Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happens When an AI Agent Sees Employee Salaries?
It can repeat them. A salary a model reads on a compensation screen stays in its context for the rest of the run, and the leak is an internal trust failure before it is a legal one; ask what the agent receives from the screen, who approves a pay change and what record shows both.
A compensation screen is the page an HR team watches most closely, and it is the page an agent is most likely to be handed. It lists employees with job profile, salary amount and equity grant beside the identification fields an employer maintains. When an agent opens it, the browser renders the page and the model receives what the page shows: the salary of the person it was asked about and the salary of everyone else in the list. Those figures stay in context for the rest of the run, so they can reappear in a summary, a ticket comment or a later task, and the first damage is to trust inside the team that holds the pay. Most organizations sit between experimenting and scaling agents, so the question arrives before the policy does (What Is the PII Wall?). Permissions and profiles decide who may open a screen, and they leave open what the model is shown once it opens. The question is narrower than whether an agent should touch HR data: what the model receives when the page loads, which person approves a change, and what evidence survives the run.
Key findings
- Salary data stays out of a model's context only when the values on the compensation screen are replaced with consistent tokens before the model reads the page, with real figures released only at an approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each pay change and a record of what the model received, because an approval governs the action the agent takes, not the rows the screen already returned (How Do I Let a Coding Agent Use a Test Database That Contains Real Customer Data?).
- None of the vendor pages reviewed states that the salary figures a screen renders are replaced before the model reads them; they describe who may open the screen and what an administrator may change (Rippling, 2026).
- Rippling's documentation states that access "governs the different types of data a permission profile has about the people in its scope," which bounds which records an agent opens, not what the model receives (Rippling, 2026).
- Gusto's help page states that "Your legal name" and "Social Security Number (SSN)" are fields an employer must update, so an agent acting for the employer can edit an identity number as well as pay (Gusto, 2026).
- In a benchmark of web agents, agents began following injected instructions in up to 86% of cases, though "even state-of-the-art agents often struggle to fully complete the attacker goals" (Evtimov et al., 2025).
What does an agent receive when it opens a compensation screen?
The record is a compensation screen: one page in an HR system that lists a department's employees with job profile, pay rate, salary amount, effective date and equity grant. An agent asked to check a figure or draft a pay change opens it, the browser renders it, and the model receives the rendered text. That text is the whole screen, not the field the agent was sent to edit: every row in view, the column labels, and the salaries of people the task never mentioned.
Permissions decide whether the agent can open the page, and they stop there. Rippling's documentation states that "Access governs the different types of data a permission profile has about the people in its scope," and that profiles are "attached to specific employee attributes, like level or department" (Rippling, 2026). A profile scoped to one department still renders every salary in it. A review of SAP's learning material finds the same boundary: Joule honors existing permissions, so a person's authorizations limit what an agent reads (What Sensitive Data Can SAP Joule Agents Access?).
The fields are not only pay. Gusto's help page lists "Your legal name" and "Social Security Number (SSN)" among the details only the employer can update (Gusto, 2026). Workday's manual states that the task "can change an employee's package, grade, rate of pay, salary amount, or plans," which puts the reading one approval away from a write (Workday, 2026).
What happens to a salary figure once the model reads it?
A figure that reaches the model stays there. It is in the context for every later step of the run: the summary the agent writes for its operator, a comment it posts on a ticket, and a note it adds to the HR record.
The research record explains why one reading is enough for an attacker. In an environmental injection attack on generalist web agents, injected web elements achieved "up to 70% attack success rate (ASR) in stealing users' specific PII" (Liao et al., 2025). A page the agent reads later need not be the payroll system; it needs to be a page the agent will follow, and the figure is already in context. If the model had been shown tokens, that page would collect tokens (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
The first cost is internal. An employee who learns that a tool read their salary, and the salaries of their team, has lost something a policy update cannot restore, and the questions that follow are about who approved the deployment. The legal cost is real and narrower. State pay transparency rules require employers to publish a range, not an individual figure: Virginia requires employers to "disclose the wage or salary range in all public and internal job postings," and Connecticut requires the "wage or wage range and a general description of benefits" in internal and public advertisements (Cooley, 2026). A band is public; the figure for a named person on the screen is not.
What do the vendors themselves say?
Two vendor pages describe the boundaries above the data, and a third describes the task that changes the amount.
Gusto's help page documents the fields an employer maintains and stops at the employee's own view: employees can "add up to 5 bank accounts and split pay between them," a bank change requires them to "Complete the security check (2-step code and confirm current bank)," and "Your legal name" and "Social Security Number (SSN)" are fields the employer must update (Gusto, 2026). It does not state how an SSN appears to an administrator or to an agent.
Rippling's permission page documents the boundary above the data, not what the model receives once the screen renders: "Access governs the different types of data a permission profile has about the people in its scope," and profiles are "attached to specific employee attributes, like level or department" (Rippling, 2026). It makes no AI claim and does not describe a model reading a page.
| Vendor | What its page documents | What a buyer should verify |
|---|---|---|
| Gusto | Employer-updated legal name and SSN; employee bank accounts; a security check on bank changes | Whether an administrator's view masks the SSN, and what an agent signed in as that administrator receives |
| Rippling | Permission profiles attached to employee attributes | Which fields a profile renders, as opposed to which records it opens |
| Workday | Per-component security; a compensation task that changes salary | Whether the approval step records what the model read before the change |
Across these pages, the control that matters here, values replaced on the rendered screen before the model reads them, is not described in the pages reviewed.
Who approves a pay change, and what does that approval cover?
An approval is an action control, and the pages reviewed describe it as one. IBM's agent documentation lets the builder write an escalation instruction: an instruction can state that "the agent must escalate unresolved issues to a human" (IBM, 2026), a behavior the builder specifies rather than a control over what the model read.
