Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happens When an AI Agent Sees a Credit Card Number?
The number enters the model's context when the page renders, then travels into the reply the agent drafts, the ticket note it writes and whatever transcript the vendor keeps. Ask what the model receives on that screen, who approves the refund or card action, and what record of the screen survives the run.
A support team that drafts refunds with an agent can end up holding a card number it never asked for. A customer writes in about a double charge and pastes the card number, expiry date and security code into the message. The ticket draws the message, the order panel, the customer's name and address, two internal notes and a reply box. The agent reads the page as it renders, and the sixteen digits arrive in the model's context with the rest of the thread, in a field no payment form controls.
The pattern is general to any page with free text. A checkout is built to show four digits and keep the rest. A ticket, a forwarded email, a scanned document attached to a claim and the card dashboard where finance issues a virtual card can all render the whole number. Permission decides whether the record opens. What the model receives once it is open is a different question, and so is where that copy goes afterwards.
The third question has a standard behind it, and the standard's own sentences are more precise than most summaries of it. PCI DSS sets rules for card data, including how the PAN may be stored and rendered. Whether a transcript counts as a store is a question for an assessor. Whether the model read the digits is a question a team can answer from one test. What Is the PII Wall? describes the boundary this record crosses.
Key findings
- For a card number on a support ticket to stay out of a model's context, the value would have to be replaced with a consistent token such as CARD_001 before any model reads the rendered page, with the real digits released only to the destination a named person approved (What Is Render-Layer Tokenization?).
- It would also require a named person approving each refund or card action and a record of what the screen showed the model, because an approval governs the action and leaves the values already in context where they were (What Is an AI Control Record?).
- The vendor pages reviewed describe screen access, transcripts, training defaults and card controls, and none of them states that a card number on a rendered page is replaced before the model reads it (Microsoft, Vision, 2026; OpenAI, Data controls, 2026).
- Microsoft's Copilot Vision page says that when a session ends "all shared context is cleared" and that "A transcript of your conversation with Vision is stored in your conversation history," so the screen can be dropped and the words kept (Microsoft, Vision, 2026).
- GPT-4 and ChatGPT "reveal private information in contexts that humans would not" in 39% and 57% of cases in the contextual-integrity test (Mireshghallah et al., 2024).
- The PCI SSC fact sheet turns that risk into a rule: at a minimum, PCI DSS "requires PAN to be rendered unreadable anywhere it is stored," including in logs and backups (PCI Security Standards Council, 2008).
What does an agent read when a card number sits in a support ticket?
The record here is one support ticket. The message body carries the full number, the expiry date and the security code. The order panel carries the merchant, the amount and the date, the sidebar carries the customer's name, address and two earlier tickets, and the reply box sits open below. An agent asked to prepare a refund reads all of it, because a rendered page arrives whole: the fields the task needs and the fields beside them (Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?).
A refund needs the order, the amount, the last four digits and the reason. The middle digits identify the issuer and the account, and the security code proves that whoever holds the number also holds the card. Neither is needed to match the charge. A checkout form can be designed to show four digits. A message body shows whatever a customer typed, and customers type the whole number when they believe it helps.
| What the ticket draws | What a refund needs | What the model receives |
|---|---|---|
| Message body: number, expiry, security code | The last four digits | All sixteen digits, the expiry and the code |
| Order panel: merchant, amount, date | The amount and the merchant | The same values |
| Sidebar: name, address, earlier tickets | The name for the reply | All of it, including the earlier tickets |
| Internal notes | The reason code | Every note, including ones written for staff |
| Card dashboard, when the agent opens it | The card's label | The number the dashboard shows for that card |
The last row is the one teams miss. A card number does not have to sit on a checkout page to reach a model. It sits wherever a page draws it, and the pages that draw it are the ones built to show a card rather than to take a payment.
A permission decides whether the ticket opens. It does not decide which fields the page draws, and a support queue is where the work begins.
Where does the number go after the model reads it?
The context window comes first. The page content is part of the model's input for the request, and each later turn in the run carries that input forward, so a number read on the first step can appear in a summary five steps later. The reply is the next copy: an agent drafting an answer that quotes the customer's message writes the digits onto the ticket, where a wider group can read them than the original message.
Retention is a separate question, and the vendor pages keep the two apart. OpenAI's data controls page says "Data controls let you choose whether your conversations help train OpenAI models" and that "Turning off Improve the model for everyone does not delete or hide saved chats" (OpenAI, Data controls, 2026). A training choice therefore leaves the stored conversation in place. The answer to how long is a storage period written in a contract or a help page, and the answer to what the model saw is a record of the screen.
The copy that matters is the one in the model's context, because the model can repeat it in any later sentence it writes: a summary, a note, a reply. Retention decides how long the record of the run survives. It does not decide what the model read, which is the distinction between the data an agent receives and the data the task requires (What Is Least Exposure?).
A ticket screen that draws a card number is the page a record would have to show, and none of the 86 AI security products reviewed documents that record: the 36 that document model input hold prompts, conversations or request payloads at their own gateway or pipeline (How Many AI Security Products Control What an AI Agent Sees?).
