Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happens When an AI Agent Sees a Social Security Number?
The Social Security number is disclosed the moment a rendered screen shows it to the model, and it then lives in the context window, the transcript and whatever the vendor retains. Ask what the model receives, how long the vendor keeps the text, and who approves the submission.
A supplier registration form asks a finance clerk to choose Individual, type a nine-digit identification number and attach a bank account. The clerk needs the registration finished; the model needs enough of the page to finish it. Those are different amounts of information, and a browser agent receives the larger one, because a rendered page arrives as a whole. A number that identifies a person for tax purposes does not become less sensitive when it appears in a supplier portal rather than a payroll system, and the page around it rarely marks which fields the task required. Every agent that opens an employee, student or supplier record raises the same issue: once the agent is permitted to open the record, what matters is what the model receives from it. The worked case is a tax-identification field on a supplier or payroll page, and the value is a Social Security number. The trail runs from the screen into the context window, into the transcript and into the vendor's retention, and a governed environment is what changes that trail. What Is the PII Wall? describes the boundary that number crosses.
Key findings
- For a Social Security number to stay out of a model's context on a supplier or payroll screen, the value would have to be replaced with a consistent token such as SSN_001 before any model reads the rendered page, with the real number released only to a destination a named person approved (What Is Render-Layer Tokenization?).
- It would also require a named person approving each submission or record change and a record of what each screen showed the model, because an approval governs the action and not the values already in context (What Is an AI Control Record?).
- The vendor pages reviewed describe screen access, retention and training defaults, and none of them states how a Social Security number is replaced or masked before a model reads a rendered record (Microsoft, Copilot Vision, 2026; OpenAI, Data controls, 2026).
- Microsoft's Copilot Vision page says that "Copilot can view your screen or mobile camera feed and use Copilot Voice to answer questions and interact with you," a screen-sharing feature that reads whatever the shared screen displays (Microsoft, Copilot Vision, 2026).
- The same page says "When the Vision session ends, Copilot immediately stops observing, and all shared context is cleared," while "A transcript of your conversation with Vision is stored in your conversation history," so the cleared screen and the kept words are two different records (Microsoft, Copilot Vision, 2026).
- AgentDAM found that web agents "are prone to inadvertent use of unnecessary sensitive information," the failure that puts an SSN in front of a model even when the task never asks for it (Zharmagambetov et al., 2025).
What does an agent receive when an SSN is rendered on a screen?
A browser agent receives the page as the browser draws it: the text, the field values, the labels and the layout. A computer-use agent receives a screenshot and decides the next action from what the image shows (Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?). Neither route filters a field because the task does not mention it.
The supplier form is the worked record here. Its tax section asks an individual supplier for a government-issued identification number, and the field holds the nine digits of a Social Security number. The same page draws the legal name, the address and the payment section. An agent asked to complete the registration reads all of it, and the instruction to complete the tax section does not narrow what arrives.
Gusto's help page names "Social Security Number (SSN)" among the details "Your employer must update these details for you," and it does not state how the number is displayed to an administrator (Gusto, 2026). The page documents who may edit the field, not what an administrator's screen draws or what a model signed in with that account receives.
That distinction is the first finding. Permission decides whether the page opens; rendering decides what the model reads. A task can require a match on the last four digits and the page can still show all nine. The model receives the page, not the task's subset.
| What the agent is given | What it receives | What the task needs |
|---|---|---|
| Rendered supplier form | Every field and label on the page | The tax classification and enough detail to match the supplier |
| Payroll profile | The SSN field when the page draws it | The employee match, not the number |
| API response | Only the fields the endpoint returns | Depends on the endpoint |
A control that governs the page has to act before the draw. A permission that stops the page from opening keeps the number out of the model by keeping the whole record away; a control that lets the work proceed has to change what the page shows.
Where does the number go after the agent reads the screen?
Into the context window first. The model's input for the request includes the page content, and each later turn in the run carries that context forward. A run that reads the supplier form on the first step can repeat the number in a summary five steps later, because the number is part of what the model has already seen.
Then into the transcript and the tools around it. A transcript records the conversation, and any note, ticket, email or file the agent writes can carry a value it read. EchoLeak showed a production assistant's client "automatically fetches the external image URL included by the attacker," a path by which text already in the model's context can leave the run (Reddy and Gujral, 2025). The page supplies the address and the client makes the request, so an injected instruction can turn a value the model already holds into an outbound request.
Then into whatever the vendor retains. The rules differ by product and by plan. Copilot Vision says "No images are retained, transcribed, or logged" while "A transcript of your conversation with Vision is stored in your conversation history," so the frames can be discarded and the words kept (Microsoft, Copilot Vision, 2026). A session rule and a storage period answer different questions, and a team that checks only the first has not answered the second.
The number can also travel into the record the agent writes. A supplier record, a payroll note or an onboarding ticket is a durable copy, and the page that displays it may be readable by more people than the screen the agent started on. Replacing the value before the model reads it keeps the copy out of the model's writing, because the model writes the token rather than the digits (How to Protect Data Before ChatGPT, Claude or Gemini Sees It).
