Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Opera Neon Safe to Use for Work?
No, not on work accounts whose pages carry sensitive data. Opera's privacy statement says Neon sends your input to OpenAI, Google or another provider you choose, keeps the chat for 365 days, and limits itself to a final approval on some actions and a block on banking pages; check what the model receives before you rely on either.
No, not on a work account whose pages carry sensitive data, and the reason sits in Opera's own privacy statement rather than in a feature list. A researcher comparing three vendors asks Neon Do to pull the numbers into one table, and the pages it opens can carry a negotiated rate and a named customer beside the list price. The agent works inside the browser session a person already has open, and the input travels to a model provider. What an employer has to settle is narrower than whether the agent is good at comparison work: what leaves the browser, how long a copy stays on a server, and what the two safeguards Opera describes actually cover.
The answers are specific enough to review. Opera names the model route, gives a retention window of 365 days, and describes a final approval and a block on certain sites. It says nothing about the values a page shows the model, which is where a vendor comparison lands, because the rate a researcher wants is rarely the only figure on the page. A team that reads the feature list and stops there has read none of the terms that decide the question.
Key findings
- For Opera Neon to be safe on work accounts, the values on a page would have to be replaced with consistent tokens before the model reads it, with the real values resolving only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each submission or record change and a record of what the model received on each screen, and the privacy statement describes an approval step without describing either (What Is Supervised Delegation?).
- The statement describes what Neon blocks and what it keeps, and describes no control over which values a permitted page puts in front of the model (Does an AI Agent See Everything on Your Screen?).
- Opera's statement says chat data is "stored, fully encrypted, on Opera's servers, and will be automatically deleted after 365 days," which sets the retention window an employer has to fit its own obligations into (Opera, Privacy, 2026).
- The same statement says Neon is configured "to not complete certain actions without your final approval" and "will also block access to certain sensitive websites, like banking pages," two controls on where the agent goes and what it finishes (Opera, Privacy, 2026).
- Google's consumer Gemini Apps notice, which covers the consumer app rather than the API terms a browser vendor would use, says "A subset of chats is reviewed by human reviewers (including Google's trained service providers)" (Google, Privacy Hub, 2026).
What does Neon read on a vendor comparison page?
The record is one vendor comparison. A researcher opens three pricing pages, asks Neon Do for the per-seat price and the contract term, and the agent scrolls each page, opens the pricing details panel and types the figures into a comparison document. The task needs two values from each page; the pages render a list price, a negotiated rate, a term length, a customer logo and the account manager's name. Neon is one of the 3 of 15 AI agents whose pages describe removing or hiding some specific values, and 0 of the 15 describe replacing customer data on a working page with tokens the agent can work with, so a negotiated rate still reaches the model (Do AI Agents Ask Before Making a Payment?).
An agent that works a page reads that page. The statement treats page content as part of the deal: a tool the user connects "will need access to certain browser data (like tabs or page content)," and the assistant inside the browser works from the same tabs (Opera, Privacy, 2026). The tab the researcher left open is in scope along with the one the task names.
That read is also the injection surface. Attacks "enable adversaries to remotely (without a direct interface) exploit LLM-integrated applications" (Greshake et al., 2023), and injected page elements have reached "up to 70% attack success rate (ASR) in stealing users' specific PII" (How Do Websites Manipulate AI Agents?). A hidden instruction in a footnote arrives with the prices.
The session is the third part. A browser agent works the logins that are already open, so a comparison built from a customer's own vendor portal inherits every tab that portal trusts (Can a Browser Agent Read My Session Cookies?). On each of those pages the model receives the render, and the two safeguards act on the action and the destination rather than on the fields.
What do the vendors themselves say?
The pages that bear on this question are Opera's privacy statement and Google's help pages, and they answer different halves. Opera's statement is the only place that describes what Neon keeps and what it will not finish.
