Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?

The hosting vendor controls where the agent runs and which sites it may reach; in the documentation reviewed, no one controls what the model reads from a permitted page, because the screenshot goes to the model as rendered. Check who sets that page policy, where the page renders, and what record you receive, because the task completes either way.

An outside network connects to a hosted browser enclosure while an agent views the rendered page inside.

The hosting vendor controls where the agent runs and which sites it may reach; in the documentation reviewed, no one controls what the model reads from a permitted page, because the screenshot goes to the model as rendered. Check who sets that page policy, where the page renders, and what record you receive, because the task completes either way. Two developments in October 2026 put the question in front of buyers: OpenAI documents an Agents API that runs the browser in its own hosted environment, and Perplexity open-sourced SPACE, the sandbox platform behind its Computer product. Both are isolation designs, and isolation is a real control. It is a control over a different thing from the one this page asks about. This page is an evaluation checklist: what isolation decides and leaves undecided, who sets the policy on what the model reads from a permitted page, where the page renders and who holds the session, what record the customer receives, what the two vendors' documentation says, and what a governed environment changes. It builds on research on whether sandboxing an enterprise AI agent protects your data.

Key findings

  • OpenAI's computer use guide states that "the Agents API runs the browser in an OpenAI-hosted environment"; the agent observes browser screenshots and decides the next action from what it sees, and the developer's application must approve each new website origin before the browser accesses it (OpenAI, 2026).
  • Perplexity describes SPACE as isolating agent-generated code and files from the host in per-sandbox virtual machines; "SPACE treats the sandbox as untrusted and manages network access and platform-held credentials outside the sandbox" (Perplexity, 2026).
  • Anthropic's engineering account of sandboxing holds that "effective sandboxing requires both filesystem and network isolation" and reports that sandboxing "safely reduces permission prompts by 84%," a measure of execution risk rather than of what a model reads (Anthropic, 2025).
  • OpenAI's ChatGPT Work admin documentation states that the Compliance Logs Platform "retains data for 30 days" and that records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, 2026).
  • NIST's container security guidance treats isolation as a boundary around execution, which is the layer hosted browsers and sandboxes address (NIST, 2017).
  • Whether the model vendor should own the environment the agent runs in is examined in research on whether the AI model vendor should own the agent environment.

What does isolation decide, and what does it leave undecided?

Isolation answers where the agent's code runs and what it can touch. Perplexity's SPACE runs each sandbox in its own small virtual machine, isolates agent-generated code and files from the host, and keeps network access and platform-held credentials outside the sandbox, which it treats as untrusted (Perplexity, 2026). Anthropic's account of sandboxing its coding agent makes the same point: "effective sandboxing requires both filesystem and network isolation" (Anthropic, 2025). NIST's container security guidance frames isolation as a boundary around execution (NIST, 2017). These control the blast radius of what the agent does.

They leave undecided what the model reads. A browser agent's loop is: render, capture, send the capture to the model, act on its decision. Isolation governs the fourth step, where a confused agent might write to disk, call out or use a credential. The third step is untouched: a sandbox that fully contains the agent still sends the model a faithful picture of every page it is allowed to open. Meta's Agents Rule of Two names three properties that together create risk: untrusted input, access to sensitive data, and the ability to change state or communicate externally (Meta AI, 2025). Isolation acts on the third; the second is set by what the page shows.

Take a cloud billing console as the record type: a billing account page showing the owner's name and email, a card's last four digits and expiry, a tax identifier, a billing address and a list of invoices. The task is to download last month's invoice. Isolation decides that the agent cannot reach the host filesystem or an unapproved origin meanwhile. It says nothing about the model having received the tax identifier and card details to click one link. The checklist begins here, with the three questions that follow.

Who sets the policy on what the model reads from a permitted page?

