Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Is a Secure Alternative to Edge Copilot Actions for Vendor Portal Work?
Alternatives to Edge Copilot Actions for vendor portal work are judged by what the model reads on the portal page, not by where the clicks run. Look for values replaced with consistent tokens before the model reads the rendered page, a named person approving each remittance, and a record of both.
An accounts payable clerk pays carriers through a portal that shows each invoice, its amount and the bank account the carrier wants paid, in a browser that has been signed in since morning. An agent can do the useful part of that work: open each remittance, compare it with the invoice in the ledger and prepare the payment. What the controller needs to know is what the model was shown when the page rendered, because an account number that reaches the model can leave in a summary, a support ticket or a transcript. Microsoft's Edge feature keeps the clerk's stored password and the wallet out of the agent's reach, which is the part teams like. The page itself, the values on it and the record of what the model read are the parts still open, and they are where the alternatives differ. The work is repetitive, the amounts are large and the portal renders the same fields every week, so the question is not whether an agent should do it but what the page should show the model while it does. A carrier remittance page is a small, weekly decision with a large number attached.
Key findings
-
For an agent to work a remittance page safely, the values on that page would have to be replaced with consistent tokens before any model reads the rendered screen, so the bank account arrives as ACCT_002 and the carrier as VENDOR_003 (What Is a Protected Browser for AI Agents?).
-
It would also require a named person approving each remittance, submission or record change, and a record of what the model received on that screen, kept where the organization's own monitoring can read it (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
-
The pages reviewed describe where Copilot's actions run and which stored credentials it cannot reach; no page reviewed describes replacing the values on a portal before the model reads it (Microsoft, Browse, 2026).
-
Microsoft's work page says Copilot in Edge builds a response from "content from the current webpage" when an organization allows it, and leaves the handling of that content to settings that can vary by feature (Microsoft, Copilot in Edge, 2026).
-
Reddy and Gujral document CVE-2025-32711 in Microsoft 365 Copilot, where the client "automatically fetches the external image URL included by the attacker", the path a supplier logo takes (Reddy and Gujral, 2025).
-
The Hacker News rated that exploit CVSS 9.3 and named its object as "the MOST sensitive data from the current LLM context", which on a remittance page is the account number (The Hacker News, 2025).
What does Edge Copilot Actions read when it opens a vendor portal?
The record for this page is a carrier portal remittance page: a table of invoices due, the amount on each, the bank account the carrier wants paid, and a Remit button beside every row.
Microsoft defines the feature as one that "lets Copilot perform actions directly in your Microsoft Edge browser, such as clicking, typing, and navigating tabs", and adds that "All actions run locally in your browser, ensuring full visibility and control", two statements about where the clicks happen rather than about what the model is shown (Microsoft, Browse, 2026).
The support page also says "Copilot can access cookies", so "if you're already signed into a site that Copilot has access to, it will also be signed in automatically" (Microsoft, Browse, 2026). The agent arrives as the clerk, with the clerk's access, and reads what the clerk would read.
On the input side, Microsoft's work page states that Copilot in Edge generates responses based on your prompt, conversation history, and, when allowed by your organization's settings, "content from the current webpage", and it adds that "How information is handled can vary by feature" (Microsoft, Copilot in Edge, 2026).
The do-not-use list names the data rather than removing it from the screen: "Financial activity (banking, stock trading, credit card details)" and "Personal identifiers (Social Security numbers, government IDs, medical records)" (Microsoft, Browse, 2026). The invoice number, the amount and the due date are enough to reconcile; a model that also receives the bank account holds the carrier's number for the rest of the run. The alternatives on offer divide by where a value stops being real: a handover, a narrower identity, or a page that renders values as consistent tokens.
What happens when the portal page carries hidden instructions?
A portal page carries text other people wrote: invoice memos, carrier names, a chat widget in the corner. Any of those can carry text the agent reads as an instruction, the class OWASP names: "Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files" (OWASP, 2025).
Microsoft warns that the feature is experimental and "may misinterpret instructions, make mistakes, or be affected by malicious hidden instructions on web pages", and its example sends the agent to "visit another site to collect sensitive information instead" (Microsoft, Browse, 2026).
