Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Which Agentic Browsers Keep Screenshots of What They Did?
Most do: Claude in Chrome captures whatever a tab shows, Dia keeps content 30 days, Opera Neon 365, and several browsers state no period at all. Ask what a screenshot contains, how long it is kept, and whether a zero-retention mode covers the image.
A browser agent opens a customer record in a receivables tool, types a saved card number, clicks Submit, and the run ends. What remains on the vendor's side is a set of images of that screen, one per step, and the retention period for them is usually the last thing a buyer reads on the product page. The images matter to a buyer because a screenshot holds whatever the page rendered at that moment, including the account name, the balance, the invoice number and the card on file, and it outlives the run that produced it. It can sit in a vendor's history, a support tool or a training pipeline, and each is a separate place a buyer has to check before signing.
The question is which agentic browsers keep those images and for how long. The answers are uneven: one vendor publishes a period for content, one for chat data, one for logs, several describe the capture without a retention term, and some describe the browser without saying what it captures. With answers that uneven, a security review that asks only whether the agent can act cannot see the copy of the screen that the run leaves behind.
Key findings
- A screenshot keeps a copy of whatever the screen rendered, so the control that matters sits at the render layer: consistent tokens replace customer values before any model reads the screen, and real values resolve only at the approved destination (What Is Render-Layer Tokenization?).
- The same run needs a named person approving each submission and a record of what the model received, exported to the customer's own monitoring, so the image stops being the only account of the work (What Is an AI Control Record?).
- The gap is retention: the pages reviewed describe what a browser does with a page far more often than what happens to the image of it, and the Manus page does not state a period for what its browser captures (Manus, 2026).
- Anthropic's help page for Claude in Chrome states that "Claude takes screenshots of your active browser tab to understand webpage content" and that "Whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation" (Anthropic, Help Center, 2026).
- Skyvern's documentation warns that "a typed value can still show up in later screenshots and page text" unless Mask Secrets is on, which makes the screenshot a place a value survives the form (Skyvern, 2026).
What does a browser agent capture when it reads a screen?
A team shortlists ten agentic browsers for one workflow and opens the same customer account page in each. The page is a receivables record: account name, balance, invoice number and the card on file. The agent reads the rendered page, and the browser holds an image of what it read, which is the copy that survives the run.
The capture follows the architecture. A browser extension draws the page in the user's own browser and captures the tab. Anthropic's page describes Claude taking screenshots of the active tab, and whatever is visible in one of those tabs "becomes part of the conversation" (Anthropic, Help Center, 2026).
Dia sends the prompt and the relevant page content to "a third-party AI model," and its form fields stay "invisible to the agentic system," which hides a password and leaves the account number in view (The Browser Company, 2026).
A hosted browser renders the page on the vendor's machine. Manus's cloud browser page says "All browser sessions are encrypted" and that each user gets "a separate, isolated browser instance" (Manus, 2026). Encryption at rest says nothing about who can read the image or how long it stays.
An automation framework is the third shape. Skyvern's page says the model "gets placeholders, not your values," then adds that "a typed value can still show up in later screenshots and page text" (Skyvern, 2026). Browser Use says "The LLM only sees placeholders (x_user, x_pass)" and tells developers to "Set use_vision=False to prevent screenshot leaks" (Browser Use, Sensitive, 2026).
Which vendors publish a retention period for what they record?
The pages reviewed attach three periods to retention, and each covers a different object. The Browser Company's Dia page says content data "isn't tied to your account, is retained for 30 days, and then deleted" (The Browser Company, 2026). Opera's Neon privacy statement says chat data is "stored, fully encrypted, on Opera's servers, and will be automatically deleted after 365 days" (Opera, 2026). OpenAI's ChatGPT Work admin FAQ says the Compliance Logs Platform "retains data for 30 days" and that its records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, Work, 2026).
None of the three uses the word screenshot. Reading "content data" as "the image" is an inference the page does not support, and the caution applies to "chat data" and "compliance logs" too.
The rest state no period. Manus describes encrypted, isolated sessions and states no period for what its browser captures (Manus, 2026). Skyvern explains how to hide a typed value in later screenshots and states no period for those screenshots (Skyvern, 2026). Anthropic's Claude in Chrome page blocks high-risk sites and asks before financial sites, and it states no period for the images it captures (Anthropic, Help Center, 2026). The one explicit zero is Browser Use's cloud page: "Zero Data Retention (ZDR) projects never record, even when recording is requested," which covers recordings rather than the values a page shows (Browser Use, Secrets, 2026).