In OpenAI's hosted computer use, the developer's application starts the session, follows its events, and must approve each new website origin before the browser accesses it (OpenAI, 2026). That is a policy on which pages. Once an origin is approved, the agent observes browser screenshots and decides the next action from what it sees; no step is described between the screenshot and the model where the customer could alter what the page shows. ChatGPT Work's documentation makes a related distinction: "Allowing a website doesn't approve every action on that site" (OpenAI, 2026), so actions can be gated after a site is allowed, but what the model reads from the allowed site is not described as a configurable policy.

Perplexity's SPACE is explicit about what it governs: network access and credentials are managed outside the sandbox, and the sandbox is treated as untrusted (Perplexity, 2026). Isolation is of execution and credentials. A page policy, in the sense of rules about which values on a rendered page the model may see, is not described in the pages reviewed.

So for both products as documented, no one sets that policy. The customer sets origin approvals and, in some products, action approvals; the vendor sets the host; the page shows what the application shows. OWASP's prompt injection entry adds the second reason the question matters: a page the agent is permitted to read can carry instructions as well as data (OWASP, 2025), and a policy that governs what the model reads from the page is the only kind that acts on both. A buyer evaluating a hosted browser should ask the vendor whether such a policy exists, who configures it, and whether it applies before the capture reaches the model.

Where is the page rendered, and who holds the session?

Location decides whose logs, jurisdiction and credentials are involved. OpenAI states that the Agents API runs the browser in an OpenAI-hosted environment (OpenAI, 2026); the customer's application drives the session, but the page renders on infrastructure the customer does not control. For ChatGPT Work, OpenAI states that "website sign-in through the cloud browser isn't available in Enterprise or Edu workspaces" (OpenAI, 2026), and the retired ChatGPT agent's help page noted that with connected apps it "can access sensitive data like emails, files, or account settings" and that screenshots are not captured during takeover, which "helps protect passwords" (OpenAI, 2026). The protection for passwords is to stop capturing; nothing equivalent is described for the data on the page once control returns.

Perplexity's SPACE is open-sourced, so an organization could run the sandbox on infrastructure it controls. SPACE keeps credentials outside the sandbox at the platform level (Perplexity, 2026); who operates that platform is a deployment choice.

On the billing console: if the hosted browser signs in with the organization's credentials, the session holding the tax identifier lives on the vendor's host; if sign-in is unavailable, the task cannot be done there; if the sandbox is self-hosted, the session is the organization's and the page still renders in full to the model. Location changes the custodian of the session, not what the model reads. Research on whether it is safe to let ChatGPT Work access sensitive company data examines the hosted case in detail.

What record does the customer receive?

OpenAI's computer use documentation states that screenshots are omitted from API output by default and included only when include_screenshots is true (OpenAI, 2026). The customer can therefore obtain the screenshots the model saw, a record of the model's input in the clear: the billing page with the tax identifier on it, stored wherever the application stores API output. For ChatGPT Work, the Compliance Logs Platform "retains data for 30 days" and the records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, 2026). For SPACE, a record of what the model received from a page is not described in the pages reviewed.

The billing console task as a before-and-after. Before: the agent opens the billing account page; the screenshot, holding the owner's name, email, card digits, tax identifier and address, goes to the model; the model finds last month's invoice and clicks download. Task complete. The record, if screenshots were requested, is the page in the clear; if not, there is no record of what the model read.

After, under a page policy applied before the capture: the same page renders with OWNER_001, EMAIL_001, CARD_001, TAXID_001 and ADDR_001 in place of the values and the invoice list intact; the model finds the invoice and clicks download. Task complete. The record is the page as the model saw it, with tokens where the values were, plus the click. The outcome is identical; the difference is the model's input and the content of the record, and a buyer should ask each vendor which record it can produce. Research on what an AI Control Record is describes the second kind.

What does the vendor's own documentation say?

