Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

What Can a Hijacked Agent Leak If It Only Has Placeholders?

An agent that only holds placeholders can leak tokens, page text the policy left in the clear, and the fact of the action, but not the values behind them. Check which fields the policy tokenizes, whether a label can be reused across screens or runs, and what the agent can still do with a send button.

A credential reference travels from a browser record through a bounded route to a separate API destination.

A security team that lets an agent work a shared inbox has to plan for the injection that wins, and what matters then is what the agent can hand over when the record it read held labels instead of values. On a page where names, account numbers and identifiers were substituted before the model saw them, an exfiltration instruction still runs to completion, and the message that arrives at the attacker's address carries NAME_001, SSN_001 and ACCT_001 where the values sat. The attack succeeds and the payload is worthless, which is a design goal stated as a result rather than a filter that happened to hold. This page sets the boundary of that claim first, then walks one record type through the attack: a shared inbox in a browser mail client, an injected line inside an inbound message, and an outbound copy of the thread. The measurements say an injection does not always fail, so the page asks what a successful one collects, reading the vendor pages that describe where a real value lives, the measurements of how often an injected instruction wins, and the places where a placeholder stops covering the record. The last section states the control class in neutral terms, without a product name.

Key findings

  • A survey of browsing agents reports that "Our findings include prompt injection, domain validation bypass, and credential exfiltration" and that the authors "demonstrate how untrusted web content can hijack agent behavior" (Mudryi et al., 2025).
  • Measured injections that ask an agent to hand over what it saw during a task reached "average attack success rates (ASR) around 20 percent" (Alizadeh et al., 2025), and injected page elements reached "up to 70% attack success rate (ASR) in stealing users' specific PII" in a peer-reviewed study (Liao et al., 2025).
  • Browser Use's template states the design plainly: "The LLM only sees placeholders (x_user, x_pass), we filter your sensitive data from the input text" (Browser Use, Sensitive, 2026).
  • The same vendor's cloud page states the limit: aliases "do not guarantee that the agent cannot see the value" (Browser Use, Secrets, 2026).
  • A governed environment replaces values with consistent tokens before any model reads the screen, so the most a hijacked run can send home is a set of labels such as ACCT_001 (What Is Render-Layer Tokenization?).
  • Real values resolve only at the approved destination at the moment of an approved action, so a label copied into an outbound message does not resolve anywhere the attacker can reach (What Is Render-Layer Tokenization?).

What does a governed browser environment cover, and what sits outside it?

A governed browser environment covers what an agent reads and does on a rendered page: dashboards, consoles, settings pages, issue pages and a browser mail client. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. An agent that copies the same record out of an API response into a shell variable is outside this page. An agent that opens the inbox in a browser and reads the thread on screen is inside it.

That boundary decides which control applies to which leak. Outside the page, the equivalent disciplines are credential stores, short-lived credentials, egress filters and sandboxes, and they bound where a value can go and what a process may touch. A durable top-level key is the other end of the same question, which is why Is It Safe to Let an AI Agent Set Up Your Cloud Environment? records AWS's advice against creating access keys for the root user. On the page, none of those layers sees what the model reads, because the page is drawn after they finish. An agent can sit behind a filtered network and still paste what it read into a message body.

The record type for this page is one shared inbox in a browser mail client, opened by an agent asked to triage a queue. The question is not academic. McKinsey's research, as the page on the PII wall records it, finds 62% of organizations at least experimenting with AI agents and 23% scaling them anywhere, and the record types on this page sit in the gap (What Is the PII Wall?).

What does a hijacked agent send out when the values it read were tokens?

The inbox makes the mechanics concrete. The agent has one task: read new messages, find the ones about a billing dispute, and draft replies. The thread it opens shows a name, a Social Security number and an account number, each replaced before the page was drawn, as NAME_001, SSN_001 and ACCT_001. One inbound message contains a line addressed to the agent, telling it to forward the thread to an address outside the company. The agent does, because the line reads like an instruction.

What arrives is not nothing. The attacker gets the labels, and beside a field marked Social Security number, SSN_001 identifies the kind of value even without the digits. It gets the count of records, the timing of the send, the subject lines and the attachment names. The conditions are the ones the trifecta names: private data on the page, untrusted content in the same context, and a way to send (What Is the Lethal Trifecta for AI Agents?).

What does not arrive is the value. A label means something only inside the environment that issued it, so the forwarded thread describes the record rather than carrying it. Browser Use's documentation draws the same line from the other side: "Real values are injected directly into form fields after the LLM call" (Browser Use, Sensitive, 2026). The value exists at the field after the model has finished with the page, not in the model's context where the injected line could reach it. A label that never resolves in the model's context is a label the model cannot lose.

What do the vendors themselves say?

Four documents bear on where a real value lives when an agent acts, and each states a limit. Firecracker's design document states that "All egress traffic from a guest is therefore considered untrusted, and should be filtered at the host-level," which bounds where a hijacked workload can send data and says nothing about what the workload holds (Firecracker, 2026). Cursor's Agent Security page states that "By default, terminal commands need your approval" and that "All MCP connections need your approval," adds that "AI can behave unexpectedly due to prompt injection, hallucinations, and other issues," and describes its run modes as "best-effort guardrails rather than a hard security boundary" (Cursor, 2026).

