AI agents can see only what their configuration and delegated permissions expose—but that can extend far beyond your chat prompt. An agent may receive your instructions, inspect connected apps and files, call APIs, run code in a sandbox, retain session or memory data, and send information to another service. The exact boundary differs by product, account settings, tools, and hosting arrangement. To understand risk, examine four separate questions: what the agent can reach, what it processes, what persists, and who receives copies.
The four boundaries that determine an agent’s data access
1. Permission: what it can reach
An “agent” is not a universal permission level. Access follows enabled applications, account grants, administrator policies, tool definitions, filesystem mounts, network routes, and API credentials. A read-only calendar connection exposes a different boundary from a CRM tool that can edit records or send messages. User-delegated permissions, service accounts, and administrator-managed scopes also produce different results.
As an Amazon Associate I earn from qualifying purchases.
For example, workspace owners can control which applications are available to ChatGPT agent in Enterprise and Edu. If an app is unavailable to agent mode, agent mode cannot use it; however, data from a synchronized app might still be reachable through another separately enabled ChatGPT feature, such as chat or deep research. Connected Google applications remain subject to the Google account’s permissions and workspace settings.
2. Processing: what enters model inference
Data can arrive through several routes:
- Your instructions and conversation context.
- Uploaded documents, images, and other files.
- Records retrieved from applications, databases, search systems, or APIs.
- Results returned by external tools, function calls, MCP servers, or grounding systems.
- Files mounted into a worker, shell commands, package output, browser content, or other sandbox activity.
- Stateful objects such as threads, messages, runs, and memory summaries.
Retrieved material is commonly added to a prompt or otherwise supplied to a model endpoint for inference. Microsoft describes its Agent Service as augmenting prompts with retrieved information and sending them to the configured model endpoint under that model’s applicable terms. “Not used to train” therefore does not mean “not processed”: inference, safety review, logging, and feature storage can still occur.
#1 Best Overall
- Compatible Model(s): Magicmoon brand filter only for 24 inch -diagonally measured - widescreen monitor - aspect ratio 16:9 - filter size: width: 20 15/16", Height: 11 13/16" (531mm x 298mm)
- Superior Privacy: The computer privacy filter makes the screen appear dark when looking at it from an angle (the angle is about 30 to 60 degree), but bright when looking directly at it. To change the privacy level - simply adjust your monitor’s brightness accordingly
- Eye and Screen Protection: Privacy Filter does not only protect your private life but also protects your eyes by blocking 30% of blue light , blocking the harmful blue light between 380 to 495 nm, it filters out the blue light and relieves eye strain
- Perfect For Open Workspaces: Great for maintaining screen privacy in open work spaces
- Includes Two Options: Option 1 uses clear adhesive strips that securely attach to any computer screen. Option 2 (for computer screens with a raised bezel only) uses slide mount tabs that easily stick to the display frame, allowing you to slide the privacy screen filter on and off as needed
3. Persistence: what remains after a run
Storage is not one bucket. Separate copies may exist as abuse-monitoring logs, uploaded files, conversation records, tool outputs, session state, worker files, memory summaries, audit events, or customer-managed exports. Each can have a different owner, retention period, deletion mechanism, and geographic location.
4. Sharing and action: where data goes next
A tool call can transmit an input to a connected service and return its output to the agent. Publishing an agent to Microsoft 365 or Teams causes those services to process and store associated data under their own terms. Bing grounding, external model endpoints, cloud-hosted sandboxes, and customer-operated workers add further recipients. Returned information may also be written to a database, sent in an email, exported, or published if the agent has those action rights.
A practical data-flow map
- Input: the user supplies an instruction and conversational context.
- Authorized retrieval: the agent uses only the apps, files, APIs, search sources, and databases allowed by its configuration and credentials.
- Execution: an optional shell, filesystem, browser, package environment, mounted directory, or network connection lets it inspect or modify data outside the prompt.
- Inference: user-provided and retrieved content is sent to the configured model for processing.
- Persistence: sessions, logs, files, tool results, memory, and outputs follow separate lifecycle rules.
- Sharing or action: results return to the user or move to another tool, cloud service, database, or publishing surface.
Not every agent has every component. The map is a checklist for finding each boundary in the product you actually run.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- 【Privacy Filter Dimensions】- Width: 20 15/16" (532 mm), Height: 11 13/16" (299 mm), Diagonal: 24" (609.6 mm) - SightPro Blackout Privacy Screen Filter is engineered to be compatible with HP, Dell, Samsung, Lenovo, LG, Acer, ASUS, ViewSonic, and other monitor brands. Please verify your computer screen's width and height measurements before ordering. It's not recommended to make your selection based solely on your computer screen's diagonal size.
