Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is It Safe to Let Manus Handle Customer Records?
No, not on a live queue of real customer records. Manus's help center describes isolated sessions, encrypted traffic and a live view of the run, and it does not state what the model reads on a logged-in customer page or how long the session keeps it; ask for both before a session touches a real queue.
A support queue is where customer records collect: names, email addresses, order numbers, the last four digits of a card, and the free-text message that explains what went wrong. Point a browser agent at that queue and it reads the list, opens a ticket, drafts a reply and updates fields, so a rendered page passes in front of a model at every step. Manus runs that work in a cloud browser it operates for the user, and its help center describes isolated browser instances, encrypted sessions, a live view of the run and a Take Over step when a site asks for a verification (Manus, 2026). The same page does not state which values the model reads on a logged-in customer page, or how long the session, its transcript and what the model read are kept. Those two questions set the answer: an export with the identifying fields removed is workable in a way that a live queue of real customers is not. A bad reply is the smallest part of what is at stake. A record that carries a name, an address and a partial card number identifies a customer, and a session that has read two hundred of them holds the queue rather than one ticket.
Key findings
- A customer record is safe with an agent only when the values on the page are replaced with consistent tokens before the model reads it, so the queue shows CUST_014 where the customer's details sit (What Is Render-Layer Tokenization?).
- It also needs a named person approving each write to the record and a record of what the model received, so a reply, a refund and a status change are attributable to someone rather than to a run (What Is a Protected Browser for AI Agents?).
- Manus's published documentation does not state that values on a page are replaced before the model reads them; its pages describe "a separate, isolated browser instance" per user and a live view of the run (Manus, 2026).
- In a measured attack on generalist web agents, injected page elements reached "up to 70% attack success rate (ASR) in stealing users' specific PII," the material a support queue holds by default (Liao et al., 2025).
- OWASP's entry for sensitive information disclosure warns that "Personal identifiable information (PII) may be disclosed during interactions with the LLM," with outcomes that include "unauthorized data access, privacy violations, and intellectual property breaches" (OWASP, 2025).
- The page sets no period for a session, a transcript or a memory of the run; "You can log out or clear sessions anytime" is an action for the user, not a retention term (Manus, 2026).
What does a Manus session read on a customer record screen?
The record for this page is a support queue with customer PII. The list view carries a name, an email address, an order number and the last four digits of a card; the detail view carries the customer's message above the fields an agent updates. A Manus task opens the list, reads the detail page and drafts a reply, so every screen it works is drawn in the cloud browser and read by the model that decides the next click.
The help center describes the account side: "Each user has a separate, isolated browser instance," "All browser sessions are encrypted," and "You see everything Manus is doing in real-time" (Manus, 2026). Isolation and encryption keep other users and the network away from the session. Neither changes what the model reads on a page the session is working, and the page describes no step that replaces a customer value before the model sees it.
Injected page elements reached "up to 70% attack success rate (ASR) in stealing users' specific PII" in a measured attack on generalist web agents (Liao et al., 2025), and research on information flow reports that "poisoned data retrieved from one component can change the model's behavior and compromise the entire system, including coercing the model to spread confidential data to untrusted components" (Siddiqui et al., 2025). A queue supplies both: the identifying fields, and a customer's message an outsider can write.
Cloud rendering does not settle it: a page drawn on the provider's infrastructure and sent as "a stream of draw commands rather than page code" is still a page a model reads (How to Protect Data Without Cloud Browser Rendering?). The three conditions that make a queue dangerous, private data, untrusted content and an outbound path, are the ones the analysis of agent browsing names (Is It Safe to Let AI Agents Read External Web Pages?).
What does Manus keep after it reads a customer record?
The help center answers the account questions and leaves the record questions open. It states that "Manus doesn't store your passwords," that "You control which accounts Manus can access," and that "You can log out or clear sessions anytime" (Manus, 2026). Each of those limits what the account can reach, and none sets a period for the session, for a transcript, or for whatever the model keeps of a page it has read.