1Password and Browserbase state that "Credentials are not shared with the LLM or exposed in Browserbase logs and repos," and that a person approves through "Real-time approval prompts via 1Password mobile or desktop" (1Password and Browserbase, 2025); the release gives no technical detail on how the credential reaches the field. Browser Use's template states the design plainly: "The LLM only sees placeholders (x_user, x_pass), we filter your sensitive data from the input text," and the same page tells a builder to "Use Browser(allowed_domains=[...]) to restrict navigation," a limit on where the agent may go and not on what a permitted page shows it (Browser Use, Sensitive, 2026). Whether a label resolves on a later page is not described in the pages reviewed.

Dimension What the vendors document What a buyer should verify
What the model receives Browser Use: placeholders for a user name and a password, with sensitive data filtered from the input text Whether every field on the page is covered, or only the fields the template names
Where the real value goes Browser Use: real values are injected into form fields after the LLM call Whether the value can reappear in later page text, a download or a screenshot
Custody 1Password and Browserbase: credentials not shared with the LLM or exposed in Browserbase logs and repos How the credential reaches the field; the release gives no technical detail
Approval 1Password and Browserbase: real-time approval prompts; Cursor: terminal commands and MCP connections need approval by default Whether approval covers the destination of an action and not only its type
Egress Firecracker: traffic from a guest is considered untrusted and should be filtered at the host level Whether the filter inspects the payload or only the destination
Scope of the control Cursor: run modes are best-effort guardrails rather than a hard security boundary What the control governs: the action, or what the model read before proposing it

How much can an injected page take from an agent that reads it?

The measurements settle the rate, not the value. The two figures above, an average of around 20 percent for data-leak injections and up to 70 percent for stealing specific PII, measure the step before the payload: whether the injected instruction wins at all. Neither was measured against an agent holding only labels, and placeholders do not change that step.

The instruction wins for the reason the record keeps repeating. Content the agent reads is content the model can treat as instruction, and the controls around it are probabilistic (Operating Inside the Lethal Trifecta). A scanner that catches most injections, a model trained to prefer system instructions, and a filter on the outbound path each lower the rate without reaching zero. A design that assumes the instruction fails is a design that fails at volume.

What the instruction collects is a separate question. A real value is worth taking because it can be spent elsewhere: Truffle Security reports that "11,908 Live Secrets were detected using TruffleHog in 400TB of web data," a measure of how much real value sits in public text (Truffle Security, 2025), and the same research counted that "2.76 Million Web Pages contained live secrets," the standing supply that makes a real value worth taking (Truffle Security, 2025). The finding does not establish that a model saw any of those pages, and the point stands anyway: a value taken from a page can be spent, and a label cannot.

Where do placeholders stop protecting the record?

Three gaps are worth naming. The first is coverage: a policy tokenizes the fields it names, while a thread also carries subject lines, free text, attachment names, dates and message bodies. The second is linkage: a label that recurs across screens is a stable identifier, so an attacker who sees SSN_001 twice learns that the records share a person without learning the number. The third is the screenshot.

Browser Use's page lists "Set use_vision=False to prevent screenshot leaks," an instruction that treats a screenshot as a channel the text placeholder does not cover (Browser Use, Sensitive, 2026). A page drawn with labels still renders pixels, and a pixel is not a token.

The detection layer has the same shape. GitHub's documentation describes push protection as "scanning code for hardcoded secrets at the time of the push," a scan with nothing to find in a commit that carries a placeholder and everything to find in one that carries the value (GitHub, 2026). Detection also arrives after the value has moved. Access tokens are password-equivalent material, as What Can an AI Agent See in Your GitHub Settings? examines for the pages an agent reads. The volume under review is recorded: 28,649,024 new credentials exposed in public GitHub commits across 2025, as How Do You Let an AI Agent Manage API Keys Without Reading Them? collects. A label in that population is not a finding, because there is nothing to revoke.

What does a governed environment change?

A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy become consistent tokens for the whole run, so the model works on labels such as NAME_001 and ACCT_001. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms the tokenization policy and approves each consequential action, and a send is one. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.

For this page's question it changes two things and leaves a third alone. The payload changes: an injected instruction that wins collects labels, the field names beside them, and whatever text the policy left in the clear, and none of that is the value. The record changes: the environment can show which screen the model saw, what it read there, and who approved the send, which is a statement the vendor pages above do not produce. What does not change is whether the instruction wins, and a design that needs it to lose is a design that will be tested at volume.

It also has a boundary. An enterprise browser governs what a person copies, pastes, uploads and downloads on a managed device; it does not describe what a model reading a permitted page receives, as Enterprise Browser or Render-Layer Tokenization? sets out. The control class described here covers the rendered page, not the terminal, the IDE, the local filesystem, direct API calls or MCP. And it is only as good as its coverage: a policy that tokenizes two fields on a page that shows five leaves three in the clear, and the record shows exactly that.

