Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happens When an AI Agent Sees a Bank Account Number?
It is read off the page like any other value, then stays in the model's context and in whatever the session keeps. Unlike a card number it cannot be reissued, because it names the account that every payer, statement and vendor record already holds; ask what the model received and who approved the payment.
Finance teams now hand vendor onboarding and payment runs to agents, and the people who own the vendor master have rarely been asked which fields those agents read. A bank account number is one of the few values in a finance workflow that nobody rotates on a hunch. It is the address of someone's money, and it appears on the supplier registration form, the remittance advice, the bank statement and the payment screen where the funds leave. An agent that opens any of those pages has the number drawn by the browser and read into its context in the same pass, and from that pass onward the value belongs to the run: it can surface in a summary, a transcript, a tool call or an error message. Whether the agent may act is a separate question, and most tools answer it with an approval step or a pause. What the model was shown before it acted is the part those steps do not answer. The record type here is a supplier registration form with a bank account section, and the standard to hold it to sits in two places: what the vendor pages say the model receives, and what the bank rules require of the number itself.
Key findings
- For a bank account number on a vendor record to stay out of a model's context, the value would have to be replaced with a consistent token before any model reads the screen, with the real number resolving only at the approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving the payment or the record change, and a record of which screens the model read and what each showed (What Happens When a Fake Invoice Email Instructs an AI Agent to Change a Payee?).
- None of the vendor pages reviewed describes a control that replaces the values on a rendered statement, vendor record or payment screen before the model reads them; they describe the session, the retention window and a pause on sensitive sites (Microsoft, 2026).
- GPT-4 and ChatGPT "reveal private information in contexts that humans would not" in 39% and 57% of cases, which is the behavior a number on a statement meets once it has been read into a model (Mireshghallah et al., 2024).
- Swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques," the measurement behind the claim that a stand-in need not cost the agent its work (Serenari and Lee, 2025).
- The supplier registration guide for one vendor program states that "Bank account information must be included", and that an electronic payment selection means "you will be required to" add a bank account (Suntory Global Spirits, 2025).
What does the model receive when the number is on the screen?
A browser does not hand a model a database row, it hands over what the page shows. Microsoft's support page for Copilot Vision puts it plainly: "Copilot can view your screen or mobile camera feed and use Copilot Voice to answer questions and interact with you", and adds that "When the Vision session ends, Copilot immediately stops observing, and all shared context is cleared," while "A transcript of your conversation with Vision is stored in your conversation history" (Microsoft, 2026).
On a vendor record with a bank account section, the number sits inside what the model receives. Clearing at the end governs what the vendor keeps observing, not what the model read while the session ran, and the transcript outlives it. OpenAI drew the same boundary elsewhere: in logged-in mode, Atlas agent mode "can use sites you're already signed in to", and it "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions" (OpenAI, Atlas, 2026). The pause arrives after the page has been read.
A hosted browser makes the same point from the other direction: the agent observes screenshots and decides its next step from what it sees (Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?). A measured study found that GPT-4 and ChatGPT returned a private value "in contexts that humans would not" in 39% and 57% of cases, which is what a rendered account number is up against (Mireshghallah et al., 2024). The number is not a field the agent consults once and forgets.
Where does an agent read a bank account number on a vendor record?
The record type on this page is a supplier registration form with a bank account section. In one supplier program's guide, Section 4 Payment Method says that "Bank account information must be included" and that selecting that option means "you will be required to" add a bank account, and the program "uses a 3rd-party provider (Trust Pair) to validate supplier bank information" (Suntory Global Spirits, 2025).
The form is only the first surface. The number it captures is written to the vendor master, reused on every remittance, and read again when someone opens the record to check a change. In an SAP estate the bank master sits on a separate change process from the invoice, so the number can be right on the invoice and stale in the master (Can AI Work SAP Payables Without Vendor Bank Details?).
A payment screen is the third surface. IRS Direct Pay offers to "Pay taxes from your bank account with Direct Pay", lists the service as "No sign-in required", and caps a single payment at $10 million (Internal Revenue Service, 2026). No profile is inherited, so the routing and account numbers are typed into empty fields by whoever or whatever operates the browser. Three rendered surfaces carry the same number, and a statement carries it a fourth time.
What do the vendors themselves say?
The pages reviewed here describe what a session keeps, where an agent may go and how a cloud task holds a credential, and none of them describes a step on a rendered page that replaces the values before the model reads them.