Opera covers the route, the provider's window, retention, training and the two controls in a few paragraphs. The model route is "OpenAI, Google or other AI model provider selected by you." The provider's own deletion window is 30 days for OpenAI and 24 hours for Google. Retention of Opera's own copy is 365 days, encrypted on its servers. Training is excluded: "Opera does not train AI models on your data." The controls are a final approval before certain actions and a block on sensitive sites such as banking pages, and the statement recommends that users "stay mindful of where you browse" (Opera, Privacy, 2026).
| Dimension | Opera Neon, per its privacy statement | What a buyer should verify |
|---|---|---|
| Model provider | "OpenAI, Google or other AI model provider selected by you" | Which provider your organization's terms cover |
| Retention | Chat "automatically deleted after 365 days", encrypted on Opera's servers | Whether a shorter retention duty applies to the work |
| Training | "Opera does not train AI models on your data" | What the provider does with what it receives |
| Approval | "not complete certain actions without your final approval" | Which actions, and what the approver is shown |
| Site blocking | "block access to certain sensitive websites, like banking pages" | Whether a destination block covers values on permitted pages |
| Third-party tools | a connected tool "will need access to certain browser data (like tabs or page content)" | What that tool keeps after the run |
Google's consumer notice supplies the provider half with its limit on the same page: "A subset of chats is reviewed by human reviewers (including Google's trained service providers)," and it advises "Please don't enter confidential information that you wouldn't want a reviewer to see" (Google, Privacy Hub, 2026). It is the Gemini Apps notice, so it governs the consumer app and not the API terms a browser vendor would accept.
What does Opera keep, and for how long?
A year is a long time for a task that took four minutes. Opera's statement gives the window plainly: chat data is "stored, fully encrypted, on Opera's servers," and it "will be automatically deleted after 365 days" (Opera, Privacy, 2026). Encryption at rest protects the copy from someone who reaches the disk. The 365 days is the number a retention schedule, an engagement letter or a data processing agreement has to accommodate.
One qualification belongs beside it. The statement excludes training and advertising in its own words: "Opera does not train AI models on your data, and your data is not used for advertising or personalization purposes" (Opera, Privacy, 2026).
The provider's clock is a second clock, and on Opera's own statement it runs shorter than the browser's: the statement gives 30 days for OpenAI and 24 hours for Google, against the 365 days Opera keeps for its copy (Opera, Privacy, 2026). A window that closes in a day or a month narrows the copy on the provider's side. It does not shorten the copy on Opera's servers, and it does not say which values on the page the model received.
OWASP's disclosure entry describes the consequence: "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, LLM02, 2025). A 365-day copy is where a disclosed value lives after the run has ended.
What do the approval step and the banking block cover?
The two safeguards are stated in one sentence: Neon is configured "to not complete certain actions without your final approval," and it "will also block access to certain sensitive websites, like banking pages" (Opera, Privacy, 2026). Both limit where the agent goes and what it finishes. Neither is a limit on what a page shows the model once the agent is on it.
The approval puts a person in the loop. The whitepaper on governing agentic systems calls human approval "a standard way to limit egregious failures" and asks that "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023).
What an approval cannot do is verify what the approver saw. OWASP's attack catalogue describes an attack that "manipulates the content and presentation of approval dialogs, deceiving users into authorizing malicious operations" (OWASP Foundation, n.d.). A dialog that asks whether to complete a comparison is a decision about an action, and the click cannot speak to the negotiated rate the page rendered five steps earlier.
The site block is a destination rule. Banking pages are a category a vendor can name; the pages this work runs through are pricing pages, order forms and a customer's vendor portal, and none of them is a bank. The value on a permitted page is a separate question, the same division Microsoft draws when its data loss prevention control restricts "users from pasting sensitive content into browser-based applications" (Why Does Microsoft Purview Block a Paste Into the Browser, and What Keeps the Work Moving?).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the pricing page renders CUST_001 where the customer's name sits, and the model compares the real rates across vendors. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. The real values resolve only at the approved destination, at the moment of an approved action. A named person approves every payment, submission and record change, under existing permissions, so the approval is on the record, and the run exports the screens the model received as tokens, the actions taken and the approvals given.
Its scope is the rendered page. A governed browser environment covers what an agent reads and does on a page such as a pricing page or an order form, and does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP.
The research record argues against a single layer that settles the whole problem. Columbia's lab page states that "trustworthy agent automation cannot be solved at a single layer of the stack" (DAPLab, 2026), and the benchmark work on agent-tool defenses makes the point from the other direction: a defense that "achieves perfect security with high utility across all four public benchmarks" is measured by benchmarks the same paper finds "easily saturated" (Bhagwatkar et al., 2026). Compare the two placements on this page's record (RedactSure vs Opera Neon: 2026 Comparison & Alternative), and the difference that matters is whether a value is replaced before any model reads the page.
