Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Can an AI Agent See in HubSpot?
A HubSpot contact record renders the name, email, phone numbers, job title and lifecycle stage, plus the deals with their amounts, the tickets with the customer's own words and the inbox threads linked to it. Check which role the agent holds, what each screen shows it, and who approves a record change or an outbound email.
A sales team that lets an agent work in its customer relationship management system hands it a directory of the company's customers, read one rendered page at a time. A browser agent receives each page as text, an image or both, and the fields arrive in the model's context whether the task needs them or not (What Does an AI Agent See in a Screenshot?).
A role, a seat or a Super Admin switch decides which pages open. None of those decides what a page shows once it opens, and HubSpot's own settings govern what the vendor's AI features may use rather than what a browser agent signed into the portal reads on the screen.
That distinction between access and content decides the answer to the question, because a contact record holds a customer's identity, the history of the relationship and the price that was agreed, in a single place, while the agent is usually asked only to move a stage or draft a reply. The gap between the two is the exposure a review has to measure, and it is counted in fields rather than in pages.
Key findings
- For an agent to work a HubSpot contact record without holding the customer's identifiers, the values on the rendered page would have to be replaced with consistent tokens before any model reads it, so the email arrives as EMAIL_001 and the phone as PHONE_014 (What Is Render-Layer Tokenization?).
- It would also require a named person approving each record change, email send and deal move, and a record of the screens read and the approver (What Is an AI Control Record?).
- HubSpot's knowledge base describes switches that decide what its own AI tools may use, and no page reviewed describes a control that removes the values a portal screen renders before a model reads them (HubSpot, Understand Agent Hub, 2026).
- A Super Admin must turn on the CRM data switch before assistants and agents in Breeze studio can use CRM records, and the page warns that "Additional permissions may be required depending on the goal of the assistant or agent" (HubSpot, Breeze studio, 2026).
- Training is opt-out: "Super Admins can opt out of AI model training at any time", so a portal that has never visited that setting has left the default in place (HubSpot, model training, 2026).
- The MIT AI Agent Index recorded that "The default is that approval is required", that users can switch it off, and that triggered agents run without it (AI Agent Index, 2026).
What does an agent read on a HubSpot contact record?
The record is drawn in panels, and each panel is page text to a model. The left column carries the identity: name, email address, two phone numbers, job title, company, owner and lifecycle stage. The activity panel carries the history: emails logged with their bodies, call notes and form submissions. The association panels carry the deals, the tickets and the company the contact belongs to. Custom properties sit wherever the portal placed them, including a date of birth or a billing account number. None of the 86 AI security and data protection products reviewed describes reversible tokenization of what an agent reads on a screen, so the contact values and deal amounts render as text the model receives (How Many AI Security Products Control What an AI Agent Sees?).
What the model receives is the whole of it. A screenshot or page text does not flag relevance, so the deal amount reads beside the email address and the thread beside the phone number (What Is Least Exposure?).
That is a record of a person rather than a row in a table. OWASP notes that "Personal identifiable information (PII) may be disclosed during interactions with the LLM", which describes a contact page as much as a chat window (OWASP, LLM02, 2025).
A role does not filter any of this. An agent with read access to contacts reads the full profile, and one with edit access reads it before it changes a field. An agent that calls the CRM's API from a script reads a response body outside a browser control, so a review should name that route separately.
What does the CRM hand an agent beyond the contact?
The contact is the entry point, not the extent. A deal page draws the amount, the line items, the discount and the stage history. A ticket page draws the subject, the body the customer wrote, the attachments and the internal notes a support team added. A connected inbox draws the thread, the signature block and the phone numbers people type into email. A list draws the records that matched a filter.
A browser agent asked to prepare a renewal reads all of that to answer a question about one account. The field that decides whether the work is safe is the free text, not the price on the deal. A ticket body, a note and an email thread are text an outsider wrote, and that is the channel Greshake et al. describe in attacks that "enable adversaries to remotely (without a direct interface) exploit LLM-integrated applications" (Greshake et al., 2023).
The measured failures land on the page. An attack that hid page elements from a generalist web agent reached "up to 70% ASR in stealing specific PII", a failure of a rendered page rather than of a database (Liao et al., 2025).
