Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Zscaler AI Broker Secure Browser Agents?
No, not on the screens a browser agent reads: Zscaler's brokers govern the calls an agent makes to MCP and A2A servers, with inline DLP on the transaction, and no page states that a value on a rendered screen is replaced before a model reads it. Ask what the model receives from the page, then what the call carries.
A finance team hands an agent a vendor invoice to reconcile against the payable ledger. On one path the agent calls an MCP server, which returns the invoice as JSON; on the other it opens the payable record in a bought application and reads the vendor name, the bank account and the amount off the screen. Zscaler's documentation covers the first path: the AI Security page describes MCP and A2A brokers, inline inspection and DLP on the model, agent and API calls the platform sees (Zscaler, AI Security, 2026). The distinction is practical, because it decides which control a security team buys and which run a record can reconstruct. The second path generates no call for a control plane to inspect, and a browser agent that reads a rendered page takes its values into the model's context, where a later step in the same run can send them anywhere the agent can reach. The broker vocabulary does not describe that difference, because a request and a read are different events. A security team should establish what the model holds after the screen is drawn, which the pages reviewed leave open.
Key findings
- Because the page is the input, the control that answers this question replaces the values a payable screen renders with consistent tokens before any model reads it, so the agent works with VENDOR_014 and ACCT_014 throughout (What Is Render-Layer Tokenization?).
- A named person approving each payment or record change, and a record of what the model received, are the other half, since a traffic policy keeps no entry for a read that never became a call (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
- The gap is placement: Zscaler's pages describe MCP and A2A brokers, inline DLP and a runtime boundary, and none of them describes a step that replaces a value on a rendered page before a model reads it (Zscaler, AI Security, 2026).
- Web agents in a measured evaluation "are prone to inadvertent use of unnecessary sensitive information," and the leak path in that setting is the page each step renders (Zharmagambetov et al., 2025).
- A firewall at the agent-tool interface "achieves perfect security with high utility across all four public benchmarks," a result about calls, not a page (Bhagwatkar et al., 2026).
- Zscaler puts the broker there: "Secure agentic communications through MCP and A2A brokers and enforce fine-grained access policies across every enterprise AI agent" (Zscaler, AI Security, 2026).
What does the broker govern, and what does it leave to the screen?
Zscaler's AI Security page promises to "Route, secure, and govern every AI transaction from one central control plane," and it states that "Zscaler sits inline across the full AI workflow" (Zscaler, AI Security, 2026). Its phrase "filter sensitive data from LLMs" is a control on the data traveling to a model in a call, not on the page an application renders.
SAP's course material gives the agent-to-agent path the same shape: "A2A is primarily used for outbound agent-to-agent communication," with inbound requests routed through an Agent Hub that enforces authentication and authorization (SAP Learning, 2026). An MCP call has the same structure, a defined request to a server that exposes the operations and scopes its author chose (Should AI Agents Use Screens, APIs or MCP?).
Set the paths side by side. A payable record holds a vendor name, a remit-to bank account and an amount. Through MCP, the agent asks for invoice 4471 and receives a JSON object with those fields, each crossing a point the broker owns. Through a browser, the agent opens the payable page and the same three fields are painted on a screen it reads as text. The second path has no request to authorize and no response to inspect, and that is where a broker stops. The 86-product review splits along the same line: 27 of them document control over what a model receives in pipelines or traffic they handle, against one that describes masking what an agent reads from a page it works in (How Many AI Security Products Control What an AI Agent Sees?).
What does a browser agent read on an account page?
Open the payable record and the browser agent sees the whole page: vendor name, bank account, amount and approval field. A web agent reads the rendered document, so the page itself is the input. Work on autonomous web agents found that they "are prone to inadvertent use of unnecessary sensitive information," and the exposure happens where the values are (Zharmagambetov et al., 2025).
A browsing agent's prompt is built from the page, and a survey of browsing agents reports findings including "prompt injection, domain validation bypass, and credential exfiltration" (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?), so one successful injection yields an action rather than a disclosure alone (Does Prompt Injection Matter If the Agent Has No Credentials?). Brave's researchers reported that attackers can "hide prompt injection instructions in images using a faint light blue text" that screenshot-reading agents act on (Can Hidden Text on a Web Page Hijack a Browser Agent?).