Google's Gemini Apps page carries the retention numbers: "A subset of chats is reviewed by human reviewers (including Google's trained service providers) to help improve Google services", it advises "Please don't enter confidential information that you wouldn't want a reviewer to see", temporary chats "are retained with your account for 72 hours", and "Reviewed chats are retained for up to three years." (Google, 2026).
OpenAI's Atlas help page covered modes and a pause, both of which govern where the agent goes rather than what it reads: agent mode "can use sites you're already signed in to", and it "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions" (OpenAI, Atlas, 2026).
OpenAI's Codex cloud page shows custody when the value travels in a process rather than on a page: credentials "are only available to setup scripts" and are removed "before the agent phase starts", while "Environment variables are set for the full duration of the chat (including setup scripts and the agent phase)" (OpenAI, Codex Cloud, 2026). The page is marked Legacy and its scope is an environment.
| Vendor page | What it governs | What it says about the values on a screen |
|---|---|---|
| Microsoft Copilot Vision | Observation and transcript | Nothing: context clears at the end, the transcript stays |
| Google Gemini Apps | Human review and retention | Nothing about an agent page; chats are kept and reviewed |
| OpenAI Atlas agent mode (retired August 2026) | Where the agent went, when it paused | Nothing: the pause comes after the page is read |
| OpenAI Codex cloud | Which credentials a task holds | An environment variable, not a rendered field |
Why can an account number not be replaced the way a card number can?
A card number can be cancelled and reissued with a new number, which ends the value of any copy. An account number is the address of the account at the bank, and the rules that govern ACH treat a change to it as an event. Nacha's WEB Debit rule requires that "a fraudulent transaction detection system must, at a minimum, validate the account to be debited", and "The supplemental requirement applies to the first use of an account number, or changes to the account number" (Nacha, WEB Debits, 2026). The rule fixes the trigger rather than the technique.
The storage rule points the same way. Nacha requires covered parties to "protect deposit account information by rendering it unreadable when it is stored electronically", and it applies to "each Non-Consumer Originator that is not a Participating DFI, each Third-Party Service Provider, and each Third-Party Sender" above the volume thresholds, with Phase 1 and Phase 2 tied to 6 million and 2 million ACH payments a year (Nacha, Data Security, 2026). The limit is explicit: access controls alone "do not meet the new standard"; the rule addresses information "when it is stored electronically" rather than a value rendered on a screen, and financial institutions sit outside its scope.
What that leaves: the number is a key that has to stay stable, because every payer and every stored record refers to it. The useful comparison is not with a password, which can be reset, but with an identifier whose continuity is the thing being protected.
How do you keep the number usable while the model reads a token?
A stand-in breaks the work if it is inconsistent. If the vendor record shows ACCT_001 and the invoice shows ACCT_002, an agent cannot match them, and the reconciliation a finance team needs is gone. The research on consistent pseudonyms measures the cost: swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques" (Serenari and Lee, 2025).
The payments industry already runs a version of the idea. Plaid's Auth documentation describes tokenized account numbers, where "Only the numbers.ach[].account field can be set as a TAN", and states the limits: "TANs are only valid for the ACH and RTP payment rails" and "TANs may not be supported by your third-party fraud and account verification databases and vendors." (Plaid, 2026). A tokenized account number moves money, and three banks issue one today.
The same property decides what a hijacked agent gives up. An agent that holds ACCT_001 for the whole run can be tricked into pasting a token into a chat, and the paste is worthless outside the environment that issued it (What Can a Hijacked Agent Leak If It Only Has Placeholders?). What breaks the work is a mask that changes the value's identity, not the substitution (Does Masking Data on Screen Break Browser Agents?).
What that leaves: consistency for the whole run, including the pages a person never sees, and a restoring step at the destination the number is meant for.
What does a governed environment change?
A governed environment is a control class that acts where the screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the registration form, the vendor record and the payment screen all show ACCT_001. Real values resolve only at an approved destination, at the moment of an approved action. A named person confirms which fields are replaced and approves each consequential action, and a payment or a bank detail change is one. Every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
It changes the surface count. The three pages that carry the number render the same stand-in, so a number read on any of them is a token, and the real value appears once, in the payment file a person approved.