The page an agent is permitted to open still renders as text (Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?).
What do the vendors themselves say?
The Agent Hub overview says administrators "configure what data is shared" in AI settings and defers the detail of data use to the AI Trust FAQs, which answers a question about the vendor's own AI features and says nothing about what a page shows a browser agent (HubSpot, Understand Agent Hub, 2026).
The Breeze studio page is more specific: a Super Admin must turn on CRM data before assistants and agents can use it, and "Additional permissions may be required depending on the goal of the assistant or agent" (HubSpot, Breeze studio, 2026). Both sentences describe a gate in front of the vendor's own agents.
The Sensitive Data page withholds "custom property values for Sensitive Data properties" from AI tools and does not describe standard contact, deal or ticket properties as withheld (HubSpot, Sensitive Data, 2026). The protection is a designation list an administrator maintains, and the identifying fields on a contact page are not on that list unless an administrator put them there.
Training runs the other way: "Super Admins can opt out of AI model training at any time", which places the decision with the administrator, not the page (HubSpot, model training, 2026).
Resolve247 records that "HubSpot moved Breeze Agents into Agent Hub on 23 July 2026", so settings and defaults read before that date describe a different arrangement (Resolve247, 2026).
| Dimension | HubSpot, per its documentation | What a buyer should verify |
|---|---|---|
| Data use in AI settings | Administrators "configure what data is shared"; the detail of data use is deferred to the AI Trust FAQs | What the FAQs say about retention, and whether the setting reaches an agent |
| Access to CRM data | A Super Admin turns on CRM data; additional permissions may be required depending on the agent's goal | Which agents are on, and what each one's goal permits |
| Withheld fields | Custom property values for Sensitive Data properties are withheld from AI | The portal's Sensitive Data list, and which standard fields hold regulated values |
| Model training | Super Admins can opt out at any time; the default is opted in | Whether the portal opted out, and when |
Who approves an agent's change in HubSpot?
An approval is the step where a person sees what the agent proposes before it lands. HubSpot requires permissions before an agent may use CRM data, which decides which pages open. The Index adds that users can switch approval off and that automatically triggered agents run without it, which is how a record change or an email send leaves without a person reading the content (AI Agent Index, 2026).
The actions that need a named approver on a contact record are the ones that change what a customer is worth or what a customer receives: a deal amount, a discount, a bulk email send or a credit. OWASP describes excessive agency as "the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM", which frames the approval question around the action rather than the field (OWASP, LLM06, 2025).
An approval that names the action, the record and the person is checkable. A prompt that says the agent wants to update a contact is not, because it hides the values the reviewer needs to judge.
Hiding a value from the model while it types is half of that. The page after the save is where a typed value can return as text or in a screenshot (Can a Browser Agent Fill In a Form Without Seeing the Values?).
What should a security team ask for in writing?
The answer should name the role and the screen. Ask which seat or role the agent holds, which objects it can open, whether it can read tickets, notes and inbox threads, and what the model receives from a rendered page on each screen it opens. Ask who approves a deal change, a merge, a bulk send or a credit, and ask what record shows the screens read and the approver's name. An answer that names a data switch has answered what the vendor's own AI may use and left the browser agent out of the answer (Does HubSpot Breeze Expose Customer Information?).
The regulatory stake is not abstract. The SEC's amendments to Regulation S-P require covered firms to keep an incident response program for unauthorized access to customer information and generally to notify affected individuals within 30 days (SEC, 2024). A CRM is where that customer information sits, and an agent reading it is a route to it.
Two questions sort a vendor. Ask what the model receives from a rendered screen, in a sentence that says whether values are replaced before the model reads the page, and ask what happens to a value the agent typed into a field after the save. A vendor that describes only where the agent may go has described the door, not the room.
What does a governed environment change?
A governed environment acts on the page before a model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the contact's email renders as EMAIL_001, the phone as PHONE_014 and a billing account number as ACCT_014, and the agent works through those tokens. The task stays doable because the fields it needs stay legible: the lifecycle stage, the deal stage, the ticket status and the customer's message are still there, while the identifiers inside that text are replaced.
Real values resolve only at an approved destination, at the moment of an approved action. A named person approves each record change, email send and deal move, and every screen, action and approval is written to a record that exports to the organization's monitoring. The record shows the pages read, the tokens and the approver.