The page is assembled from data the application already holds, including fields the person at that step does not need, such as the full account number where the task is to confirm an invoice.
Google's Gemini guidance names one layer as "Identifying and redacting external image URLs and suspicious links" (Google Workspace Admin Help, 2026), a defense on what reaches the model that leaves the account number where the page put it.
What do the vendors themselves say?
Zscaler's AI Security page offers to "filter sensitive data from LLMs" and to apply "inline DLP and Zero Trust applied to every model, agent, and API call in real time" (Zscaler, AI Security, 2026). Its generative AI page adds browser isolation, offering to "render AI and ML applications in Browser Isolation to allow user prompts while restricting clipboard use for uploads and downloads" (Zscaler, Generative AI, 2026). The October 21, 2026 blog adds a runtime boundary, a runtime that "contains the agent and governs what it can see, do, and reach," with Zscaler picking up "at the moment the agent reaches beyond the runtime" (Zscaler, OpenShell, 2026).
| Dimension | Zscaler, per its documentation | What a buyer should verify |
|---|---|---|
| Where the control sits | "Zscaler sits inline across the full AI workflow" (Zscaler, AI Security, 2026) | Whether a page read crosses any inline point |
| What it inspects | "filter sensitive data from LLMs" (Zscaler, AI Security, 2026) | Whether the model's input is the call or the rendered page |
| Agent-to-agent path | "Secure agentic communications through MCP and A2A brokers" (Zscaler, AI Security, 2026) | Whether a browser session sits on the broker path |
| Browser AI | "render AI and ML applications in Browser Isolation to allow user prompts while restricting clipboard use" (Zscaler, Generative AI, 2026) | What the model receives after the application renders |
| Runtime boundary | "Zscaler picks up at the moment the agent reaches beyond the runtime" (Zscaler, OpenShell, 2026) | Whether the runtime's own containment covers the screen |
| Approval | No page reviewed names the person who approves one payment or record change | Who signs for the action, and where the name is recorded |
| Record | "The data is stopped in transit and the attempt is recorded" (Zscaler, OpenShell, 2026) | Whether a record exists for a read that never became a call |
Read together, the pages place the control at the call, the isolated session and the runtime edge, each an event the platform can name. A clipboard restriction keeps a file from crossing the boundary of a session, which is a control on exfiltration by copy and paste, and it does not change the account number the payable page displays so a payment can be approved. A dedicated AI Broker page was not among the pages reviewed, so the broker facts here come from the AI Security page, which is the page that describes MCP and A2A brokers. The pages state what they govern, not what the screen shows. A buyer should treat the table as an inventory of what the documentation states.
What should a security team ask for in writing?
The answers sort a vendor into one of two placements, and five questions do most of the work:
- Which values does the model receive from the rendered screen, field by field, on a page the agent already works?
- Does the broker see a page read, or only a call?
- Who approves the payment, the submission or the record change, and is that person's name in the record?
- What does the record show the model held after the screen was drawn?
- Which identity does the agent use, and what scope does that identity carry?
The regulator's concern is the action as much as the disclosure. FINRA's 2026 oversight report sets out both risks: "AI agents acting autonomously without human validation and approval," and agents that "may act beyond the user's actual or intended scope and authority" (FINRA, 2025). Harvard's guidance asks organizations to "Require human approval for high-impact, sensitive, irreversible, or externally visible actions whenever feasible" (Harvard University Information Security and Data Privacy, 2026). A payment is externally visible and hard to reverse, and a browser agent holding an account number is one step from it.
None of those answers replaces the others: an identity scopes what the agent may do, an approval names who answers for it, and a record shows what the model held. Only the first question changes the value the agent can leak.
What does a governed environment change?
A governed environment is a control class that acts at the render layer, before any model reads a page. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.Values chosen by a policy are replaced with consistent tokens for the whole run, so a payable record reads VENDOR_014 and ACCT_014, and the tokens stay the same on every screen. Real values resolve only at the approved destination, at the moment of an approved action. A named person confirms which fields are tokenized and approves each consequential action, and every screen as tokens, every action and every approval is written to a record that exports to the organization's monitoring.