What the record shows
The control this question turns on sits before the model: values replaced on the rendered screen, a named person approving the submission, and a record of what the model received. Against that standard Neon is a browser with real limits and a long tail. It names its model route, keeps an encrypted copy for a year, asks before certain actions and blocks banking sites, and it describes no step that decides which values a pricing page puts in front of the model. A work account whose pages carry a negotiated rate or a customer name is where that gap lands, and the 365-day copy outlives the task. An employer should run that test in an afternoon: open one vendor pricing page that carries a rate and a contact, ask the agent for the contract term, then list every field on the screen beside the two fields the task needed.
Methodology and limitations
This page rests on Opera's privacy statement, Google's help pages, OWASP's attack catalogue and disclosure entry, a preprint on indirect prompt injection, a benchmark paper on agent-tool defenses, a whitepaper on governing agentic systems, a Columbia lab page, and existing RedactSure research. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page.
No product on this page was tested for this page, and "not described" means the pages reviewed. Features change, and the page carries its date, so a release after it is unreviewed until the check above is repeated. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a comparison built from three pricing pages, and not an organization. Determinations about whether a workflow meets a retention obligation belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow.
Frequently asked questions
Is Opera Neon safe to use for work?
No, not on a work account whose pages carry a negotiated rate or a customer name. Opera's statement describes a browser that sends input to a model provider and keeps the conversation for 365 days, with the provider's copy deleted after 30 days for OpenAI or 24 hours for Google, a final approval before certain actions and a block on banking pages. The approval and the block cover where the agent goes. Neither decides which values on a permitted page reach the model, and that is the term a work account turns on.
What does the model provider receive from a Neon session?
The user's input, sent to "OpenAI, Google or other AI model provider selected by you," and the page content the agent works from. Opera's statement says a connected AI tool "will need access to certain browser data (like tabs or page content)," and the assistant in the browser reads the same tabs. The statement puts no field limit on that read.
Does Opera keep a copy of what Neon read?
Yes, for 365 days. The statement says chat data is "stored, fully encrypted, on Opera's servers" and "will be automatically deleted after 365 days," and that it is not used to train models or for advertising. Encryption at rest protects the copy from someone who reaches the disk; it does not shorten the year. A team with a shorter retention duty has to treat the copy as existing for the full window, not as gone when the task ends.
Does blocking banking pages keep sensitive data off the model's screen?
No. The block is a destination rule: Neon "will block access to certain sensitive websites, like banking pages," which narrows where the agent can go. A pricing page, an order form and a customer's vendor portal are not banks, and the values on them still render to the model. It is not a field-level control, and a team should not count it as one when it scopes a pilot.
Who approves an action that Neon completes?
The person at the keyboard, for the actions Opera covers. The statement says the browser is configured "to not complete certain actions without your final approval," which puts a click between the agent and some actions. It does not name the actions, and it does not say the approver sees which values the page put in front of the model. OWASP's attack catalogue shows a dialog can be manipulated, so an approval is evidence only when the record shows what the approver saw.
What record should an employer ask for before allowing Neon?
One record per run showing which screens the agent read, what values the model received on each, which actions ran and who approved them. Opera's statement describes retention, an approval step and a site block, and it describes no per-screen record an employer can export. Ask for that record, then compare it with the tabs the agent opened. A deletion date shows when a copy is gone, not what the model saw while the tab was open.
How RedactSure Keeps a Negotiated Rate Off the Model's Screen
A comparison that needs three prices also reads the negotiated rate and the customer name, and the controls above govern where the agent goes. Opera's statement keeps each chat for 365 days, a window that outlasts the comparison it was opened for (Opera, Privacy, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, Neon Do read the pricing page in the researcher's session and the model received the negotiated rate and the account manager's name. Inside the governed environment the same page renders CUST_001, the customer's name resolves only at the export a named person approved, and the approval carries that name into the record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A negotiated rate that never reaches the model cannot be repeated in a comparison document. Bring one pricing page and see, with test values, what the model reads and who approves the export. Book a demo