That silence is expensive for a queue. An agent that worked two hundred tickets has read two hundred records, and what it read travels past the page in ways the page does not describe. A study of privacy in language models found that GPT-4 and ChatGPT "reveal private information in contexts that humans would not" in 39% and 57% of cases (Mireshghallah et al., 2024). A cloud session also keeps the state that makes an agent useful across steps (Can a Browser Agent Read My Session Cookies?).
A session that is cleared and a service that states what it kept are different answers, and the gap between the organizations experimenting with agents and the ones running them at scale is where that question gets decided (What Is the PII Wall?). A team can settle it on one ticket: ask for the retention period in writing, run a test record with a marked field, and see whether the mark is still there when the task ends.
What do the vendors themselves say?
Two vendor pages bear on the question. Manus's help center governs the session, and Google's Workspace guidance covers the account an agent signs in with.
Manus documents the isolation and the watching: "Each user has a separate, isolated browser instance," "All browser sessions are encrypted," "Manus doesn't store your passwords," and "Take Over lets you temporarily control the browser when Manus encounters verifications (CAPTCHA, SMS codes, etc.)" (Manus, 2026). The page sets no retention period for what the session read, and it does not state what the model reads on a logged-in customer page.
Only one of the 16 AI agent products the prompt injection review covers publishes a rate, Claude in Chrome, and Manus's rate is not described in the pages searched (How Many AI Agent Vendors Publish a Prompt Injection Rate?).
Google's advice on administrator accounts is a limit on the account rather than on the model: "Use the super admin account only when needed" (Google, 2026). The guidance covers administrator accounts in Workspace, and it does not address an agent session that signs in on a user's behalf. Together they leave a buyer with the account controls and without a statement about the screen.
| Dimension | Manus, per its documentation | What a buyer should verify |
|---|---|---|
| Session isolation | "Each user has a separate, isolated browser instance" | Whether tasks on one account share a session |
| What the model receives | A live view of the run for the person watching; nothing stated about what the model reads | What the model reads on a logged-in customer page |
| Retention | "You can log out or clear sessions anytime"; no period given | The period for a session, a transcript and model context |
| Account access | "You control which accounts Manus can access" | Which accounts a task may reach, and at what privilege |
Who approves a change to a customer record, and what record shows it?
The documented human step is a verification handover, not an approval. Take Over returns the browser to the person when a site asks for a CAPTCHA or an SMS code, at the point a site demands proof of a person (Manus, 2026). A reply sent to a customer, a refund issued and a status changed on a record are writes the agent makes after that point, and the help center describes no approver for them.
Who approves is a question about identity, and the regulator has said what that identity needs: covered entities "should consider using authentication factors that can withstand AI-manipulated deepfakes" (New York State Department of Financial Services, 2024).
AWS's guidance for agentic systems recommends separate permissions for an agent and a human so that "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). In a session where the agent acts inside the user's account, the log that exists names the user. A lab that studies agent infrastructure adds the scale problem: "workflows leak data, and human oversight breaks under scale" (DAPLab, 2026).
The design that makes an approval mean something is the one credential products already document: the value is injected "if, and only if, the human approves the access" (Can a Browser Agent See My Password When It Logs In?). For a queue, the equivalent is a named person approving the write, with the record showing the page the model read before it.
What does a governed environment change?
A governed environment is a control class that acts where the screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a queue shows CUST_014 and CARD_014 and the agent works on those. Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each payment, submission and record change, and every screen as tokens, every action and every approval lands in a record that exports to the organization's own monitoring.
It changes two things here. A transcript of two hundred tickets that holds tokens is a record of work; one that holds names and card digits is a copy of the customer base, so retention becomes answerable rather than silent. And a write to a record has a name on it, with the record showing the page the model read before it.
Its scope is the rendered page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP, and a queue worked through a ticketing API sits outside it.
