Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is a Browser Extension Enough to Secure an Agentic Browser?
No, not as the only control: an extension can govern what an agent types, pastes and uploads in a browser it is installed in, but it does not change what the page renders into the model, and an agent in a cloud browser never loads it. Ask what the model received on each screen, then test one record.
A support agent opens an order record in Comet and asks the browser agent to refund the card on file. The extension installed in that browser sees the paste, flags the card number and holds the action for a click. The customer's name, address and order value sit on the same page, and the model read them to find the refund button. The extension never saw that read.
An extension is a control at the browser's edge: it watches what a person or an agent sends out and can stop a paste, an upload or a visit. An agentic browser works in the opposite direction, reading the page before it acts, so the decisive question is what the page puts in front of the model. This means the extension protects the send and not the read, and most teams meet that gap between experimenting and scaling: 62% of organizations are at least experimenting with AI agents and 23% are scaling them (What Is the PII Wall?).
The stakes are a record that outlives the task. A customer page that renders in full stays in a context that can be logged or pasted onward, and the same task run by a cloud agent never touches the browser with the extension. A security team that cannot say which of those two points its control acts on cannot say what its agent's model has read.
Key findings
- For an agent to work safely on a page that carries customer data, the values would have to be replaced with consistent tokens before the model reads it, so the model works on CUST_014 rather than on the record itself (What Is Render-Layer Tokenization?).
- It would also require a named person approving each consequential action and a record of what the model received on each screen, a decision about the run rather than about traffic that leaves the browser (What Is a Protected Browser for AI Agents?).
- Akamai's product page describes controls on what leaves the browser, and the pages reviewed do not describe replacing a value on a permitted page or a named person approving one agent action (Akamai, product page, 2026).
- Akamai documents that "an autonomous agent acting in the browser is governed by the same policies as a person," which applies a person's policy to an agent without changing what the page shows it (Akamai, product page, 2026).
- Chaikin and Sahib found that once an agent follows injected instructions in a logged-in browser, "same-origin policy (SOP) or cross-origin resource sharing (CORS) are all effectively useless," so the page the extension allows is where the exposure sits (Chaikin and Sahib, 2025).
- Sahib and Chaikin showed that an attacker can "hide prompt injection instructions in images using a faint light blue text" that a screenshot-reading agent acts on, an instruction that never passes through a paste or upload control (Sahib and Chaikin, 2025).
What can an extension see when an agent reads a page?
Akamai's product page states that the product "installs as an extension on the browsers your organization already runs." The events it names are "Text input, copy/paste, uploads, downloads, and data exchanges," and the response can be "adaptive controls that warn, redact, block, or guide user actions based on context and risk" (Akamai, product page, 2026).
That list describes an egress boundary. A paste into a chat box, an upload of a customer export, a visit to a personal webmail: each is an action the extension can see before it leaves. Trade coverage of the product stated that it could "prevent AI agents from accessing sensitive websites or restrict them from pasting certain types of data," and named "ChatGPT Atlas, Comet, Dia, and Genspark" as the supported browsers (CIO Influence, 2026), a list that included Atlas, which OpenAI discontinued in August 2026 (OpenAI, 2026).
In Comet on a laptop, the agent opens a customer order and pastes the card number into the refund form; the extension sees the paste and stops it. In Manus, the same refund runs in a browser on the vendor's cloud, the person watches a live view, and no extension from the organization is installed there (What Can Manus See in Your Cloud Browser Session?).
What the documented controls do not change is the page as the model receives it, because their events are the agent's actions, not the page's content. For Browser Use to be safe on a live support queue, the values on each customer record would have to be replaced with consistent tokens before the model reads the screen (Is It Safe to Run Browser Use on Customer Records?).
Where does an extension stop on a screen it allows?
The control starts with a decision about the site. If the customer portal is permitted, the page loads and renders, and the application composes its values. The documented events then govern what the agent does with them: stop the paste, hold the download, warn on the upload. The pages reviewed do not describe replacing a value on a permitted page before the model reads it (Akamai, product page, 2026).
That leaves the reading itself ungoverned. A refund screen carries the customer's name, address, order value and the card on file, and the model reads the page to find the button. The extension's log records that a paste was blocked, not that the address was read. A paste into a chat box is the event the extension governs best (Can a Browser Agent Be Tricked Into Pasting Sensitive Data Into a Chat?).
