Screenshot, screen record and accessibility permissions; page content "created and provided by third parties" | Whether any value is replaced before the model reads the rendered page |
| What the policy promises | Will not collect identification numbers, bank accounts or passwords, and may unwittingly collect the same data | Which sentence applies to a page the agent opens on a logged-in account |
| What the agent can do | Browser Use and Computer Use on every tier | Which payment or detail change needs a named approver |
What should a security team ask for in writing?
Start with the reading step, because every other answer depends on it. Ask what the model receives from a rendered screen, field by field, and whether a value is replaced before it arrives, so the payables row reaches the model as ACCT_001 rather than the account number. A prompt governs an action, and the reading has already happened by then.
Then ask where a real value resolves: the number reaches the bank's own form when a named person approves the change, and not the model's context or a screenshot kept for debugging.
Then ask for the record. The three measures a visibility study sets out, "agent identifiers, real-time monitoring, and activity logging" (Chan et al., 2024), describe what a per-page trail holds: which agent, which screen, what it read and who approved. Accountability does not move with the tool: "FINRA intends for its rules and guidance to be technologically neutral" (FINRA, 2024), which leaves a member firm's duties attached to the work rather than to the browser.
Then ask whether detection is offered as the answer. A classifier lowers the number of injections that succeed and does not change what the model holds when one does: Anthropic states that its protections "significantly reduce risk" and that "no system is completely immune to all attacks" (Does a Smarter Model Stop Prompt Injection?).
What does a governed environment change?
It changes what the model is given, not what the browser is allowed to do. A governed environment substitutes values at the render layer: before any model reads the screen, the account number in the vendor row becomes a consistent token, and every later page in the run draws the same token for that value. The model still reads the vendor name, the invoice and the memo line; the account number it sees is ACCT_001.
The second change is where a real value resolves, at the approved destination and the moment of an approved action: the bank details form receives the number when a named person approves the change, and it never passes through the model's context.
The third change is the record. Every screen the model read, every action and every approval is written to a record the organization exports, so an audit can compare the page as the person saw it with the request the model received. That comparison is what turns a permission list into evidence.
None of this stops an injection from arriving. A lab page on agent automation holds that "trustworthy agent automation cannot be solved at a single layer of the stack" (DAPLab, 2026), which is why the substitution and the record belong together. Enterprise Browser or Render-Layer Tokenization? sets out what separates a browser control from an enterprise browser, and RedactSure vs Island Enterprise Browser: 2026 Comparison & Alternative applies the distinction to a category built for human data movement in web applications, which governs where a person may send a record, not what a model reads from a screen.
What the record shows
For a payables team, whether a hidden instruction pays off is decided on the rendered screen, not in the prompt the clerk typed. Fellou's pages put the screen inside the agent's reach through screenshot, screen record and accessibility permissions, and put the sensitive-data rule on the person, who is told not to type such information (Fellou, Privacy Policy, 2026). Neither sentence says what the model receives when a payables portal draws a vendor's account number. The team should run one test: name one page, open it with a test account, and compare the string the model received with the string the page displays. If both read the same account number, an injected memo line has something to take.
Methodology and limitations
The page rests on five Fellou pages read in full (the privacy policy, the terms, the pricing page, the machine-readable index and the Eko README), a regulator notice, a preprint on agent visibility, a lab page on agent automation and a knowledge-base thread on the payables screen used as the example. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 24, 2026, and each Sources line carries its date.
No product named here was tested for this page. "Not described" means the pages reviewed: a vendor documents what its product does, and a missing sentence is an omission rather than a claim about capability. Features change, and the page carries its date. The example describes a record type, a payables portal screen, and not an organization. RedactSure is deploying now with enterprise and government customers. Determinations about what a finance team owes its regulator belong to counsel, assessors and the organization's security and compliance officers.
Frequently asked questions
Does Fellou protect against prompt injection?
No, not on an account whose pages carry bank details. Fellou's policy asks for screenshot, screen record and accessibility permissions, warns that it may unwittingly collect other personal data, and tells users not to input sensitive information (Fellou, Privacy Policy, 2026). Those sentences describe collection and a rule on the person. Neither replaces a value on the rendered page before the model reads it, which is what would make an injected instruction collect a placeholder instead of an account number.
What does the model receive from a page that Fellou renders?
The page as the browser drew it, including text a reader sees and text a page hides from a script but draws on screen. The permissions cover screenshots and screen recording as well as accessibility, and Fellou's terms note that page content in search sources "is created and provided by third parties" (Fellou, Terms, 2026). A memo line written for the model arrives with the vendor row it sits in, in the same request as the numbers.
Does the permission prompt stop an injection?
It narrows what the agent may do and says nothing about what it has already read. A prompt shown before a click gives a person a chance to refuse an action, and the instruction is in the model's context by then; a request to read a page or summarize a memo may raise no prompt at all. Fellou's policy points to permissions and asks users to keep sensitive information out.
Does Fellou keep a record of what the model read?
Fellou's policy describes collection and deletion after notice, and its pricing page describes plan features and consumption (Fellou, Pricing, 2026). Neither describes an export of what the model received on a screen, which is the record an auditor asks for first: the three measures a visibility study names are "agent identifiers, real-time monitoring, and activity logging" (Chan et al., 2024).
Would a stronger model fix the reading problem?
No. A model that resists more injections still receives the values the page drew. A benchmark reviewed on this site reports that its results "reveal critical vulnerabilities in different stages of agent operation" and finds "limited effectiveness shown in current defenses" (Will Prompt Injection Ever Be Fixed at the Model Level?). The failure rate can move; what the model holds on a successful attempt does not.
What should a team ask Fellou in writing?
Which values are replaced on a rendered screen before the model reads it, where the real value resolves, who approves a payment or a detail change, and what record shows the screen as the model saw it. Ask for those four as sentences the vendor will stand behind, then run one payables task with test bank details and compare the page with the request.
How RedactSure Keeps a Hidden Instruction From Collecting the Account Number
A hidden instruction in a memo field reaches the model before anyone decides whether the payment should move. The browser's policy warns the service "may unwittingly collect other personal data" that may include the sensitive information users are told not to type (Fellou, Privacy Policy, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the portal draws the vendor row with the account number and the memo line's instruction, so one click can change where the money goes. Inside: the row renders as ACCT_001, the model reads the memo and drafts the change, and a named person approves it; the real number resolves at the bank's form at that moment.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
One payables page settles whether an injected memo line can move money, and who signed off on the change. Bring a vendor setup from your workflow and see, with test bank details, what the model reads and where the real number lands. Book a demo