A lab that studies agent automation concludes that "trustworthy agent automation cannot be solved at a single layer of the stack" (DAPLab, 2026), and the render layer is the one an agent's model actually reads (What Is Render-Layer Tokenization?). The comparison with a hosted browsing session is in (RedactSure vs Manus: 2026 Comparison & Alternative).
What the record shows
A customer record is only as safe with an agent as the two controls around it: what the model receives from the rendered page, and who approves a change to the record. The pages reviewed describe isolated sessions, encrypted traffic, a live view and a Take Over step, and they do not state which values the model reads on a logged-in page or how long the session keeps them. For a support queue that makes the answer specific: an export stripped of names, addresses and account numbers is workable, and the live queue is not. Name one task and one test record, run it in a test tenant, and write down what the model received on the first screen and whether the session kept it.
Methodology and limitations
This page rests on Manus's help center, Google's Workspace guidance, a state regulator's letter, OWASP's entry on sensitive information disclosure, three research papers, AWS's agentic AI lens, a lab page and existing RedactSure research pages. Sources were read between October 16, 2026 and October 21, 2026, and each Sources line carries the date for its page. Figures from research papers are cited as reported.
No product on this page was tested. The products are described from their public documentation, vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a support queue with customer PII, not an organization. What the model reads on a logged-in page, and what a session retains, are not described in the pages reviewed.
Whether a queue, a retention period or an approval meets a contractual, privacy or regulatory requirement is a determination for counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Is it safe to let Manus handle customer records?
No, not on a live queue of real customers. The help center describes isolated browser instances, encrypted sessions and a live view of the run, and it does not state what the model reads on a logged-in customer page or how long the session keeps what it read (Manus, 2026). A page that holds a name, an address and a partial card number is read like any other page. An export with those fields removed changes the answer; the live queue does not.
Does Manus show the model the whole customer record?
The pages reviewed do not say. What they describe is a browser Manus operates, with a live view for the person watching and a Take Over step when a site asks for a verification. A detail page that renders a name, an address and the last four digits of a card puts those values in front of whatever reads the page, and no step replaces them first. Treat the record as read until a test run shows otherwise.
What does Manus keep after a session ends?
No period is stated. "You can log out or clear sessions anytime" and "All browser sessions are encrypted" cover the session and its transport, and neither sets a period. A transcript, a memory of the run and a log of what the model read are not described on the page. Ask for the retention period in writing, and treat a session that read a queue as a copy of it until the answer arrives.
Who approves a change an agent makes to a customer record?
No one, from what the pages describe. Take Over returns the browser to the person when a site asks for a CAPTCHA or an SMS code, which is a verification step and not an approval of a reply, a refund or a status change. An approval that carries weight names the person, shows what will change, lands in a record, and rests on authentication a generated voice cannot carry.
What record shows what the model read?
None that the help center describes. The live view is a window on the run while it happens, and the page describes no export of the screens the model received. AWS's guidance for agentic systems makes the requirement concrete: separate agent and human permissions, so that "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). A queue needs the screen the model saw, the action taken and the name of whoever approved it.
Is Manus fine for an anonymized export?
Yes, when the fields that identify a person are gone before the session starts. A list of ticket numbers, dates and product names gives an agent work without a customer attached, and the exposure here depends on values that identify someone. A name, an address or the last four digits of a card is an identity, and a pseudonymous case ID is not. Strip the fields, run the export against a test queue, and keep the live queue out of the session.
How RedactSure Keeps a Support Queue Off the Model's Screen
A browser agent that reads a customer's name and card details has already taken the record, and controls on where it goes leave that step untouched. Injected page elements in a measured attack on web agents reached "up to 70% attack success rate (ASR) in stealing users' specific PII."
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the session opens the queue and the model receives the customer's name, email address and the card's last four digits as it drafts a reply. Inside: the page shows CUST_014, MAIL_014 and CARD_014, the reply is drafted from those tokens, and the support lead approves the status change before the real values resolve.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A support queue holds the customer records that make an agent useful and the ones that make it dangerous. Bring one ticket workflow and see, with test values, the page the model reads, the approval and the record. Book a demo