What do the vendors themselves say?
| Browser | What its page says it captures | Retention it states |
|---|---|---|
| Claude in Chrome | "Claude takes screenshots of your active browser tab"; visible content "becomes part of the conversation" | None stated; site blocking and financial-site prompts instead |
| Dia | Prompt and page content sent to "a third-party AI model"; form fields "invisible to the agentic system" | 30 days for content data |
| Opera Neon | Chat data "stored, fully encrypted, on Opera's servers" | 365 days for chat data |
| Manus | Encrypted sessions, an isolated instance per user, takeover for verification | None stated |
| Skyvern | Typed value "can still show up in later screenshots and page text" unless Mask Secrets is on | None stated |
| Browser Use | Placeholders in the input text; vision can be off | Zero retention for recordings, not values |
One register states the capture plainly and then describes controls that govern where the agent goes: Anthropic's page lists site blocking, a prompt before financial sites and password-manager fills, and no period for the image. A second states a period for a neighboring object: The Browser Company attaches 30 days to content data and adds the limit that the browser "should not be used for work that involves PHI or other data you're obligated to protect under a law like HIPAA" (The Browser Company, 2026).
A third describes a confirmation step. OpenAI's help page for the retired ChatGPT agent says screenshots are not captured during a takeover, which it says "helps protect passwords" (OpenAI, Agent, 2026). That narrows the moment of capture and sets no retention term for the image.
For Manus and the retired ChatGPT agent, a period for the image is not described in the pages reviewed. That is the summary of nine pages read in full: the ones that say most about the screen say least about the copy.
What does a stored screenshot contain, and who can read it?
The image contains what the page drew: the account name, the balance, the invoice number and the card on file with its last four digits, plus the labels and navigation around them, and whatever else was visible, a chat panel or a notification.
A field the vendor hides from the agentic system, as Dia says of passwords and irreversible action buttons, is not in the image; a field the page renders is (The Browser Company, 2026).
Who can read it depends on where it sits. A local extension writes to the vendor's service if history or sync is on, and a hosted browser writes to the vendor's storage by design. Dia's page sends the content to a third-party model, which adds a processor. Encryption at rest, which Manus states, protects the file from someone without the key; it does not shorten the period or answer who on staff can open it.
The controls the pages describe act after the value is in the image. Skyvern says saved passwords, card numbers and secrets are "never shown again in the app or returned by the API," a custody statement about the product, not about screenshots already taken (Skyvern, 2026). Mask Secrets hides a typed value in later screenshots, which narrows the window and leaves the earlier capture in place.
Does Masking Data on Screen Break Browser Agents? and Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser? cover what masking does to the work and the hosted case. Does Zero Data Retention Cover Claude Computer Use Screenshots? sets out the developer-side copy.
How do I check one browser before an agent opens a customer record?
Start with the object: ask the vendor to name what it retains, image, content, chat or log, and to give the period for each in writing. A page that says "content data, 30 days" has answered a different question, and the gap between the two is where an image sits unmanaged.
Then ask three questions about capture. Is the screenshot on by default? What turns it off, and does the setting cover the image or only the model's view? Browser Use's use_vision flag is the clearest off switch, and its cloud page is the clearest zero: ZDR projects never record, even when recording is requested (Browser Use, Secrets, 2026).
Run one task with test values and read the history the vendor exposes. Open the same receivables record, put a known test account number on it, let the agent read the page, then look at the image. If it shows the test value, the period applies to a copy of customer data. If it shows a token, the image records the task.
Ask for the record of the run: who approved the submission, what the model received on each screen, where it exports. That export is rare: 5 of the 15 AI agents whose documentation was reviewed describe a per-action record an administrator can export, so an agent run that leaves one is the exception in that set (Do AI Agents Ask Before Making a Payment?). Which Enterprise AI Agents Can Work on Screens With PII Today, and What Does Each One Read? applies the same test to a wider set of agents.
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so the model works on placeholders on every page. Real values resolve only at the approved destination, at the moment of an approved action. A named person confirms the policy and approves each consequential action, and every screen as tokens, every action and every approval is written to a record that exports to the customer's monitoring.
For this question the difference is the image. A screenshot taken inside that environment holds the token, so a retained image is a record of the task rather than a copy of the customer's data. A vendor can keep the image for 30 days or 365, and the period applies to CUST_014 and ACCT_002, not to the account holder.
