Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Can Copilot Actions in Edge See on a Web Page?
Everything the page renders, because Copilot Actions works on the page as drawn and Microsoft's support page says it captures screenshots of the webpage it is using. Ask what the model receives from a permitted screen and which values, if any, are replaced before it reads them.
A payroll administrator asks Copilot in Edge to check one overtime line on a Workday payroll summary, and the agent opens the page in a window where the payroll system is already signed in. That line sits in a table that also carries the worker's name, pay rate, salary amount, direct deposit account and identification number, and the question that survives the run is which of those values the model received. Microsoft's answer is broad. The feature works on the page as a person sees it, and the support page says Copilot captures screenshots of the webpage it is using, so the view is the rendered screen rather than the one field the task named. The credential limits that get quoted in a review, autofill data, saved passwords and wallet information, govern what the agent can pull from the browser's stores, and they leave the page in front of it. The stakes are the values a payroll page renders by design, in a session that is already signed in, and the same shape appears on a benefits page, a claims screen and a bank account page. One payroll summary and one agent run answer the narrower question: what reached the model, and what would have to change for the page's values not to.
Key findings
- For Copilot Actions in Edge to keep a payroll page out of the model's view, the identifying values on that page would have to be replaced with consistent tokens before the model reads it, so the agent works on EMP_014 and never holds the worker's identifying values (What Is Render-Layer Tokenization?).
- It would also require a named person approving each submission the agent proposes and an exported record of what the model received on each screen, because the rendered page is what the model carries for the rest of the run (What Is Supervised Delegation?).
- Microsoft's pages describe where the actions run, which stored credentials the agent cannot reach and which uses to avoid; they do not describe values replaced on the rendered page before the model reads it (Microsoft, Browse, 2026).
- Microsoft's support page says Copilot "captures screenshots of the webpage it's using," on a page that also states "All actions run locally in your browser" (Microsoft, Browse, 2026).
- The same page defines the feature as one that lets Copilot "perform actions directly in your Microsoft Edge browser, such as clicking, typing, and navigating tabs" (Microsoft, Browse, 2026).
- A visual redaction model tested on rendered web pages reported "more than doubling text-extraction baseline accuracy (0.753 vs 0.357 mAP@50)," a measure of how much of a screen can be read from its pixels (Zhao, 2026).
What does Copilot Actions read on a page it is working on?
Take the payroll summary as the record. It opens in the tab the administrator is already using, signed in through her session, and it renders as a payroll page renders: the worker's name, employee ID and pay period in the header, a table of rate, regular and overtime hours and salary amount, and a panel with the deposit account and identification number on file. The task names one overtime row; the page carries every value beside it.
Microsoft's page for Edge at work describes the input as the prompt, the conversation history and, "when allowed by your organization's settings, content from the current webpage." The switch governs whether page content is used, not which values are.
The support page adds the image. Copilot captures screenshots of the webpage it is using, so the model's copy is the viewport rather than a parsed field list: the totals row, the account panel and the identification field sit in the picture beside the row the agent was asked about.
A page that renders a customer record is the surface a browser agent copies from when it reads a prompt out of the page (Can a Browser Agent Copy Customer Data From a Web App Into a Prompt?). A payroll page is that surface, and a rule about what a person would type into a chat box does not reach it.
Which values does the credential boundary leave on the screen?
The limit Microsoft states is narrower than the review it usually supports. Copilot "cannot access autofill data, saved passwords, or wallet information," which closes the browser's stores; a card on file that the site itself renders sits outside it, because the page draws the number.
The session is the other half. The same page says "Copilot can access cookies," so "if you're already signed into a site that Copilot has access to, it will also be signed in automatically," and a signed-in payroll page renders with the values in it. The agent never holds the administrator's password and still reads her account.
Microsoft's own do-not-use list names "Personal identifiers (Social Security numbers, government IDs, medical records)" and "Financial activity (banking, stock trading, credit card details)," a rule for the person choosing the task rather than a filter on the page.
New York's regulator asks covered entities to consider "authentication factors that can withstand AI-manipulated deepfakes," a control on proving who is present, and a session the agent inherited presents no factor at all (New York State Department of Financial Services, 2024).