- 【Two Attachment Options】- Installs in minutes. Option 1 uses clear adhesive strips that securely attach to any computer screen. Option 2 (for computer screens with a raised bezel only) uses slide mount tabs that easily stick to the display frame, allowing you to slide the privacy screen filter on and off as needed.
- 【Superior Privacy and Anti Glare】- Our advanced multi-layered film filter blacks out your computer screen when viewing from the side, while maintaining a crystal clear screen straight-on. It also protects your eyes from harmful glare, UV, and blue light. [Note: It does not block visibility directly behind you, regardless of the distance.]
- 【Perfect for Travel and Open Workspaces】- Our computer screen privacy filter is the ideal solution for healthcare providers, mobile workers, commuters, students, and business travelers. Now you can stay compliant and safeguard sensitive corporate information while working in airplanes, subways, airports and public areas.
- 【Package Contents】- Each package includes one privacy screen shield filter, two sets of clear adhesive strips, two sets of slide mount tabs, and a microfiber cleaning cloth. Buy with confidence – located in the US, Sight Pro specializes in providing best-in-class privacy solutions to individuals, small businesses, corporations, government, and educational institutions. Our privacy screens are Section 889 and TAA compliant.
What major platforms document
OpenAI products
The Agents API is a managed harness with agents, tools, optional environments, durable sessions, events, and items. Sessions retain state so work can continue across turns; sessions and published artifacts can be deleted. Current documentation describes US-only data residency and says the Agents API does not support Zero Data Retention (ZDR). Running a self-hosted sandbox does not by itself make the managed API ZDR-eligible.
OpenAI’s API controls distinguish abuse-monitoring logs from feature application state. API data is not used to train or improve models unless a customer opts in. Abuse-monitoring logs may contain prompts, responses, and derived metadata and are retained for up to 30 days by default. Eligible customers can request Modified Abuse Monitoring or ZDR, subject to approval and feature limitations; under ZDR, some endpoint store behavior is forced off. These API rules do not automatically apply to consumer ChatGPT or every OpenAI service.
An OpenAI sandbox can provide an isolated Unix-like environment with files, a shell, packages, mounted data, exposed ports, snapshots, and controlled external-system access. Inject credentials at runtime through the hosting system rather than placing secrets in model instructions. The Agents SDK memory feature can inject a small summary at run start and progressively search prior work. Its workspace may contain session files, raw and consolidated memory, and summaries; live updates require filesystem capability, and separate layouts can isolate agents.
Rank #3
![[2 Pack] 24 Inch Computer Privacy Screen Filter for 16:9 Widescreen Monitor](https://m.media-amazon.com/images/I/41SBKw3J4ML._SL160_.jpg)
- 【24 PRIVACY FILTER DIMENSIONS】 Width: 20 15/16" (20.9 inches/532 mm), Height: 11 13/16" (11.8 inches/299 mm) - 16:9 Aspect Ratio. Mamol computer privacy filters are designed to be perfectly compatible with HP, Samsung, Dell, Lenovo, Acer, Asus, LG, ViewSonic and other brands of monitors. Please check the width and height dimensions of your computer screen before ordering. If you have any questions about the dimensions, please contact us.
- 【ENHANCED PRIVACY PROTECTION】Mamol 24 inch computer privacy filter keeps your electronic information confidential, making it excellent for use in high traffic areas. the computer privacy screen 24 inch is designed with advanced microlouver technology to block visibility at around 30 degrees and black out screens completely near 60 degrees.
- 【EYES PROTECTION】 This blackout privacy screen greatly reduces eye strain and minimizes potential hazards to vision. It filters 99.9% of UV rays and suppresses 98% of blue light. As a reversible 24-inch privacy screen filter: The glossy side of the protector provides extra clarity and greater privacy, and the matte side minimizes glare and distracting reflections. Satisfy your different daily uses as needed.
- 【BETTER HD CLARTIY】Mamol 24 inch computer privacy screen Shield adds an extra layer of AR Ultra HD light transmission compared to others. It maintains the high definition of the screen without sacrificing too much screen brightness. It won't reduce the brightness and cause eye fatigue because of the privacy screen installed on the screen.