Brave's research on Comet shows why an allowed page is the dangerous one. Chaikin and Sahib found that once an agent follows injected instructions in a logged-in browser, "same-origin policy (SOP) or cross-origin resource sharing (CORS) are all effectively useless" (Chaikin and Sahib, 2025). A second post shows an instruction that never passes a paste field: an attacker can "hide prompt injection instructions in images using a faint light blue text" that a screenshot-reading agent acts on (Sahib and Chaikin, 2025).
Other layers have the same shape. Anthropic's engineering post states that "effective sandboxing requires both filesystem and network isolation," a control on where an agent executes rather than on what a page shows it (Anthropic, 2025). The USENIX paper adds a channel a browser never sees: web and research agents "are vulnerable to inference attacks by passive network observers" (USENIX Association, 2026).
Across the 86 AI security and data protection products reviewed, 58 describe controlling where data can go, and 1 describes masking what an agent reads on the web pages it works in (How Many AI Security Products Control What an AI Agent Sees?).
What do the vendors themselves say?
Two Akamai documents describe the extension's coverage, and both are clear about the actions it governs. The product page states that the product "installs as an extension on the browsers your organization already runs," and its events are "Text input, copy/paste, uploads, downloads, and data exchanges" (Akamai, product page, 2026). The solution brief describes "Governance for all AI usage, including prompts, responses, and data pastes in real time" and "Browser-native DLP that monitors data in motion, without network decryption" (Akamai, Brief, 2026). Neither describes a value replaced on the page before the model reads it, which is the limit to hold in view when the agent rather than a person is the reader.
A blocked paste is visible and satisfying; a customer record read in full is invisible. The table sets what the pages document against what a buyer has to verify.
| Dimension | Akamai Workforce Protector, per its pages | What a buyer should verify |
|---|---|---|
| Where it runs | "installs as an extension on the browsers your organization already runs" (Akamai, product page, 2026) | Whether every browser the agent uses is in the install base, including a cloud browser |
| What it governs | "Text input, copy/paste, uploads, downloads, and data exchanges" (Akamai, product page, 2026) | Whether the control acts on the action or on the content of the page |
| The screen | No page reviewed states that values are replaced before the model reads the page | Ask for the model's input on one record, field by field |
| Cloud agents | No page reviewed states that a browser the organization does not run is covered | Ask where the agent's browser runs and who installs the control |
The trade coverage follows the same pattern: site access and paste restrictions, with a supported list that names desktop AI browsers (CIO Influence, 2026).
Who approves the agent's action, and what record is left?
The extension's approval is a prompt at the browser. A person can be asked to confirm a blocked or guided action, which is a real check at the point of the event (Akamai, product page, 2026). For an autonomous agent, the same policy applies and the prompt has no person attached to it, and the pages reviewed do not describe a named approver for one agent step.
The record follows from that. An extension logs an event it blocked or allowed. It does not, on the pages reviewed, export a statement of what the page showed the model, because it does not stand between the page and the model. A security team that has to show an examiner what the agent read has to get that record somewhere else.
Custody is a third layer, and it helps with credentials rather than the page. AWS documents a token vault built to "Securely store OAuth 2.0 Access and Refresh tokens, API keys, and OAuth 2.0 client secrets," which the agent retrieves with its own workload token (Douglas III, 2025). That keeps a credential out of a transcript, and it does not remove a customer's address from a refund screen. A fill-level control shows the same pattern: Browser Use's documentation says that "the LLM only sees placeholders (x_user, x_pass)" and that "real values are injected directly into form fields after the LLM call," which covers values an agent types and not values a page displays (Can a Browser Agent Fill In a Form Without Seeing the Values?).
The approval and the record belong to the run: a named person approving a payment, and an exported record of the screen that person approved.
What does a governed environment change?
A governed environment is a control class that acts before the model reads. Values chosen by policy are replaced with consistent tokens on the rendered page, so the model works on CUST_014 and ACCT_002 for the whole run. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the policy and approves each consequential action, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
Its scope is the rendered page. It governs what the agent reads and does on a screen, and it does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP.