An approval prompt governs the action the agent takes, not the rows the screen returned before it: in agent tooling, approval gates the command that runs a query, not the rows the query returns (How Do I Let a Coding Agent Use a Test Database That Contains Real Customer Data?). The same gap sits in the account behind the agent, because a command a person approves can still write anywhere that person's account can (What Is the Least Access a Coding Agent Needs to Finish a Task?), and an HR administrator's account reaches every salary in scope.
The identity behind the approval is part of the control. New York's financial regulator advises that "Covered Entities should consider using authentication factors that can withstand AI-manipulated deepfakes" (New York State Department of Financial Services, 2024). An approval from an account a deepfake can satisfy is not the named person the policy describes. An agent that can write to pay works on a system built for a careful administrator: the failures are "the predictable consequence of deploying agents that can write to systems designed only to be read by careful humans" (Columbia DAPLab, 2026).
What does a governed environment change?
A governed environment moves the control to the point where the page is drawn. Values chosen by policy are replaced with consistent tokens before any model reads the screen, so the SSN field reaches the model as SSN_001, and that token holds for the whole run. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers. Real figures resolve only at an approved destination, at the moment of an approved action; for a pay change, that destination is the payroll record a named person released.
Permission decides whether the agent may open the screen; substitution decides what it sees when it does, so the figure for a person the task never mentioned is not in the context to be repeated. Every tokenized screen, action and approval with a name is written to a record the organization can export. Its scope is the rendered page, so a figure pulled through a direct API call is outside it.
The utility objection is the one to settle with evidence. Replacing identifiers with consistent pseudonyms and restoring them after the model has done its work reduces semantic utility errors by a factor of five (Does Masking Data on Screen Break Browser Agents?). A task that compares the real salary with a band and an effective date is doing the comparison it did before; the employee's SSN reaches the model as SSN_001.
What the record shows
What a compensation screen renders is what the model receives, and the control that matters is written at the point the page is drawn. The vendor pages describe who may open a screen and what an administrator may change: permission profiles bound the data a profile has about the people in its scope, an employer alone updates a legal name or an SSN, and a compensation task can change a salary amount without evaluating eligibility (Rippling, 2026; Gusto, 2026; Workday, 2026). None states that the figures are replaced before the model reads them, so a salary a person was trusted to see sits in the model's context for the run. An HR team should run the check by naming one agent and one screen, running a lookup with test figures, and comparing the record with the salary column the page rendered.
Methodology and limitations
This page rests on peer-reviewed research and preprints on web agent injection, vendor documentation from Gusto, Rippling, Workday and IBM, a law firm's summary of pay transparency laws, a state regulator's guidance, and existing RedactSure research pages. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for this page, and none is described from a hands-on review; "not described in the pages reviewed" means those pages, not a claim about what a product cannot do. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a compensation screen, not an organization. Determinations about pay transparency or employment law belong to counsel, assessors and the organization's own compliance officers, and nothing here replaces a pilot on the organization's own screens.
Frequently asked questions
What happens when an AI agent sees employee salaries?
It can repeat them. A compensation screen renders a column of figures, the model receives the rendered page, and those figures stay in context for the rest of the run, so a summary, a comment or a later page can carry a salary the task never needed. The permissions that decide whether the agent may open the screen do not change what the model receives; a control placed before the screen is read does.
Does an agent read a salary if it only opens the screen to check a field?
Yes, if the screen renders it. A browser renders the page, not the field, so the model receives every row in view and the column labels around it. An agent sent to confirm one employee's effective date also receives the salaries of that employee's colleagues in the same table. The field a task names matters less than what the page shows when it loads.
Who should approve a pay change an agent proposes?
A named person with the authority to set that pay, not the operator who launched the agent. An approval prompt sits in front of the action, so it governs what the agent does next and says nothing about the rows the screen already returned. The approver should see the specific change, from an account whose identity is verified, and the approval should be recorded against that change.
Does masking the salary field on the screen solve the problem?
Only if the masking happens before the model reads the page and the token holds across pages. Masking applied inside one application covers that application's fields, and a model reading the rendered screen still receives whatever the page draws. Salesforce's developer guide lists masking of sensitive data, such as social security numbers, among its Trust Layer's features, a field-level control in one product rather than a statement about the screen (Does Salesforce Agentforce Need Access to Sensitive Customer Information?).
Do state pay transparency rules cover what an agent reads?
Not directly. The rules summarized in the alert require employers to publish a range in job postings, as Virginia, Maine and Connecticut do, and a posting is not a compensation screen. What the rules change is the cost of a mistake: a published band is meant to be public, while an individual figure is not, and a model that repeats one has disclosed something no posting did (Cooley, 2026).
What record should exist after an agent opens a compensation screen?
One that shows what the model received, what it did and who approved. A log of the agent's actions answers only the middle question. The record needs the screen as the model saw it, the action the agent took and the name of the person who approved it, exported to the organization's own monitoring so a reviewer can compare the page with what the model held.
How RedactSure Keeps Salary Figures Out of the Model's Context
An agent that opens a compensation screen reads every salary in view, and the profiles and approvals reviewed above bound where it goes rather than what it reads. Injected page elements have reached "up to 70% attack success rate (ASR) in stealing users' specific PII" (Liao et al., 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the screen and the model receives the salary column, the equity grant and the SSN field as drawn. Inside: the page renders SSN_001, and real figures resolve only at the payroll destination a named person approved.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A salary column that renders once stays in the model's context for the rest of the run. Bring one compensation task and see, with test values, what the model reads and where the real figure lands. Book a demo