Greshake and colleagues wrote that "We reveal new attack vectors, using Indirect Prompt Injection", and those vectors let adversaries exploit LLM-integrated applications remotely (Greshake et al., 2023). Reddy and Gujral's EchoLeak is the shipped case: the client "automatically fetches the external image URL included by the attacker" (Reddy and Gujral, 2025).
Siddiqui and colleagues describe the consequence: "poisoned data retrieved from one component can change the model's behavior and compromise the entire system, including coercing the model to spread confidential data to untrusted components" (Siddiqui et al., 2025). A study of browsing agents names the three failures a paste attack chains, "prompt injection, domain validation bypass, and credential exfiltration" (Can a Browser Agent Be Tricked Into Pasting Sensitive Data Into a Chat?).
On the remittance page, the instruction that matters says the payee's bank details have changed and sends the agent to a page it can reach with the clerk's session. What it collects is what the model was shown; on a page rendered as tokens it collects ACCT_002 and VENDOR_003 (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
What do the vendors themselves say?
The support page is specific about the credential the agent cannot reach. The stored credential is closed: Copilot "cannot access autofill data, saved passwords, or wallet information", which is the boundary that makes the feature usable at all on a work account (Microsoft, Browse, 2026).
Rollout is narrow and consumer-first: "For consumers, Browse with Copilot is rolling out as a feature for Microsoft 365 Premium subscribers in the US, with additional markets to follow" (Microsoft, Browse, 2026). Microsoft's work page describes the enterprise path, where a consent dialog may appear and an admin can enable or disable access to page content, which puts that decision with the tenant rather than with the agent (Microsoft, Copilot in Edge, 2026).
Copilot Studio's governance page covers the admin side: "Data policies control agent knowledge sources, actions, connectors and skills", and admins have full visibility into maker audit logs in Purview, which governs what an agent may use and who can audit the work rather than what a page shows its model (Microsoft, Security, 2026).
The wider field draws the same line: of the 86 AI security and data protection products reviewed, 36 describe recording what the model was shown, and in every case the record is a prompt, a conversation or a request payload at the product's own gateway or pipeline; none of the 86 describes recording the rendered screen an agent read (documentation, not tested behavior) (How Many AI Security Products Control What an AI Agent Sees?).
| Dimension | Microsoft, per its documentation | What a buyer should verify |
|---|---|---|
| Where the actions run | "All actions run locally in your browser, ensuring full visibility and control" (Microsoft, Browse, 2026) | Which account that browser is signed into, and what else is open in it |
| What the model receives | Responses built from "content from the current webpage" when the organization allows it (Microsoft, Copilot in Edge, 2026) | Which fields on the portal page reach the model once access is on |
| Stored credentials | Cannot access autofill data, saved passwords or wallet information (Microsoft, Browse, 2026) | What the page after sign-in renders, since the limit ends at the credential |
Read together, the pages document a local run, a credential boundary, admin policies over connectors and skills, and an audit trail in Purview. None of them describes replacing the values on a rendered page before the model reads it.
Can the agent still reconcile remittances when the model sees placeholders?
Yes, when the policy keeps the fields the work needs and replaces the ones it does not. A token is consistent for the whole run, so the same carrier is VENDOR_003 on the remittance page, in the ledger export and in the note the agent drafts, and the model can match the three without ever holding the name (What Is Render-Layer Tokenization?).
Amounts, dates and invoice numbers can stay as themselves when the policy says so, which is what reconciliation needs, and the bank account, the tax identifier and the carrier's contact details can be replaced, which the payment does not need the model to see.
A value the model must compare with something outside the environment, such as a scanned remittance advice the carrier emailed, comes back to a person. A clerk who downloads a CSV from the portal has a new file the governed page does not follow.
Scope is the last limit, and it matters for a portal: a governed browser covers what the agent reads and does on a rendered page, and not the terminal, the IDE, the local filesystem, direct API calls or MCP (What Is the Difference Between a Headless Browser and a Protected Browser for AI Agents?).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.Values chosen by a policy are replaced with consistent tokens for the whole run, so the carrier's bank account is ACCT_002 on every page and in every note. Real values resolve only at an approved destination, at the moment of an approved action, so the account reaches the payment form the approver saw and not the transcript. A named person approves each payment, submission or record change, and the screen, the action and the approval land in a record that exports to the organization's own monitoring.
Applied to the remittance page, the model reads the invoice numbers, the amounts and ACCT_002, prepares the payment, and stops at an approval a person gives by name. The record shows the page the model read, beside the approval, which is the artifact an auditor asks for after a payee change on a remittance page.
