Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Fellou Safe to Use for Work?
No, not on work accounts whose pages carry sensitive data: Fellou's policy warns it may "unwittingly collect" what a user inputs and asks users not to input sensitive information. Check what the model receives from the page, who approves each action and what record survives the run.
No, not on work accounts whose pages carry sensitive data. A researcher opens a vendor portal with Fellou's browser, asks for the renewal date on one contract, and the agent signs in with the researcher's session, reads the contract table and answers. The account number, the contract value, the billing contact and the support history on that table travel with the answer. Those are the values a work account exists to protect. Fellou describes it as "the world's first agentic browser that automates complex tasks with Deep Action technology" (Fellou, llms.txt, 2026), and lists "Browser Use" and "Computer Use" on every plan including the free one (Fellou, Pricing, 2026). Whether that is safe for an employer depends on three things the vendor's pages leave open: what the model receives from the screen, who approves an action, and what record a reviewer can read afterward. The policy warns that it may "unwittingly collect" what a user inputs and asks users not to input sensitive information, which is guidance to the user rather than a control on the page. An employer that hands an agent a login still answers for what the page shows, and it should settle those three things first.
Key findings
- For Fellou to be safe on a work account, the values a vendor portal renders would have to be replaced with consistent tokens such as ACCT_001 before the model reads the page, with real values resolving only at the approved destination (What Is Least Exposure?).
- It would also require a named person approving each submission and record change the agent proposes, and a record of what the model received on every screen the agent opened (What Is Supervised Delegation?).
- Fellou's published pages do not state that a rendered page's values are replaced before a model reads them; the policy asks users, "please do not input sensitive information into our Services" instead (Fellou, Policy, 2026).
- Fellou's Pricing page lists "Browser Use" and "Computer Use" on every tier, including the free plan, and it says nothing about how a page is filtered before a model reads it (Fellou, Pricing, 2026).
- A benchmark of web agents found that they "are prone to inadvertent use of unnecessary sensitive information," which is what a summary task does when it reads a whole portal page (Zharmagambetov et al., 2025).
- The Eko README, the developer framework Fellou publishes, credits its agents with "Access to private web resources," and it describes no filter on page content before a model call (Fellou, Eko, 2026).
What does an agent read when Fellou opens a vendor portal?
The record for this page is a vendor portal opened with a researcher's login: one contract page showing a renewal date, an account number, a contract value, a billing contact and a support history. The agent arrives inside the researcher's session, so it goes where the researcher could go and reads what that account renders (What Is a Tethered Agent?). The tether describes the agent's authority, not which values the model keeps.
Fellou's privacy policy describes the reach an agent needs: permissions for "screenshot and screen record, accessibility, file management, command line or other operating-system-related permissions" (Fellou, Policy, 2026). That is access to a screen, not a limit on what crosses from the screen to a model.
The benchmark record on web agents points the same way: they "are prone to inadvertent use of unnecessary sensitive information," and an agent asked for one renewal date has no reason to leave the billing contact out (Zharmagambetov et al., 2025).
A hosted browser makes the exchange visible: the application approves each new website origin, and the agent observes screenshots and chooses its next action from what it sees (Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?). The origin was approved when the login was stored; the screenshot is where the values cross.
Who approves an action Fellou proposes on a work login?
A work login turns a browser into a delegate. The agent can submit a supplier form, change a renewal date or approve a purchase, and every one of those actions lands on the account the researcher signed in with. The approval question is who, outside the model, says yes before that happens.
FINRA's 2026 oversight report records "AI agents acting autonomously without human validation and approval" and cautions that "Agents may act beyond the user's actual or intended scope and authority" (FINRA, 2025).
The AI Agent Index's 2025 entry for Gemini Enterprise records the approval requirements for its decision types as "None" found, with a pause or stop control standing in for an approver (AI Agent Index, 2026).