What do the vendors themselves say?
The vendor pages reviewed cover permission, retention and confirmation. None of them states how a Social Security number is replaced on a rendered page, and each documents a different part of the path.
Microsoft's Edge page says Copilot draws on "when allowed by your organization's settings, content from the current webpage," a permission for page access rather than a filter on the fields the model reads (Microsoft, Edge at work, 2026). It adds that "you may see a consent dialog asking whether Copilot can access page content," and that an administrator may already have enabled or disabled that access (Microsoft, Edge at work, 2026). The control decides whether the page is read, not which values it carries.
OpenAI's data controls page says "Data controls let you choose whether your conversations help train OpenAI models," a training choice rather than a retention limit (OpenAI, Data controls, 2026). It adds that "When Improve the model for everyone is off, your new conversations won't be used to train OpenAI models," while "Turning off Improve the model for everyone does not delete or hide saved chats," so the text can remain (OpenAI, Data controls, 2026).
OpenAI's Atlas page said agent mode "can use sites you're already signed in to," and that "It will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions," a confirmation on some sites rather than a replacement of the values on the page (OpenAI, Atlas, 2026).
Suntory's supplier questionnaire asks a supplier with a government-issued identification number, "such as a US social security number or Canada SIN," to select Individual, and it states that "Bank account information must be included," so the tax identity is typed into a field the page renders (Suntory Global Spirits, 2025).
| Page reviewed | What it documents | What a buyer should verify |
|---|---|---|
| Copilot in Edge at work | Page access when organization settings allow; a conditional consent dialog | What the model receives after access is granted |
| OpenAI data controls | A training choice; saved chats persist after training is turned off | The storage period and the export path for a transcript |
| Atlas agent mode | Signed-in sites; a pause on some sensitive sites | Whether the pause changes what the page renders |
| Suntory supplier form | An individual tax identity; a bank account required | What the page draws beside the tax field |
The pattern is consistent across the pages. Each control decides whether the page may be read, or how long the resulting text is kept, and none of them decides which values the page draws.
How long can the number stay in a transcript or a record?
There is no single period. A vendor's session may clear in minutes while its transcript sits in a chat history for as long as the account exists. Copilot Vision says shared context is cleared at the end of the session while the transcript is stored in conversation history (Microsoft, Copilot Vision, 2026). The session and the transcript are different stores, and each has its own clock.
A payroll or supplier record has its own retention. Tulane's registrar guide says "In the SSN/SIN/TIN field enter or update the social security number," a student-records screen that draws the number for whoever holds the role (Tulane University, 2025). The record is designed to keep the number, which is the point of the field.
The Social Security Administration's consumer pamphlet gives the question to ask: "You should ask why your number is needed, how it'll be used, and what will happen if you refuse" (Social Security Administration, 2026). Applied to an agent, the ask is why the model needs the number for the task, how the vendor uses the text, and what happens if the field is replaced with a token. The pamphlet is consumer guidance, not a rule that binds an employer or a vendor, so the answer comes from the contract and the test.
When a number is exposed, the same pamphlet points to "Identity Theft.gov guides you through each step of the recovery process" (Social Security Administration, 2026). Recovery is the last resort. The reason to care about retention is that a Social Security number is durable: it does not change after a breach, and a copy in a transcript keeps its value for every later attempt to use it.
Who approves an agent's access to a Social Security number?
Approval usually attaches to an action, not to a value. A named person can approve the supplier submission, the payroll change or the record update while the model has already read the page that carried the number. The approval makes the action accountable; it does not unsee the field. An approval step and a render-layer control are different controls, and a team needs to know which one it has.
Atlas documented the confirmation shape. Its page said agent mode "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions" (OpenAI, Atlas, 2026). The pause is a point of human attention on some sites. It is not a statement that the model did not read the page before the pause, and the page does not describe a named approver or a record of what the model received. A supplier form may not trigger the pause at all.
A governed approval names the person, the action and the evidence. The person is named before the run, not inferred from an account. The action is the submission or the record change, not the whole session. The evidence is a record of the page the model was shown and the approval that followed, which lets a reviewer reconstruct the decision (What Is Supervised Delegation?). Without that last part, the approver is confirming an outcome they cannot reconstruct, and the model's copy of the number remains outside the approval. For a reviewer who wants the screen itself, none of the 86 AI security products reviewed describes recording the rendered screen an agent read, and Copilot Vision and ChatGPT are not among the 86 (How Many AI Security Products Control What an AI Agent Sees?).
What does a governed environment change?
A governed environment acts where the page is rendered, before the model receives it. Values chosen by policy are replaced with consistent tokens for the whole run, so a supplier's tax field shows SSN_001 on the form, in the summary and on any later page that would display the number. The model can still match the supplier, decide the tax classification and complete the registration, because the token is stable and the label is intact. The real number resolves only at the destination a named person approved, at the moment of the approved action.