The difference is where the control sits. An extension is installed in a browser the organization runs, so its coverage follows the install base and stops at a cloud browser. A render-layer control sits where the page is composed, so it applies to the page the model receives whether the agent runs on a laptop or in a governed cloud session. The comparison with Akamai Workforce Protector sets the extension's coverage, which ends at the browser it is installed in, beside a control that sits at the page (RedactSure vs Akamai Workforce Protector).
The extension still has work to do. It governs egress, and a paste or an upload is a leakage path that a page-level control does not see. A lab that studies agent infrastructure puts the general point plainly: "trustworthy agent automation cannot be solved at a single layer of the stack" (DAPLab, 2026). A team running agents needs both controls.
What the record shows
What a model receives from a screen is set where the page is composed. An extension that governs typing, paste, upload and download is real coverage for a person and for an agent driven in a browser the organization runs; it leaves the rendered record in the model's context, and it does not reach an agent in a cloud browser. For a person it is sufficient, and for an agent it covers the outbound action while the reading goes uncovered. Test one refund in both places: run the same task in the browser with the extension and in the cloud agent, then compare what each model received, field by field, with the event log.
Methodology and limitations
This page rests on vendor documentation, vendor security research, one peer-reviewed paper, one lab page and existing research pages. Reading the vendor pages in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 27, 2026, and each Sources line carries the date for its page.
None of the products named on this page was tested for it. "Not described in the pages reviewed" means the pages reviewed, not a claim about what a product does, and vendor features change as the page carries its date. The products are described from their public documentation, and RedactSure's deployments include enterprise and government customers. The example is a refund on a customer order, a record type rather than an organization.
Determinations belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Is a browser extension enough to secure what an agent reads on a screen?
No, not as the only control. An extension governs what an agent types, pastes, uploads and downloads in a browser it is installed in, and those are real leakage paths. It does not change what the rendered page puts before the model, and an agent in a cloud browser never loads it. Treat it as one layer, then check what the model received on the record the agent worked.
What can an extension stop before an agent's action leaves the browser?
It can stop the action before it leaves: a paste of a card number into a chat box, an upload of a customer list, a download of a report, a visit to a blocked site. Akamai names those events and the warn, redact, block or guide responses, and each response is a decision about an action. A page-level control works earlier, on what the page shows, so the two controls cover different points and a team usually needs both.
Does an extension change what the agent's model reads?
Not from the pages reviewed. The documented controls act on typing, paste, upload, download and data exchange, and the pages do not describe replacing a value on a permitted page before the model reads it. Once the site is allowed, the record renders in full. Brave's research shows why that matters: an instruction hidden in a permitted page, or in an image, is read before any outbound action occurs.
What does a cloud browser receive that an extension never sees?
The extension does not reach it. The product installs on the browsers the organization already runs, and a cloud agent browses in a browser on the vendor's infrastructure. The person may watch a live view, but the view is a stream for the person, not a control on what the model receives. Ask where the browser runs before assuming the extension covers the task.
Who approves an agent's action under each approach?
At the browser, a person can be asked to confirm a blocked or guided action, which is an approval at the point of the event. An autonomous agent acting on a permitted page can propose a payment or a record change without that prompt, and the pages reviewed do not describe a named approver for one agent step. A governed environment puts the approver outside the model, on each consequential action, and records the name.
What should a security team ask a vendor about what the model reads?
Where the control acts: on the event, on the network, or on the rendered screen. Whether values on a page are replaced before the model reads it, and with what token. Whether the agent's browser runs on the organization's devices or in the vendor's cloud. Who approves a payment or a record change, and what record names that person. Any answer the documentation does not support is unanswered until a run on a test record confirms it.
How RedactSure Replaces Values on the Page Before the Agent's Model Reads It
An extension can stop the paste and still leave the customer's address and card on file in the model's context. Akamai's page governs "Text input, copy/paste, uploads, downloads, and data exchanges," a boundary at the action rather than at the page (Akamai, product page, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the refund record in Comet and the model receives the customer's name, address, order value and the card on file. Inside: the same record renders CUST_014, ADDR_003 and CARD_001, a named supervisor approves the refund, and the real card number resolves only for that approved action.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
An extension governs what an agent sends out, while the refund record is what its model reads. Bring one agent task and see, with test values, what the model reads and who approves the release. Book a demo