Dimension OpenAI and Perplexity, per their documentation What a buyer should verify
Where the browser runs OpenAI: an OpenAI-hosted environment. Perplexity: per-sandbox virtual machines, open-sourced Which party operates the host for the buyer's deployment
Which sites the agent may reach OpenAI: the developer's application approves each new origin. Perplexity: network access managed outside the sandbox Who holds the approval list and how it is changed
What the model receives from a permitted page OpenAI: browser screenshots, from which the agent decides its next action. Perplexity: not described in the pages reviewed Whether any policy alters the page before the model reads it
Credentials OpenAI: ChatGPT Work sign-in unavailable in Enterprise and Edu workspaces. Perplexity: platform-held credentials outside the sandbox How a session into a signed-in application is established and by whom
Record for the customer OpenAI: screenshots in API output when include_screenshots is true; ChatGPT Work compliance logs retained 30 days, not a complete audit trail. Perplexity: not described in the pages reviewed Whether the record shows the model's input, in what form, and for how long

OpenAI documents the hosted environment, the origin approval, the screenshot loop and the output option (OpenAI, 2026), and documents the retention and completeness limits of its enterprise compliance logs (OpenAI, 2026). Perplexity documents the isolation model and the placement of credentials (Perplexity, 2026). Neither describes a customer-set policy on what the model reads from a permitted page, nor a record of the model's input in anything other than the clear. Those are the two items a buyer should ask for in writing, with a date.

What does a governed environment change?

In a governed environment, the browser the agent uses renders inside the customer's own cloud, the values on each permitted page are replaced with consistent tokens before any model reads the capture, and the record the customer receives shows the page as the model saw it, so the three checklist questions have the same answer: the customer.

The mechanism is a class of control that sits between the rendered page and the model, inside an environment the customer operates. Values on the page that the task does not need in the clear, an account owner's name, a card's digits, a tax identifier, an address, are replaced with consistent tokens before any model reads them, and the task runs on those tokens. Real values resolve only at an approved destination at the moment of an approved action; for downloading an invoice, nothing resolves. A named person confirms what is tokenized and approves consequential actions, including payments, submissions and record changes made through the browser. Every screen as the model received it, in token form, every action and every approval is recorded and exported to the organization's own logging, for as long as the organization keeps it.

This bears on the title question because isolation and page policy are different layers. A hosted browser or a sandbox decides where the agent runs and what it can reach (Perplexity, 2026), and it can be kept. The page policy decides what the model reads from a page the agent is permitted to open, which in the documentation reviewed no party sets (OpenAI, 2026). The record answers the third question with the model's input in token form rather than a screenshot in the clear held for a fixed retention period. The control does not alter the application, the sandbox or the model; it moves the render into the customer's environment and adds a step the hosted designs do not describe.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. Agents work inside a governed browser environment in the customer's own cloud rather than on a vendor's host, so the session, the render and the record belong to the customer. On every rendered page, including a billing console or any other permitted site, substitution happens at the render layer before any model reads the screen, so account identifiers, card details and tax identifiers reach the model as consistent tokens such as ACCT_001 or CUST_001 for the whole run. Real values resolve only at approved destinations at the moment of an approved action. A named person confirms the tokenization policy and approves every payment, submission and record change, the arrangement RedactSure calls Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM. The design is model agnostic, so the same environment can carry a model from any vendor, requires no per-application integration, and leaves user permissions unchanged.

Deployments are in pilot. A pilot on the reader's own browser task would answer the three checklist questions with the pages as the model received them, the completed task, the approvals, and the exported record. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on OpenAI's Agents API computer use guide, OpenAI's ChatGPT Work overview and admin FAQ, OpenAI's help page for the retired ChatGPT agent, Perplexity's October 2026 blog post open-sourcing SPACE, Anthropic's engineering post on sandboxing its coding agent, Meta AI's Agents Rule of Two, NIST SP 800-190 on container security, the OWASP Top 10 for LLM Applications entry on prompt injection, and published RedactSure research pages on sandboxing, ChatGPT Work, model vendor ownership of the agent environment, render-layer tokenization and the AI Control Record. All sources were read as of October 16, 2026.