The research record explains why the approver has to sit outside the model. A benchmark of agent defenses reports results that "reveal critical vulnerabilities in different stages of agent operation," with "limited effectiveness shown in current defenses" (Will Prompt Injection Ever Be Fixed at the Model Level?). A confirmation the agent itself interprets is not an independent check, and the enterprise pattern is a person who scopes the work and answers for it (What Is Supervised Delegation?).
None of the pages reviewed names the person who approves an individual submission on a work account.
What do the vendors themselves say?
Fellou's Privacy Policy states that "due to technical limitations and the way you use our Services, we may unwittingly collect other personal data that you voluntarily input into the Services," then asks users, "please do not input sensitive information into our Services" (Fellou, Policy, 2026). The same policy promises that the company will not collect identification documents, bank accounts or passwords, and describes deletion once it notices such data.
| Dimension | Fellou, per its documentation | What a buyer should verify |
|---|---|---|
| Screen access | Screenshot and screen record, accessibility, file management and command line permissions | Whether a permission is scoped to the values one task needs |
| Plans | Browser Use and Computer Use on every tier, including free; Advanced Model on paid tiers | Which tier an employer would run, and what changes on it |
| Collection | No identification documents, bank accounts or passwords; users asked not to input sensitive data | What happens to values a portal renders, which the promise does not address |
| Output | Output generated by AI models from search sources | Which page values reach the model that generates it |
| Third parties | Services may include third party software and products | Which components see a page during a run |
| Record | Deletion of data once noticed | What record shows a screen as the model received it |
Fellou's Terms of Service say that "All Output provided by these Services is generated by artificial intelligence models and may contain errors or omissions," and they treat Input as what a user submits (Fellou, Terms, 2026). The same terms describe Output as "a model-based integration of information from the search sources based on natural language understanding capabilities," and they name no model provider or substitution step before a model call (Fellou, Terms, 2026). They add that "Our services may include third party software, products or services," so the components in a run are not all Fellou's own (Fellou, Terms, 2026).
Fellou's machine-readable index promises "military-grade security," a phrase that comes with no described control over what a model reads from a rendered page (Fellou, llms.txt, 2026). No Fellou page reviewed describes replacing values on the rendered screen before a model reads it, naming the person who approves each action, or keeping a record of what the model received; those mechanisms are not described in the pages reviewed.
What record would show what the model received?
A work account's review asks for three things after every run: which screens the agent opened, what each screen showed the model, and who approved the actions taken.
Fellou's policy addresses deletion rather than accounting. The policy says Fellou "will immediately delete or anonymize such information once noticed by us," which is a deletion practice rather than a record of what a model received (Fellou, Policy, 2026). Notice is not a timestamp a buyer can audit.
The nearest documented masking control in an enterprise platform is switched off for agents. In that platform's guidance, data masking for language models is currently disabled for agents, and a confirmation prompt is recommended before a custom action proceeds (Which Enterprise AI Agents Can Work on Screens With PII Today, and What Does Each One Read?). A prompt records a decision to proceed, not the values the model read before it proposed the action.
The failure the record has to survive is documented. A study of browsing agents lists "prompt injection, domain validation bypass, and credential exfiltration" among its findings, three failures one hijacked run can produce together (Does a Prompt Injection Detector Protect My Credentials?). When those three arrive in one run, the record is the only artifact that shows what the page contained when the model acted.
What does a governed environment change?
A governed environment acts at the point where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so an agent working a vendor portal sees ACCT_001 and CONTRACT_014 where the account number and the contract value sit. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each consequential action, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
That control class answers a limit the identity approach leaves open. Least privilege governs actions and credentials; it does not govern the content of the screen an agent reads (What Is Least Exposure?).
Confidential computing marks the same boundary. It keeps data in use from the host operating system, the hypervisor, the cloud provider and an insider, a list that does not include the model (RedactSure vs Anjuna: 2026 Comparison & Alternative).
The screenshot shows ACCT_001 on the contract table. The submission the agent proposes waits for a person whose name is attached to the approval. The record exports the screen as tokens, the action and the approver, so a reviewer can compare what the model read with what the page contained.