The scope is the rendered page. It does not cover the terminal, the IDE, the local filesystem, direct API calls or MCP. Within the rendered page it is the control reviewed here that changes the contents of the image rather than the length of time the image is kept. RedactSure vs Claude in Chrome: 2026 Comparison & Alternative sets that control against one browser's documented approach, which blocks sites, asks before financial pages and captures the active tab.
What the record shows
The control that settles this question acts before the image exists: values chosen by policy are replaced with consistent tokens as the screen renders, real values resolve only at the approved destination, a named person approves each submission, and the record of what the model received exports to the customer's monitoring. Measured against that, the pages reviewed fall into three groups: those that state a period for an object adjacent to the image, those that describe the capture and state no period, and those that describe the browser without saying what it captures. None states a period for the screenshot itself. A buyer should settle its own case by running one task with test values and reading the vendor's history for the image.
Methodology and limitations
Public documentation read in full gives a sound view of where each product applies its control; it does not show what a given deployment records, because that depends on the settings the customer enables. Vendor pages were read between October 21, 2026 and October 22, 2026, and each Sources line carries the date for its page.
None of the products on this page was tested for this page, and no vendor was asked to confirm a setting. "Not described in the pages reviewed" means the pages reviewed and nothing broader. Vendor features change and the page carries its date. RedactSure is deploying now with enterprise and government customers. The example describes a record type, a customer account page in a receivables tool, not an organization. Determinations about whether a retention period meets a legal or regulatory requirement belong to counsel, assessors and the organization's security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Do agentic browsers keep screenshots of what they read?
Most of the ones whose pages state it do. Anthropic's Claude in Chrome page says the browser takes screenshots of the active tab and that whatever is visible "becomes part of the conversation," and Skyvern and Browser Use both describe the image as a channel a developer can narrow. Dia and Opera state a period for content data and chat data. That is enough to ask a precise question, which is more useful than a yes or no.
How long does a browser keep what it captures?
The pages reviewed give three periods and none of them names a screenshot: 30 days for Dia's content data, 365 days for Opera Neon's chat data, and 30 days for ChatGPT Work's compliance logs. Manus, Skyvern and Anthropic state no period for the image at all, and Browser Use's zero-retention mode applies to recordings. The period depends on which object the vendor is describing, so the buyer has to make the vendor name it.
What does a stored screenshot contain?
Whatever the page rendered at the moment of capture: account names, balances, invoice numbers, the last four digits of a card, and the labels around them. It can also hold a chat panel or a notification that was on screen. A field the vendor hides from the agentic system, as Dia says of passwords, is not in the image. The contents follow the render, not the agent's intent.
Can an agent read a customer record without the image holding the values?
Yes, when the value is replaced before the page is captured. A token such as ACCT_002 stands in the image for the whole run, and the real account number resolves only at the approved destination when a named person approves the action. That is a control at the render layer, not a setting on the screenshot. The pages reviewed describe site blocking, masking and takeover steps, and none describes replacing the value before capture.
Who approves what the agent does with what it read?
Sometimes a person, sometimes a pause in the run. The retired ChatGPT agent does not capture screenshots during a takeover, and Anthropic's page asks before financial sites; both govern a moment, not the record. A prompt answers who was asked, not what was kept. A buyer who needs accountability should ask for a named approver and an exported record, because a prompt on the vendor's screen is not one.
What record should a buyer ask for?
A per-run record of what the model received on each screen, what action it took, who approved it, and where the record is exported. The pages reviewed describe logs, detection and confirmation, but OpenAI's own ChatGPT Work page says its records "don't establish a complete audit trail" for every browser interaction. Ask for the export format and the retention period in writing, and test both on one workflow before signing.
How RedactSure Keeps a Screenshot From Carrying the Customer Record
A browser agent's screenshot is a second copy of the customer record, and the controls reviewed above govern the action more than the image. Opera's Neon statement keeps chat data for 365 days, the longest period any page on this list states.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the agent opens the receivables record, the browser captures the page, and the image holds the account name, the balance and the card on file. Inside the governed environment: the same screen renders CUST_014, ACCT_002 and CARD_001, so the image holds tokens, and a named person approves the credit memo before the real account number resolves at the payment destination.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A screenshot keeps the customer record for as long as the vendor stores it. Bring one screen from your own workflow and see, with test values, what the image contains and who approves the run. Book a demo