No hands-on testing of OpenAI's hosted browser, ChatGPT Work or Perplexity's SPACE was performed for this page. Where a capability is described as not described, the statement means not described in the pages reviewed, not that the product lacks it. OpenAI's computer use page carries no date and the ChatGPT agent has been retired in favor of ChatGPT Work, as its help page notes; Perplexity's post was published the day before this page was written. Vendor features change and the page carries its date. Statements about RedactSure describe its current design, with deployments in pilot. The cloud billing console and the invoice task describe a record type, not any organization, and the token names are illustrative.

Whether a given hosted browser, sandbox or governed environment meets an organization's obligations under its data protection laws, its cloud and vendor agreements or its own security policies is a determination for its counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

In a hosted or sandboxed browser, the vendor or the sandbox operator controls where the agent runs, which origins it may reach and, in some products, which actions need approval. Those are controls on execution and destination. What the model reads from a page the agent is permitted to open is, in the documentation reviewed for OpenAI's hosted computer use and Perplexity's SPACE, not controlled by anyone: the capture goes to the model as rendered, and the record the customer can obtain is either that capture in the clear or a compliance log the vendor describes as incomplete and time-limited. The three checklist questions, who sets the page policy, where the page renders and what record the customer receives, are answered together only when the render happens in an environment the customer operates; RedactSure's environment is one such design. The test is to name one agent and one task on one permitted page, run it, and ask each vendor for the record of what the model received.

Frequently asked questions

Does a sandbox protect the data on the pages the agent reads?

A sandbox protects the host from the agent: it isolates files, code and often network access, and SPACE keeps credentials outside it. It does not alter what the browser renders or what the model receives from the render. A page the agent is permitted to open is captured and sent to the model in full. Sandboxing and page policy are different layers, and a buyer can have one without the other; the checklist asks for both and records which the vendor documents.

If my application approves each origin, do I control what the model sees?

You control which sites the agent may visit. OpenAI's documentation describes origin approval by the developer's application and, for ChatGPT Work, notes that allowing a website does not approve every action on it. Neither is a control on the content of a permitted page. Everything the page shows to a signed-in user is in the screenshot the model receives, in the pages reviewed, and an injected instruction on that page arrives the same way.

Can I get the screenshots the model saw?

For OpenAI's computer use, yes: screenshots are omitted from API output by default and included when include_screenshots is set. That gives a record of the model's input, in the clear, stored by your application. ChatGPT Work's compliance logs are retained for 30 days and are described by OpenAI as not establishing a complete audit trail. For SPACE, a record of the model's input is not described in the pages reviewed.

Does self-hosting the sandbox change the answer?

It changes who holds the session and the logs, which matters for jurisdiction, retention and credentials. SPACE being open-sourced makes self-hosting possible. It does not by itself add a policy on what the model reads from a rendered page; the page still renders in full to the model unless something alters the capture before it is sent. Location is the second checklist question, not the first, and a self-hosted sandbox with no page policy still answers the first question with no one.

Why does the task complete either way?

Because most browser tasks act on structure, not on identifying values. Downloading an invoice needs the invoice list and the download control, not the tax identifier or the card digits on the same page. When those values render as consistent tokens, the model still finds the control and the task completes. Tasks that need a real value to land somewhere, such as entering a card number into a payment form, resolve it only at that destination, under a person's approval, and the model still never reads it.

What should I ask a hosted browser vendor in writing?

Three things, with dates: whether any policy alters what the model reads from a permitted page and who configures it; where the page renders and who holds the session into signed-in applications; and what record of the model's input the customer receives, in what form and for how long. The answers for the products reviewed here are, respectively, not described, the vendor's host or a self-hosted sandbox, and screenshots in the clear or a time-limited log.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.