Its scope is the rendered page. A direct API call, an import or an agent working through the CRM's own connectors sits outside it, and a review should describe those routes separately. Masking the values does not break the task when the same token follows a value across pages, which is what the utility research on this control class found (Does Masking Data on Screen Break Browser Agents?).
What the record shows
What a CRM hands an agent is decided at the render layer: when policy replaces the values on each screen with consistent tokens before the model reads it, the agent works the contact through EMAIL_001, PHONE_014 and ACCT_014, and real values resolve only at a destination a named person approved. On this record, permissions decide which pages open, and each page renders the full person: identity, the deals with amounts, the tickets with the customer's words and the connected threads. HubSpot's switches decide what its own AI features may use. A revenue operations lead should run one check: give a test agent a record to update, capture every screen it reads, and compare those fields with the fields the update used. The difference is the exposure the review has to name.
Methodology and limitations
The page rests on four HubSpot knowledge base pages, the MIT AI Agent Index, two OWASP entries, the SEC's Regulation S-P release, an industry account of the Agent Hub migration and two papers. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page.
No product on this page was tested for it, and "not described" means the pages reviewed. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a contact record in a CRM, and not an organization. A pilot of one workflow on the organization's own screens is still the test, and whether a particular portal's switches, designations and training election meet a contractual or regulatory requirement belongs to counsel, assessors and the organization's own compliance officers.
Frequently asked questions
What can an AI agent see in HubSpot?
Everything the role it holds can open, drawn one page at a time: the contact's name, email, phone numbers, job title and lifecycle stage, the deals with their amounts and stages, the tickets with the customer's own words, and the inbox threads linked to the record. Custom properties appear wherever the portal placed them, including the ones the portal never designated. The role decides which pages open, and the page decides which fields arrive. A wider role adds pages, not filters.
Does a role limit what an agent reads on a page?
No. A role, a seat or a permission set decides which pages an agent can open, and HubSpot documents that layer in detail. Once a contact page opens, the page draws the full profile, and the agent reads the email address and the phone numbers along with the stage it was asked to change. A narrower role removes pages from the run; it does not filter the fields on the pages that remain.
Do HubSpot's data switches change what a browser agent reads?
Not from the pages reviewed. The CRM data switch, the Sensitive Data property list and the training setting decide what HubSpot's own assistants and agents may use, and the pages describe administrators configuring what data is shared with those features. A browser agent signed into the portal reads a rendered page, and that rendered page is not filtered by any of those settings.
Who should approve an agent's email send or deal update?
A named person with authority over the account, before the action lands. A deal amount, a discount, a merge, a bulk send or a credit changes what a customer is worth or what they receive, so the approval has to show the old value beside the new one. An approval that says only that an agent wants to update a record asks the reviewer to trust a summary that the agent wrote about itself.
What record should a HubSpot agent run leave?
One that shows the pages the agent read, the values that arrived as tokens, the action it took and the person who approved it. A CRM change log is not that record, because it shows the field that changed and not the screen the model read before changing it. The record should export to the organization's own monitoring, so a reviewer can compare the run with the original ticket months later.
Can an agent read a connected inbox through HubSpot?
Where the portal has connected the mailbox and the agent's role reaches conversations, yes. A connected thread carries whatever the customer and the team wrote, including addresses, phone numbers and account details people type into email, and it sits linked to the contact record beside it. A thread is page text like any other field, and it is the field outsiders write. Reading it is how a reply gets written, which is why the review starts there.
How RedactSure Keeps the Contact Record Out of the Agent's Context
A CRM page draws a customer's identity, the price that was agreed and the words they wrote, and permissions decide only whether an agent may open it. HubSpot withholds custom property values only, which leaves the standard identifying fields readable (HubSpot, Sensitive Data, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, an agent updating one field read the whole record, so the email address, the account number and the deal amount entered its context. Inside the governed environment the record renders as EMAIL_001, ACCT_014 and DEAL_014, and real values resolve only at the destination a named person approved.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A contact page an agent read for one field stays in its context for the rest of the run. Bring one CRM task and see, with test values, what the model reads and where the real value lands. Book a demo