- 【ANTI SCRATCH & WASHABLE 】Our privacy anti-glare Monitor film has a surface enhancement layer to protect the privacy filter from scratches and fingerprints. It is washable and reusable. Even after prolonged use, you will get a brand new privacy screen for your desktop computer monitor after cleaning. Very Durable!
For connected Google apps, access follows Google permissions and workspace settings. If Memory is enabled, eligible information may inform personalization. OpenAI’s connected-app FAQ says that connected-app data is not used to train generalized models except in described cases such as submitted feedback, manual copying or uploading, or content included in a response. That statement is scoped to connected-app data under that FAQ, not all data in every product.
Anthropic deployments
Anthropic’s API retention documentation applies to the Claude API and named deployments where Anthropic is the processor. Amazon Bedrock and Google Cloud’s Agent Platform use their cloud provider as processor, so the corresponding provider documentation governs those deployments.
Anthropic describes ZDR as an arrangement in which prompts and responses are not stored at rest after the API response returns, subject to feature eligibility and organization-level enablement. Other categories follow different schedules: Activity Feed data is retained six years; selected Compliance API data and local Cowork or Claude Code transcripts may also use six-year defaults; cloud remote-session transcripts are retained six years unless deleted sooner. Claude.ai chat, file, and project content follows the organization’s retention setting unless deleted earlier. These are product-specific examples checked in October 2026, not a universal Anthropic or industry rule.
Rank #4
- Privacy Screen Filter Size: If the visible area of your display has the following dimension: Width x Height (Exclude Frame/Arrow 1 to 3 mm errors): 20 15/16" x 11 13/16" (532 mm x 299 mm), then this filter is good for you. Very Important to double check your screen's Width and Height excluding frame before ordering. It's not recommended to make your selection based solely on your screen's diagonal size
- Left and Right Privacy: Not block visibility directly behind you, regardless of distance. The privacy filter makes the screen appear dark when looking at it from an angle (left and right 30 to 180 degree), but clear when looking directly at it. To change the privacy levels, simply adjust your monitor's brightness level accordingly
- Matte and Glossy Sides: It's a reversible privacy screen filter, giving you the flexibility to choose glossy or matte finish. The matte side will have less glare, however the glossy side will have stronger privacy
- Perfect for Open Workspaces: Ensure your working space is bright and well lit. Privacy screens do not work in dimly lit areas
- Two Installation Option: Option 1 uses clear double side adhesive strips that securely attach to any computer screen. Option 2 (for computer screens with a raised bezel only) uses slide mount tabs that easily stick to the display frame, allowing you to take out the privacy screen filter easily as needed
In a self-hosted managed-agent sandbox, content is outside Anthropic’s lifecycle controls after delivery to the worker. The customer must handle retention, redaction, deletion, leftover local memory copies, filesystem permissions, and isolation between sessions. Tools and MCP servers running there have worker permissions and can alter local copies.
Microsoft Foundry Agent Service
Microsoft identifies prompts and generated content, customer-uploaded data for File Search, Code Interpreter, and Azure AI Search, external tool outputs, stateful Threads, Messages and Runs, and augmented grounding data as processed data. MCP header data is available only for the current run and is not persisted. Publishing to Microsoft 365 or Teams gives those services their own processing and storage responsibilities. Check the configured model endpoint and each connected tool, not just the Agent Service label.
Recommended Free Tools
Memory and shared-agent systems
Memory is storage with permissions and staleness risks, not an abstract intelligence layer. It may contain conversation histories, knowledge-base entries, learned patterns, embeddings, intermediate reasoning states, raw files, and summaries. A later run or another agent can retrieve that material if its access policy allows.
Best Value
- 【PRIVACY FILTER DIMENSIONS】- Width: 23 9/16" (598 mm), Height: 13 1/4" (337 mm), Diagonal: 27" (685.8 mm) - Peslv Dark 27 inch Privacy Screen Filter is engineered to be compatible with 27in Dell, HP, Samsung, Lenovo, LG, Acer, ASUS, Toshiba, ViewSonic, Aoc, Sceptre, PHILIPS, ViewSonic and other brands monitors with 16:9 aspect ratio. Please verify your computer screen's width and height measurements before ordering. It is not recommended to select a size based solely on the diagonal.
- 【HIGH-CLASS PRIVACY ABLE】Peslv collected suggestions from more than 2000 computer users and performed 22188 anti-peep angle corrections on the micro-blind optical technology to ensure that any line of sight beyond +-30° facing the screen will be shielded. With a Peslv computer privacy screen 27 inch, Protect the privacy of your computer monitor screen and no longer leak any confidential data.