The control class has four parts, and this page's question needs all four. Substitution before any model reads the screen keeps the number out of the context window. Consistent tokens keep the work coherent across pages. A named approver makes each submission or record change accountable. An exported record shows what the model received, what the agent did and who approved it. None of the four depends on the model behaving well, which matters because a page can carry an instruction as easily as it carries a field.
The scope is the rendered page: dashboards, consoles, settings pages and forms. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. A number read from a file or returned by an API is a different control problem, and a team that works across both needs a control for each. RedactSure vs Microsoft Purview: 2026 Comparison & Alternative sets out how a data-estate control differs from a control at the screen, which is the distinction this page's record turns on.
What the record shows
A Social Security number on a rendered record is disclosed when the page draws it, and no later retention setting removes it from the context in which the model read it. The vendor pages reviewed divide the path into permission, observation, transcript and training: Edge decides whether Copilot may read page content, Copilot Vision clears shared context and keeps a transcript, OpenAI's data controls choose training and leave saved chats in place, and Atlas paused on some sensitive sites without saying what the page showed the model. None of those pages describes a replacement of the number before the model reads it. Name one agent and one supplier or payroll screen that carries an SSN, run the task with a test nine-digit value, and compare what the model received on the page with what the transcript and the vendor's retention page say was kept. If the test value appears in the transcript, the real number would have appeared there too.
Methodology and limitations
This page rests on vendor help pages from Microsoft, OpenAI, Gusto and Suntory Global Spirits, a registrar guide from Tulane University, a consumer pamphlet from the Social Security Administration, and two research papers on privacy leakage and prompt injection. The vendor pages were read in full, and public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 21, 2026 and October 22, 2026, and each Sources line carries the date for its page. The Social Security Administration publication is consumer guidance rather than a rule, and it states no legal duty for an employer, a bank or a software vendor to mask an SSN.
No product named here was tested for this page. The products are described from their public documentation, and "not described in the pages reviewed" means the pages reviewed for this page did not state the point. Vendor features change, and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a tax-identification field on a supplier or payroll page, not an organization. Determinations about whether a workflow meets a legal, tax or contractual requirement belong to counsel, assessors and the organization's own security and compliance officers. Nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
What happens when an AI agent sees a Social Security number?
It receives the page that draws the number. The SSN enters the model's context with the rest of the screen, travels into the transcript and any note the agent writes, and stays for as long as the vendor or the customer keeps that text. Permission decides whether the page opens; it does not decide which fields the model reads. Replacing the number with a token before the draw is the control that changes what the model receives.
Does the number stay in the transcript after the run ends?
Often, yes. A session can clear its screen context and still keep a transcript: Copilot Vision says shared context is cleared when the session ends and that a transcript is stored in conversation history. A vendor's training setting is separate from its storage period, and turning training off does not delete saved chats. Ask for the retention period in writing, then read a real transcript to see whether the number is there.
Can a retention setting keep the SSN out of the model?
No. Retention decides how long text is kept, not what the model reads when the page is open. A short retention period reduces the window after the run; it does not stop the number from entering the context. The only point that changes what the model receives is before the page is read, where a value can be replaced with a token. Retention and substitution answer different questions.
Who should approve an agent that opens a supplier or payroll record?
A named person, for the submission or the record change. The approval should identify the action, the record and the person, and it should be backed by a record of what the model received. A confirmation prompt inside the agent is weaker, because it can appear only on some sites and it does not by itself name an approver or preserve the evidence. Test whether the prompt fires on the record you care about.
What record should the team keep of what the model received?
One record per run, showing the page as the model saw it, the actions the agent took and the name of each approver. That record lets a reviewer answer the question after the fact: did the model read the number, or a token? A transcript alone is incomplete because it may omit the screen, and an action log alone is incomplete because it may omit the values. Ask for both, exported to the team's own monitoring.
Should an agent ever read a full Social Security number?
Only when the task requires the digits and no token can carry it. Most supplier, payroll and registrar tasks need a match, not the number: the last four digits, a name and a date of birth can identify the record. The Social Security Administration advises people to ask why a number is needed and what happens if they refuse, and that question applies to an agent's owner. Prefer the token unless the task fails without the digits.
How RedactSure Keeps an SSN Off the Screen the Model Reads
A supplier page hands the model a number the task never needed, and the controls reviewed act after that read. Copilot Vision clears shared context when a session ends yet still stores a transcript (Microsoft, Copilot Vision, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the tax section draws nine digits, the model reads them, and a later summary can carry them forward. Inside: the field renders SSN_001 for the run, the model matches the supplier on the token, and the real number resolves only at the approved destination when a named person approves. The record shows the page the model was shown and the approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A Social Security number on a supplier form is the value a reviewer will ask about first. Bring one record that carries an SSN and see, with test values, what the model reads and where the real number lands. Book a demo