What do the vendors themselves say?
The pages reviewed describe observation, permission, training and confirmation, and each one stops short of the values on the page.
Microsoft's Copilot Vision page says "Copilot can view your screen or mobile camera feed and use Copilot Voice to answer questions and interact with you," a feature that reads whatever the shared screen holds (Microsoft, Vision, 2026). Its Edge page says Copilot draws on "when allowed by your organization's settings, content from the current webpage," so the organization's setting decides whether the page is read rather than which values it carries (Microsoft, Edge, 2026).
For managed workspaces, OpenAI's data controls page adds that "By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu, or ChatGPT for Healthcare workspaces to train its models," a training default rather than a retention limit (OpenAI, Data controls, 2026). OpenAI's Atlas page said agent mode "can use sites you're already signed in to," a reach of the session a person already holds rather than a separate identity for the agent, and that "It will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions" (OpenAI, Atlas, 2026). The same page said the agent "cannot access other apps on your computer or file system," so the browser session is the whole of its reach on the machine (OpenAI, Atlas, 2026).
| Page reviewed | What it documents | What it leaves open |
|---|---|---|
| Copilot Vision | A shared screen or camera feed; a transcript kept in conversation history | Whether the transcript holds the card number |
| Copilot in Edge at work | Page content when the organization allows it; a tenant boundary | Which fields the model reads once access is granted |
| OpenAI data controls | A training choice; saved chats that persist after training is off | The storage period for a transcript |
| ChatGPT Atlas agent mode (retired August 2026) | Signed-in sites; a pause on some sensitive sites | What the page showed the model before the pause |
The pattern holds across the four pages. Each control decides whether a page may be read, or how long the resulting text is kept, and none of them replaces a value before the model reads the screen. A finance team that asks only whether the agent is permitted to open the ticket has not asked this question.
Does a card number on a screen put the environment in PCI scope?
The PCI SSC fact sheet lists the card values a system may keep: "Only the PAN, expiration date, service code, or cardholder name may be stored" (PCI Security Standards Council, 2008). It then turns that list into a rendering rule: at a minimum, PCI DSS "requires PAN to be rendered unreadable anywhere it is stored," including in logs and backups (PCI Security Standards Council, 2008). A security code is in the group the sheet calls sensitive authentication data, which "must never be stored after authorization" even when it is encrypted (PCI Security Standards Council, 2008).
Those sentences were written for databases, and they apply to any system that keeps card data. A model's context is a store for the length of a request. A transcript is a store for as long as the vendor or the customer keeps it. A ticket note is a store for as long as the ticket exists. The sheet's own boundary explains why the read matters: "PCI DSS, however, does not apply if PANs are not stored, processed, or transmitted" (PCI Security Standards Council, 2008). An environment that keeps a transcript of a screen holding a PAN has created a store of card data. An environment that keeps the PAN off the screen has not.
The current standard keeps the same rule in different words: the PAN "must be rendered unreadable according to PCI DSS Requirement 3.5.1" (PCI Security Standards Council, 2024). Neither sentence says a browser is in scope or out of it. That call belongs to a qualified assessor, and the fact that decides it is the data flow the team can document: what the page drew, what the model received, and what was written down afterwards. Can ChatGPT Work Handle Cardholder Data Without Expanding PCI Scope? works the same question through a checkout page and reaches the same reading, that a model which reads the screen is processing the values on it.
Who approves the action the number enables?
Approval attaches to an action, and the action here is a refund, a card issuance or a payment. A named person approving the refund is the right control for the money, and it arrives after the model has read the ticket. The approval makes the action accountable. It does not return the digits the model already holds.
The reference record for one agent describes a pause rather than a named approval. The 2025 AI Agent Index entry for Gemini Enterprise records approval requirements for decision types as "None" found, while users can pause or stop an agent (AI Agent Index, 2026). A pause stops a run. It does not describe what the model read before the pause, and it does not name the person who would answer for the action.
Card controls are a different instrument. Ramp's product page says a virtual card "lets you pay online or via mobile wallet without exposing your actual card details," a limit on what a merchant sees rather than on what an agent's screen shows, and that an administrator can "Add an expiration date or issue a single-use card that automatically closes after one payment" (Ramp, 2026). Brex's help page says "Creating a dedicated card for each of your vendors is one of the easiest ways to control spending," and that "The cardholder can see the card in their Wallet" (Brex, 2026). It adds that "admins and any other users with the specific product capability" can create and apply a dedicated card, a permission on who opens the page rather than on what it renders (Brex, 2026).
Those controls bound what a stolen number can buy and who can issue a card. They do not change what a page shows the model, and the wallet is a page. A team needs the two controls on different layers: the card limits the loss, and a named approver working from a record of what the model received makes the action answerable (What Is Supervised Delegation?).
What does a governed environment change?