What the record shows
No, not on work accounts whose pages carry sensitive data, and the reason sits in three places a buyer can name: the model receives what the rendered page shows, no person is named to approve an action, and no record states what the model received. Fellou's pages describe permissions, plans, outputs and a security phrase in detail, and each of those governs what the agent may do or what the company promises about collection. The vendor's own warning that it may "unwittingly collect" what a user inputs is the clearest statement of the limit. An employer should run the check on one portal page with a test account: ask the agent for a single value, then compare the transcript, the page and any log the run left behind. The gap between those three is the answer.
Methodology and limitations
This page rests on Fellou's public documentation, the privacy policy, terms of service, pricing page, llms.txt and the Eko README, together with one benchmark of web agents, FINRA's 2026 annual regulatory oversight report, a research index of deployed agents and existing RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control. The vendor pages were read as of October 24, 2026, and each Sources line carries the date for its page.
No product on this page was tested hands-on, Fellou's or RedactSure's, and RedactSure is deploying now with enterprise and government customers. "Not described" means the pages reviewed said nothing about a mechanism, not that the mechanism is absent from the product; vendor features change, and the page carries its date. The example describes a record type, a vendor portal opened with a researcher's login, and not an organization. Determinations about whether a workflow meets a contractual or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Is Fellou safe to use for work?
No, not on work accounts whose pages carry sensitive data. Its policy warns that the service may "unwittingly collect" personal data a user inputs and asks users not to input sensitive information, and its plans put Browser Use and Computer Use on every tier. Those are statements about collection and features, not about what a model receives from a page. A work account needs the answer in the transcript.
Does Fellou send the whole page it reads to a model?
Not from the pages reviewed. The policy describes permissions that let an agent capture the screen and read its content, and the terms treat Output as what models generate, but neither page says which values from a portal reach a model or whether any are replaced first. That silence is the finding: a documentation review cannot settle the question alone, and one test page answers more.
Who approves an action Fellou takes on a work account?
No person is named in the pages reviewed. The policy and terms describe permissions, plans and outputs; neither names an approver for a submission, a record change or a payment. FINRA's 2026 oversight report warns that agents may act without human validation, and a catalog of deployed agents records approval requirements as "None" for one enterprise suite. A work account should supply the approver the documentation does not.
What record does Fellou keep of what its agent read?
No record of what the model read is described. The policy addresses deletion: it says the company will "immediately delete or anonymize" information once noticed, which treats collected data as something to remove rather than something to account for. A reviewer asking which screens the agent opened, what each screen showed the model and who approved an action would not find those three items described. The record has to come from the environment the agent runs in, or from the buyer's own test.
Do the free plan's Browser Use and Computer Use change what the model reads?
No. The plan changes what a buyer pays and which model tier runs, not what the agent is shown on a page. Browser Use and Computer Use appear on every tier, including the free plan, and the pricing page describes features and limits rather than a screen-level filter. A paid tier that adds Advanced Model widens the choice of model; it does not change the page values any model receives. The exposure question is the same on every plan.
What control would change the answer?
Replacing the portal's values with consistent tokens before any model reads the screen, resolving real values only at the approved destination, naming the person who approves each submission, and exporting a record of what the model received. Those controls sit outside the model and outside a permission list. With them, an agent can work the page and the account number stays out of its context. Without them, a work account is trusting a permission grant to do the work of a policy.
How RedactSure Keeps a Vendor Portal's Values Out of the Model
A researcher's portal login lets an agent read an account number, and the controls reviewed here govern where it goes, not what its model receives. Fellou's policy asks users not to input sensitive information into a service built to read pages (Fellou, Policy, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the model receives the account number and the contract value as the page draws them, and the screenshot carries both into the transcript. Inside: the portal renders ACCT_001 and CONTRACT_014 for the whole run, the researcher approves the one submission the agent proposes, and the real values reach the vendor's form at that approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
The account number on a portal page is the value an employer will be asked to explain. Bring one vendor portal and see, with test values, what the model reads and where the real value lands. Book a demo