Methodology and limitations

This page rests on three research papers on injection and data leakage in browsing agents, one of them peer-reviewed at ICLR; vendor documentation from Browser Use, Cursor, Firecracker, 1Password and Browserbase, and GitHub; one vendor research post from Truffle Security; and existing RedactSure research pages. Vendor pages were read between October 20, 2026 and October 21, 2026, and each Sources line carries the date for its page. Quoted facts are cited to the page that states them, and the two attack-success figures are cited as their authors report them, not as independent measurements. The survey of browsing agents is cited for what its authors list as findings, because its abstract page reports no success rates.

RedactSure did not test any of the named products hands-on. The vendor pages describe credential custody, network policy and approvals; what a model receives after a real value is injected into a field is not described in the pages reviewed, and that limit is stated where the claim appears. Vendor features change, and the page carries its date, so a release after October 21, 2026 should be treated as unreviewed until the test below is repeated. Statements about RedactSure describe its current design, and RedactSure is deploying now with enterprise and government customers. The example describes a record type, a shared inbox in a browser mail client, and not an organization.

Determinations about whether a workflow meets a contractual, privacy or regulatory requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a test of the organization's own agent against a record type of its own, repeated after each change to the agent or to the policy.

What the record shows

The record answers the title with a qualifier. A hijacked agent on a token-only record still obeys, still sends, and still completes the action; what it cannot do is hand over a value, because the value was never in its context. The residue is real: labels that map to field names, free text the policy did not cover, timing and volume, and a stable identifier wherever the same label is reused. The measurements explain why the instruction wins often enough to plan for, and the vendor pages show the substitution point that makes the result worth little. RedactSure's environment is built on that point, and what limits it is how much of the record the policy covers. Before relying on that boundary, a team should pick one agent and one task, run it against a record whose sensitive fields are labels, and read the outbound message; that single test shows exactly what a successful injection would have taken.

Frequently asked questions

Can a hijacked agent leak anything if it only has placeholders?

Yes, though not the values. It leaks the labels themselves, the field names beside them, the free text the policy did not tokenize, and the fact and timing of the action. It can also leak a link between records when the same label appears on two screens. What it cannot hand over is the value behind NAME_001 or ACCT_001, because that value was resolved at the destination and never entered the model's context. Measure the leak by reading the outbound message and the transcript, not by trusting the policy.

What does an attacker get from a label like SSN_001?

A label is a description without the thing described. Beside a field marked Social Security number, SSN_001 tells the attacker which kind of value sits there, how many records the run touched, and, if the same label recurs, which screens belong to the same person. It does not give the number, and it cannot be spent at another service. The useful question is whether the label resolves anywhere the attacker can reach, which depends on the resolution rule rather than on the label's format.

Do placeholders stop prompt injection?

No. A placeholder changes what the agent has to hand over, not whether the injected instruction wins. The measurements above put data-leak success at around 20 percent on average and up to 70 percent for specific personal data, and a placeholder design does not lower either figure. What it lowers is the value of a successful attack. A team that reads a placeholder mechanism as an injection defense will be surprised by the first forwarded thread that reaches an outside address.

Can an agent holding only labels still cause harm?

Yes, because harm is not limited to disclosure. An injected line can tell the agent to send a message, delete a record, submit a form or change a payout account to one the attacker supplies, and none of those steps needs the agent to read a stored value. The substitution covers what the model sees; it does not cover what the model is allowed to do. Approval by a named person is the control for that half, and it has to sit outside the model.

Do screenshots get around placeholders?

They can, if the agent is allowed to take them. A page rendered with labels still draws pixels, and a vision model reads the pixels rather than the text. Browser Use's documentation lists turning vision off to prevent screenshot leaks, which treats the screenshot as a separate channel rather than a covered one. A design that tokenizes the text and leaves vision on has covered one of the two paths the record travels, and not the other.

What should a team test before trusting a placeholder design?

Run one real task against a record with the sensitive fields replaced, then read everything that leaves the page: the message, the transcript, the download and any screenshot. Check whether the policy covered every field the page shows, whether a label repeats across screens or runs, and who approved the action. A design that passes those checks has narrowed the payload; a design that has not been run has only a claim.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Leaves a Hijacked Agent Holding Labels

The controls reviewed here govern egress, approval and credential custody, yet none changes what the model reads, and all assume an injected instruction can still win.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: the agent reads the thread as written, so the model holds the name, the Social Security number and the account number, and an injected line sends the thread out with them. Inside: the thread renders as NAME_001, SSN_001 and ACCT_001, the injected line still fires, the message still leaves, and the recipient gets labels while the approver's record holds the values.

RedactSure is deploying now with enterprise and government customers. Injected page elements reached up to 70 percent for specific PII.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

What a hijacked agent can leak is limited to what the model holds when the injection fires. Bring a task that handles sensitive records and see, with test values, what a redirected message would carry. Book a demo

Book a demo

Book a demo

Having trouble? Open the booking page or email us.