A browser control that stops a paste at the destination, as Purview's browser data loss prevention does, leaves the page that renders the value untouched (Why Does Microsoft Purview Block a Paste Into the Browser, and What Keeps the Work Moving?).
What do the vendors themselves say?
The three Microsoft statements quoted above fit together: actions run locally in Edge, a response can draw on page content when the organization allows it, and the feature captures screenshots of the webpage it is using. None of the three says which values on a permitted page the model is shown.
The Edge at work page adds that "you may see a consent dialog asking whether Copilot can access page content," and that an admin "might have explicitly enabled or disabled Copilot's access to page content" (Microsoft, Edge at work, 2026).
Microsoft's Copilot Studio governance page says data policies control an agent's "knowledge sources, actions, connectors and skills," with "admins have full visibility into maker audit logs in Purview," a set of controls for the agents an organization builds (Microsoft, Security and governance, 2026). The same governance question for an agent built in Copilot Studio has its own record of what the agent can reach (What Can Microsoft Copilot Studio Agents See?).
A per-field policy on which values the model may be shown is not described in the pages reviewed. What is described is a boundary around the browser's stores and a consent decision about page content.
| Dimension | Microsoft Edge Copilot Actions, per its documentation | What a buyer should verify |
|---|---|---|
| What the agent does on a page | Clicks, types and navigates tabs in Edge; "All actions run locally in your browser" (Microsoft, Browse, 2026) | Which values on a permitted page reach the model |
| What the model receives | Page content when the organization allows it; a screenshot of the webpage it is using (Microsoft, Browse, 2026) | Whether the panels beside the task render into the same view |
| Stored credentials | Cannot reach "autofill data, saved passwords, or wallet information" (Microsoft, Browse, 2026) | What the site itself renders once the session is signed in |
| Sessions | Can access cookies and signs in where the user is signed in (Microsoft, Browse, 2026) | Which work accounts are open in the window the agent uses |
| Uses to avoid | Banking, card details, Social Security numbers, medical records (Microsoft, Browse, 2026) | Whether any page the agent will open shows those values |
| Consent and admin | Consent dialog conditional; an admin may enable or disable page access (Microsoft, Edge at work, 2026) | Whether the setting decides which values or only whether |
| Record | Screenshots kept with the conversation (Microsoft, Browse, 2026) | What the employer can export for one run, screen by screen |
What does the stored record keep after the page closes?
The screenshots are the part of the run that outlives it. Microsoft saves them with the conversation, so the payroll summary the agent read is still there after the tab has closed, with the salary amount, the deposit account and the identification number where they were.
Reddy and Gujral document CVE-2025-32711 in Microsoft 365 Copilot, where the client "automatically fetches the external image URL included by the attacker," a zero-click path from a fetched image to data the context held (Reddy and Gujral, 2025).
The information-flow analysis puts the mechanism this way: "poisoned data retrieved from one component can change the model's behavior and compromise the entire system, including coercing the model to spread confidential data to untrusted components" (Siddiqui et al., 2025). The Hacker News reported the flaw at CVSS 9.3 and described the target as "the MOST sensitive data from the current LLM context" (The Hacker News, 2025).
Columbia's Data, Agents, and Processes Lab puts the limit plainly: "trustworthy agent automation cannot be solved at a single layer of the stack" (DAPLab, 2026).
A page that carries untrusted text gives an attacker the three conditions in the lethal trifecta, access to private data, exposure to untrusted content and a way to communicate out (Is It Safe to Let AI Agents Read External Web Pages?).
What does a governed environment change?
A governed environment acts where the screen is drawn, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on EMP_014 and ACCT_002 and the page still functions: the overtime row can be checked, the total confirmed and the form submitted. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. The real values resolve only at the approved destination, at the moment of an approved action.
The other two parts are about accountability: a named person approves each consequential action, and a payroll submission is one. Every screen the model read, every action and every approval with a name goes into a record the employer can export to its own monitoring.