A governed environment acts where the page is rendered, before the model receives it. Values chosen by policy are replaced with consistent tokens for the whole run, so the ticket shows CARD_001 in the message body, in the reply the agent drafts and on any later page that would display the number. The model can still match the charge, find the order and draft the reply, because the token is stable and the labels are intact. The real digits resolve only at the destination a named person approved, at the moment of the approved action.
The control class has four parts and this page's question needs all four. Substitution before any model reads the screen keeps the number out of the context. Consistent tokens keep the work coherent across pages. A named approver makes the refund or the card action accountable. An exported record shows what the model received, what the agent did and who approved it. None of the four depends on the model behaving well, which matters because a ticket can carry an instruction as easily as it carries a card number.
The scope is the rendered page: the ticket queue, the billing console, the card dashboard, the settings page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A number a coding agent reads from a file, or receives in an environment variable, is a different control problem. The difference between a control over a data estate and a control over a rendered screen is set out in (RedactSure vs Microsoft Purview: 2026 Comparison & Alternative).
What the record shows
On this page's record, the disclosure happens when the ticket screen draws the digits, and every later control answers a different question. Copilot Vision reads the shared screen and keeps a transcript, Edge decides whether page content may be read, the data controls choose training and leave saved chats, and Atlas paused on some sensitive sites without saying what the page showed the model; each of those controls governs access or retention, not the values the page draws. The PCI sentences apply to what was written down rather than to what was read, and they reach a store of card data whether or not anyone intended a store. Name one ticket that carries a full card number, run one agent through it with a 16-digit test value, and compare what the transcript holds with what the page drew. If the test value appears in the reply or the transcript, the real number would have appeared there too.
Methodology and limitations
This page rests on PCI SSC guidance and the v4.0.1 standard, vendor help pages from Microsoft, OpenAI, Ramp and Brex, one contextual-integrity preprint and one research dataset, plus the RedactSure pages cited above. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 21, 2026 and October 22, 2026, and each Sources line carries the date for its page. The PCI fact sheet is a 2008 summary that predates v4.0.1, so it is cited for the storage rules the standard has kept and the current text is cited beside it.
No product named here was tested for this page. The products are described from their public documentation, and "not described in the pages reviewed" means the pages reviewed for this page did not state the point. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a support ticket carrying a card number, not an organization. Determinations about PCI scope, or about whether a workflow meets a card-scheme requirement, belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
What does an agent receive when a credit card number reaches it?
It receives the page that draws the number, in full. The digits enter the model's context with the message, the order panel and the customer's address, and they can appear later in a reply, a note or a transcript. Permission decides whether the ticket opens. It does not decide which fields the model reads. Replacing the number with a token before the page renders is the control that changes what the model receives.
Does the number stay in the model's transcript after the run ends?
Often, yes. A session can clear its screen context and still store the text of the exchange, and a training choice is a separate setting from a storage period. The transcript is written for the team that runs the agent, so the question is which of its systems keeps it and for how long. Ask for the retention period in writing, then read a real transcript and look for the digits.
Does a card number on a screen put the environment in PCI scope?
It can, and the decision is not the vendor's to make. The scoping test follows what a system stores, processes or transmits, so a page that draws a PAN into a model, and a transcript that keeps it, are facts an assessor will weigh. PCI DSS requires a stored PAN to be unreadable and does not apply where no PAN is stored, processed or transmitted. Keeping the number off the screen keeps those facts simple.
Who should approve a refund an agent prepares?
A named person, for the refund and for any card action in the same run. The approval should identify the action, the ticket and the person, and it should sit outside the model so that a manipulated page cannot supply it. The approval does not change what the model read before it, so pair it with a record of the screen. Test whether the prompt fires on the queue you care about.
Can a page that shows only the last four digits keep the full number out of the model?
Only if the full number is never rendered. A checkout that shows four digits does not put the other twelve in front of the model, and that is a real reduction in what the model can repeat. A support ticket, an email or a document that carries all sixteen digits is not that kind of page, and no setting on the agent changes what the page draws. Check the pages the agent opens, including the ones not built for payments.
What should a security team ask for in writing about the screen?
Ask for four things in writing: what the model receives from a rendered screen, whether a value is replaced before it reads the page, who approves the refund or card action by name, and what record shows the screen as the model saw it. Add the retention period for the transcript and the export path to the team's own monitoring. An answer the documentation does not support is unanswered until a run with a test card confirms it.
How RedactSure Keeps a Card Number Off the Ticket It Reads
An agent that reads a support ticket receives a card number the refund never needed, and the retention rules reviewed begin after that read. In a contextual-integrity test, GPT-4 and ChatGPT disclosed private information in 39% and 57% of cases.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the ticket draws sixteen digits, the model reads them and drafts a reply that quotes them. Inside: the ticket renders CARD_001 for the run, the model matches the order on the token, and the digits resolve only at the refund form a named person approves; the record shows the page and the approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A card number pasted into a ticket is the value a review asks about first. Bring one ticket from your own queue and see, with test values, what the model reads and where the real digits land. Book a demo