Its scope is the rendered page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP, so a number placed in an environment variable for an API payment stays with the sandbox and the credential store a team configures for it. The record then answers a question the storage rule does not: which screens the model read, what each one showed, and who released the real number. That release rests on a person, and only 6 of 15 AI agents reviewed document asking a person before completing a payment or purchase, with two of the six hedging (Do AI Agents Ask Before Making a Payment?).
What the record shows
On a rendered vendor record the control that decides what the model holds sits before the model: consistent tokens on every page of the run, a named person approving the payment or the change, and a record of what each screen showed. In this page's record, the vendor pages reviewed describe where an agent may act, and the bank rules describe how a stored account number must be protected. None describes a step that keeps the number out of the model on a rendered page. The number stays usable because a consistent token preserves the match to the invoice and the payment, which is the continuity the ACH rules depend on. Run one test on an agent your team already uses: open a test vendor record with a known account number, ask the agent to read the bank details and summarize them, then search the transcript for the digits. If they appear, the session rather than the approval is where the value escaped.
Methodology and limitations
This page rests on two research preprints, vendor documentation from Microsoft, Google and OpenAI, a supplier registration guide, Plaid's Auth documentation, two Nacha rule pages and IRS Direct Pay. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 21, 2026 and October 22, 2026, and each Sources line carries the date for its page.
The products on this page are described from documentation, and none was tested for this page; "not described" means the pages reviewed. Vendor features change and the page carries its date, so a later release is unreviewed until the test is repeated. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a supplier registration form, and not an organization.
The Microsoft Vision page is the consumer article as archived on June 25, 2026, so the quotes come from that copy. The Gemini Apps notice covers consumer accounts, and the Codex page is marked Legacy. Determinations about whether a vendor onboarding or payment flow meets a rule belong to counsel, assessors and the organization's compliance officers.
Frequently asked questions
What happens when an AI agent sees a bank account number?
It reads the digits as part of the page they sit on, and they enter the model's context for the rest of the run. What happens after that depends on the session and the transcript, because a session that clears its context at the end may still store the conversation in a history. The number becomes a value the model has already reasoned over, which no later policy can undo on that run.
Does the number stay in the model's context after the session ends?
Only for as long as the transcript and the vendor's retention rules keep it. Google's Gemini Apps page says temporary chats are "retained with your account for 72 hours", that activity "is auto-deleted after 18 months", and that "Reviewed chats are retained for up to three years." (Google, 2026). A number in a chat that a reviewer opens is therefore a number someone can read long after the payment cleared.
Who approves a payment that uses an account number the agent read?
A person has to, and the record should name which person. OpenAI's Atlas page documented a pause "to ensure you're watching it take actions on specific sensitive sites such as financial institutions", which is a confirmation on the action and not an approval of the reading (OpenAI, Atlas, 2026). The page named no approver for a vendor payment or a bank detail change.
What record shows which screens the agent read?
Usually a conversation transcript, which is a record of the chat rather than of the screen. A transcript can show that a summary quoted an account number; it does not show the field the model read or the page it sat on, which is the gap an exported screen record closes. A number in a transcript is a number the next reader can use.
Can the agent still use the account number if it reads only ACCT_001?
Yes, when the stand-in is consistent for the whole run. Serenari and Lee found that swapping identifiers for consistent pseudonyms and restoring them afterward "reduces semantic utility errors by a factor of 5 compared to baseline techniques" (Serenari and Lee, 2025). The token preserves the match between the vendor record, the invoice and the payment, so reconciliation survives, where a different stand-in on each page would break it. A restoring step at the destination is what keeps the real number out of the model.
Is a bank account number as sensitive as a card number?
For an agent reading a screen, yes, and the exposure lasts longer. A card number can be cancelled and reissued, which ends the value of a copy; an account number is the address of the account at the bank, and Nacha applies its validation requirement to "the first use of an account number, or changes to the account number" (Nacha, WEB Debits, 2026). Replacing one is a change every payer has to follow.
How RedactSure Keeps a Bank Account Number Off the Screen
An agent asked to read a vendor record gets the account number with the page, while the approvals reviewed above govern the action, not the reading. A card can be reissued; an account number cannot, and Nacha makes every later change a project (Nacha, WEB Debits, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent reads the registration form, the vendor record and the payment screen as they render, so the number enters its context. Inside the governed environment those pages render ACCT_001, the real number resolves only into the payment file, and a named person approves the payment or the change.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A bank account number that reaches a transcript outlives the run that read it. Bring one vendor record from your own workflow and see, with test values, what the model reads and who approves the release. Book a demo