For this page's record the change is simple. Before, the agent's screenshot carries the salary amount, the deposit account and the identification number into a conversation that outlives the task. Inside, the same summary renders with tokens where those values sat, and the account number appears only at the destination the payroll manager approved.
Its scope is the rendered page. A value the agent reads from a file, a terminal, an API response or an MCP tool is outside this control. The comparison for this vendor sets the render-layer design beside the browser feature's own controls (RedactSure vs Microsoft Edge Copilot Mode).
What the record shows
Visibility is decided on the rendered page, and the payroll summary shows how. The model receives the screen as it is drawn, the overtime row and the salary amount, the deposit account and the identification number beside it, and Microsoft's pages document where the actions run and which stores the agent cannot reach, not which values the screen may show. The conclusion follows: a control that stops at the credential boundary leaves the page in view, and a page in view stays in the model's context for the rest of the run. A payroll lead should test this on one payroll page: open the summary, ask for one line, then compare what the page rendered with what the transcript and the screenshots contain, field by field. The fields in both lists are the exposure.
Methodology and limitations
This page rests on Microsoft's support documentation for Browse with Copilot and for Copilot in Edge at work, a Microsoft governance page for Copilot Studio, three research preprints, a state regulator's industry letter, a university lab page, one press report and existing RedactSure research pages. Vendor pages were read between October 16, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where a product applies its control, and the record here is specific about where Microsoft's control stops.
None of the products on this page was tested for this page, and the statements about them come from documentation; not described means the pages reviewed. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The payroll summary describes a record type, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Copilot Actions in Edge see more than the field I ask about?
More than the field, and the page decides how much. The agent works on the rendered summary rather than on a parsed value, and Microsoft's support page says the feature captures screenshots of the webpage it is using. A screenshot includes the panels and totals beside the row the task named. List what the page shows and compare it with what the task needed, because the difference is what the model could read. A task that names one field opens a page with others on it.
Does it read the page as text or as an image?
Both are documented, and the image is the one that sets the floor. Microsoft's Edge at work page says a response can draw on page content when the organization allows it, and the support page says the feature captures screenshots of the webpage it is using. Text extraction can be filtered field by field; an image is the viewport. Where the two differ, the image is the safer assumption about what the model received.
Do the saved-password limits keep page values out of the model?
No. Microsoft's limit covers the browser's stores, autofill data, saved passwords and wallet information, and a value the site itself renders is not in a store. The payroll page draws the deposit account because that is what the page is for. The limit is worth keeping and should not be counted as a control on what a permitted page shows.
What record of the run can an employer review?
The conversation history, which keeps the screenshots with the conversation they belong to. That is a record of what the agent saw and did, held in the vendor's product and visible to the user. Microsoft's pages reviewed here do not describe an export for the employer's own monitoring that names an approver and accounts for each screen. A team that needs that artifact should ask which record the vendor will hand over, and who is allowed to read it, before the first run.
Who approves an action Copilot proposes?
The user watching the run, which Microsoft frames as visibility and control: the actions run locally in the browser, so the person can see the work and take over. A consent dialog can appear before page access, and an admin can disable that access. None of it is a named approver outside the model for each payment or submission, and the pages reviewed do not describe one.
Does the consent dialog decide which values the model receives?
No. The dialog asks whether Copilot can access page content, and the admin setting behind it enables or disables that access. A yes is answered for the page, not for the fields on it, so a permitted payroll summary arrives with the account panel included. Deciding which values the model may see takes a policy on the rendered page, applied before the model reads it.
How RedactSure Keeps a Payroll Summary Out of the Model's View
The controls reviewed here keep the agent out of the browser's stores and leave every value the page renders in its view. Microsoft's page says Copilot captures screenshots of the webpage it is using, so those values become the model's context.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the summary renders in the signed-in window and the screenshots carry the salary amount and the account number into the conversation. Inside, the page is drawn with ACCT_002, and the account resolves only at the approved destination, when the payroll manager approves the file.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A payroll summary renders once and the model carries its values for the rest of the run. Bring one page from your workflow and see, with test values, what the model reads, who approves the action and what the record holds. Book a demo