The nearest comparison is the Edge feature itself, set beside this control class (RedactSure vs Microsoft Edge Copilot Mode: 2026 Comparison & Alternative). Its local run and its credential boundary answer where the clicks happen; the governed environment answers what the page showed the model.
What the record shows
Three things decide whether an alternative is secure for vendor portal work: the values on the rendered page before the model reads it, the person who approves the payment, and the record of both. The pages reviewed settle the first by saying the model is given content from the current webpage, and they describe no replacement of values on the page itself. Finance sits between experiment and scale, 62% of organizations experimenting with agents and 23% scaling them (What Is the PII Wall?), and the carrier remittance page shows why: a model that read ACCT_002 cannot pass the account on, and a model that read the numbers can. Run one remittance task against a test portal, compare the transcript with the screen the clerk sees, and name the person who approved the payment.
Methodology and limitations
This page rests on Microsoft's support pages for Browse with Copilot and for Copilot in Edge at work, the Copilot Studio governance page, the OWASP Top 10 entry for prompt injection, and three research papers on indirect injection, information flow and a shipped exploit. Vendor pages were read as of October 20, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
The products on this page are described from documentation and none was tested for this page; "not described" means the pages reviewed, and vendor features change, so a release after this page's date is unreviewed. RedactSure is deploying now with enterprise and government customers. The carrier portal remittance page describes a record type, not an organization. Whether a payment flow meets a contractual or regulatory requirement belongs to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
What is a secure alternative to Edge Copilot Actions for vendor portal work?
One that replaces the portal's values before the model reads them, names the person who approves the payment, and keeps a record of both. Microsoft's Edge feature documents where actions run and which stored credentials it cannot reach, while the page content still reaches the model when an organization allows it. An alternative is secure on this work when a carrier's bank account is a token on the rendered page and a person approves the remittance. Ask for those three in writing.
Does Copilot read the vendor portal page the agent opens?
Yes, when the organization allows page content. Microsoft's work page says responses are built from the prompt, conversation history and "content from the current webpage", so a remittance page the clerk is signed into is input once access is on. An admin can also disable that access, and a consent dialog may appear first. The page never says which fields are withheld, so treat every value on a signed-in portal as read.
Do the saved-password and wallet limits keep the remittance page out of the model?
No. They bound the stored credential, not the page. Microsoft states that Copilot "cannot access autofill data, saved passwords, or wallet information", which stops the agent from pulling a card or a password out of storage. The portal page the clerk's session unlocks is a different matter, and its bank account, tax identifier and amounts render to the model like any other page. Test the page, not the password store.
Who approves a payment the agent prepared on the portal?
A named person outside the model, if the environment is built that way; the Edge feature leaves the approval to the person at the keyboard. That leaves the run in the clerk's own session, where the same person can click through, which is a safeguard for the clerk and not an approval for a controller. A payment needs an approver who is not the account the agent signed in as.
What record does finance get of one run on a remittance page?
From Microsoft's pages, none that is described: the support page covers where actions run and what the agent cannot access, and Copilot Studio keeps maker audit logs in Purview. None of those is a screen-by-screen record of what the model read on the portal. A governed environment writes that record as the run happens, with the approval and its name beside it.
What happens when a hidden instruction reaches the agent on a portal page?
It can redirect the run. Microsoft warns that the feature "may be affected by malicious hidden instructions on web pages", and its own example is an instruction that sends the agent to another site to collect sensitive information. What the injection collects depends on what the model was shown, and that is the one thing the page does not settle.
How RedactSure Keeps a Carrier's Bank Details Out of the Model
An agent that types a carrier's bank details into a remittance page has read them, and a local run with saved passwords blocked changes nothing about that.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the clerk's signed-in session opens the remittance page, the agent reads the carrier's account number, and the digits stay in its context for the rest of the run. Inside the governed environment: the page renders with ACCT_002 in place of the account, the amounts stay for reconciliation, and the real account reaches the payment form only when a named approver releases it.
RedactSure is deploying now with enterprise and government customers. Microsoft's own support page lists banking and credit card details among the uses to avoid.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A carrier's bank details on a remittance page are what finance asks about first. Bring one portal task your team pays from and see, with test values, the page as the model receives it, the approval and the record. Book a demo