What changes for this page's question is the unit. A broker governs a request, which can be named, allowed or blocked. A screen read is not a request, so a governed environment governs the read itself. The application still renders the vendor name and the account number, because the person approving the payment needs to see them, and the model sees the tokens in their place. The release happens at the destination the approval names.
The placement is what separates the two, and the adjacent comparison sets Zscaler's own wording beside it (RedactSure vs Zscaler: 2026 Comparison & Alternative).
What the record shows
A security team should judge the control by where it acts: a token in place of a value on the rendered page, a named approver, and a record of what the model held. Set against that, the broker's coverage is the traffic Zscaler's pages name: the model, agent and API calls that cross its control plane, the MCP and A2A path, and the runtime boundary its blog describes. A page read in a bought application is not one of those events, and no Zscaler page states that a value there is replaced before a model reads it. The useful question for a buyer is which path the work takes. A buyer can run the test on their own system: name one payable record and one agent, run the task twice, once through the broker and once through the browser, and compare what each model held with the record the broker kept.
Methodology and limitations
This page rests on vendor documentation from Zscaler, Google and SAP read between October 16, 2026 and October 23, 2026, two research preprints, one regulator's report, and university guidance, with the RedactSure pages linked in the body. Public documentation read in full shows where each product applies its control. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page.
None of the named products was tested for this page. Where this page says that a vendor's page does not state something, the reference is the pages reviewed, not the product's full behavior; features change and the page carries its date. The example describes a record type, a payable record in a finance application, and not an organization. RedactSure is deploying now with enterprise and government customers. Determinations about whether a control meets a contractual, regulatory or audit requirement belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Does Zscaler AI Broker secure browser agents?
No. The brokers Zscaler's AI Security page describes govern agentic communications over MCP and A2A, and the page applies inline DLP to those calls. A browser agent reading a payable record produces no call of that kind, so the broker has nothing to inspect and no place to replace the account number. What changes the answer is a control at the render layer, before the model reads the screen.
What does a browser agent read that a broker never sees?
The rendered page, field by field, as the application draws it. A payable record shows the vendor name, the account, the amount and an approval field, and the agent's model receives that text as its input. A broker sees the calls an agent makes to a server, with the operation and the response. The page produces neither, so the account number never becomes an inspected request, and no policy entry exists for that read.
Does Zscaler's browser isolation change what the model receives?
Not from what its page states. The page offers Browser Isolation for AI applications, a clipboard restriction, and visibility into the prompts users send. Those control where the application runs and what leaves the session. The page does not state where they sit relative to the model, or that a value on the rendered page is replaced before the model reads it, so a buyer cannot conclude that the model receives tokens.
Who should approve an agent's payment on a customer record?
A named person, for that payment. Harvard's guidance asks for human approval of high-impact, externally visible actions, and a payment is both. A role-based rule is different: written in advance and applied to a category, it does not name who answered for this record. The approval also has to be recorded: after an incident, the question is who approved what.
What record should exist for a read that never became a call?
One the agent's own environment writes: the screen the model read, the action taken, and the approval with a name on it. A broker's log covers the calls it inspected, and a read in a bought application leaves no such entry. Without that record, an investigation can show a page was open and not which values the model held. Ask for the export format and where the record lands in your monitoring.
Does the answer change for an agent that uses only MCP?
Yes, for that agent the broker is the relevant control, because every value it handles travels in a call the broker can name and inspect. The answer flips back the moment the same agent opens a browser to finish a task, common when an application has no useful API and is reached through its screen. Check the workflow rather than the product, and treat any step that renders a page as outside the broker's path, whatever the agent calls.
How RedactSure Protects the Screen a Broker Never Reads
A broker secures the calls an agent makes, and the page it reads on the way to a payment never becomes one of them. Zscaler's own page places its control on the call, filtering sensitive data on the way to a model, not on the screen.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the model reads the payable page with the vendor's real bank account and keeps it in context. Inside the governed environment, the page renders VENDOR_014 and ACCT_014, and a named person approves the payment, with the screen and approval in the record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A broker can show you every call it inspected, not what the model read on the page. Bring one workflow where an agent reads a customer record and see, with test values, what it receives and where the real value lands. Book a demo