- 【2 MOUNTING OPTIONS FOR EASY INSTALLATION】The Peslv 27 inch privacy screen for monitor supply 2 installation options, Various installation options, are Compatible with both 27" computer monitors with raised bezels and full-screen 27" computer monitors without raised bezels, and convenient installation allows you to complete the installation in 10 seconds. NOTE: Monitors without raised bezels are only available with mounting option 2.
- 【EXCLUSIVE DOUBLE-SIDED TECHNOLOGY】27-inch monitor privacy filter has a double-sided surface technology developed by Peslv. Matte or Glossy. With the matte surface facing outward, you can experience the advanced AG anti-glare technology from Germany while maintaining a 30-degree privacy angle, softening the strong light outdoors, and making the screen content clearly visible. With the glossy side facing outward, you can get a super anti-peeping effect with a privacy angle of 26 degrees.
- 【PROTECT SCREEN ALSO EYES】Filtering optical materials imported from Japan can reduce 92% of blue light and 98% of UV light, and filter all harmful light emitted from the screen to protect your eyes. The high-transparent and reinforced built-in protective layer not only presents high-definition picture quality but also protects your screen from scratches. Hurry up and place an order, own a privacy screen for a computer monitor 27 inch, and protect your monitor screen and your eyes.
AWS guidance treats shared memory as partially trusted. Use least-privilege or read-only access where possible, validate and ground retrieved content, and place a deterministic gateway between agents and shared memory. That gateway can check integrity, enforce policy, and create an audit trail. In customer-managed workers, also delete temporary files and prevent one session from reading another’s directory.
How to compare two agents safely
| Question | What to verify |
|---|---|
| Reach | Apps, scopes, databases, files, web sources, APIs, and whether access is user-, service-account-, or admin-controlled. |
| Action rights | Read-only versus write, delete, send, export, or publish; approval gates for consequential actions. |
| Execution boundary | Shell, filesystem, mounted data, browser, network, MCP tools, isolation owner, and credential path. |
| Persistence | Retention and deletion for prompts, outputs, files, tool results, sessions, memory, and logs. |
| Training and controls | Whether content is used for model improvement, exceptions, ZDR eligibility, audit logs, revocation, and role-based app controls. |
| Recipients and geography | Model endpoint, cloud provider, connected service, publishing surface, subprocessors, and residency commitments. |
Controls that reduce exposure
- Grant the smallest app scopes and tool permissions that complete the task.
- Prefer read-only credentials; require human approval for sending, deleting, exporting, or publishing.
- Restrict filesystem mounts, shell commands, network destinations, packages, and browser access.
- Inject secrets at runtime and rotate them; never place credentials in prompts or memory.
- Define retention separately for provider logs, sessions, files, memory, worker disks, and exports.
- Review connected-service terms, model endpoint location, and downstream storage before enabling grounding or publishing.
- Audit memory reads and writes, validate shared-memory content, and isolate sessions.
- Test revocation: disable a tool or app and confirm the agent can no longer reach it.
Common misconceptions
- “Agents can see everything.” Only if configuration, credentials, and execution paths collectively grant that reach.
- “Agents see only the prompt.” Tools, mounted files, search, APIs, and state can add substantial context.
- “No training means no storage.” Training policy is separate from inference, abuse monitoring, feature state, and customer-side copies.
- “A self-hosted worker solves retention.” It can move lifecycle responsibility to the customer while leaving local copies, permissions, and backups to manage.
Frequently Asked Questions
How long does an AI agent keep my data?
There is no universal period. OpenAI documents up to 30 days by default for API abuse-monitoring logs, while Anthropic documents six-year defaults for selected transcript and compliance categories. Sessions, files, memory, and customer-managed workers can follow different rules.
Can an agent share data with another company?
Yes. Tool calls, model endpoints, grounding services, cloud platforms, and publishing surfaces may receive inputs or outputs. Check every configured recipient and its retention terms.
Does disabling training prevent an agent from storing data?
No. A no-training commitment addresses model improvement, not inference processing, safety logs, session state, memory, uploaded files, or customer-side storage.
The Bottom Line
To know what an AI agent can see, store, or share, inventory its permissions, tools, execution environment, persistence layers, and recipients. Control each boundary independently; the word “agent” alone tells you almost nothing about the actual data exposure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
