Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Anthropic Store Claude Computer Use Screenshots?
No: Anthropic's page places the screenshot in the customer's environment ("Captured and stored in your environment, not by Anthropic"), while the request carrying the image is retained under the API terms unless the account has zero data retention, and the image reaches the model on every request. Check where the harness writes the frame and how long it stays.
A developer points Claude at a payment page on a machine they run, and the model asks for a screenshot before it clicks. The frame shows the card number in its field, the cardholder name, the billing address and the order total. Whether that image is kept turns on three events: the capture, the write and the request to the model. Anthropic answers the middle question plainly, and the other two stay with the team that runs the tool.
The tool is a primitive rather than a hosted product. The developer supplies the environment, the loop that takes each screenshot and the disk the task writes to, so the vendor's storage sentence points at your own host. A zero-retention eligibility does not empty a working directory, and a trace store that captures every step does not care what the vendor retains. A team running an agent over payment pages ends up with frames in a scratch folder, a trace and a ticket, and the longest-lived copy is rarely the one a vendor describes. The hosted case is in Who Controls What an AI Agent Sees in a Hosted or Sandboxed Browser?, where the vendor runs the browser.
Key findings
- For a payment screenshot to be safe, the values on the page would have to be replaced with consistent tokens such as CARD_001 before capture, so the image holds a placeholder instead of the number (What Is Render-Layer Tokenization?).
- It would also require a named person approving the click that submits the payment and a record of what the model received on each screen, exported where the team can read it (What Is an AI Control Record?).
- Anthropic's computer use page does not state a path or a retention period for the environment-side copy, so retention splits between vendor and harness (Anthropic, Computer use, 2026).
- Anthropic's computer use documentation says the tool provides "screenshot capabilities and mouse/keyboard control for autonomous desktop interaction," so the frame exists because the model asked to look (Anthropic, Computer use, 2026).
- The same page warns that "In some circumstances, Claude follows commands found in content even when they conflict with your instructions," and tells developers to isolate the model from sensitive data (Anthropic, Computer use, 2026).
- A payment frame carries a card number, a cardholder name, a billing address and a total, and OWASP notes that "Personal identifiable information (PII) may be disclosed during interactions with the LLM" (OWASP, 2025).
What does the computer use tool capture, and what reaches the model?
Claude receives a screenshot, decides on a mouse or keyboard action, and the developer's application executes the action and takes the next frame. Anthropic lists the tool reference as "computer_toolset_20260801" and says "It isn't currently available in Claude Managed Agents," which places the loop in the developer's own application (Anthropic, Computer use, 2026). The documentation also tells developers to "Take precautions to isolate Claude from sensitive data and actions to avoid risks related to prompt injection" (Anthropic, Computer use, 2026). Indirect injection through page content has been demonstrated since 2023, with attacks that "enable adversaries to remotely (without a direct interface) exploit LLM-integrated applications" (Greshake et al., 2023).
On a payment page the frame is the page as drawn: the card field with its number, the cardholder name, the billing address, the order total and the submit button. The model receives the image, not a field list, so a value the page draws is in the model's context whether or not the markup hides it from a script. This page covers the rendered screen the tool captures, not the terminal, the IDE, the local filesystem, direct API calls or MCP.
If the renderer fills the card field from a store and draws CARD_001, the screenshot holds the token while the model reads the form and presses submit, and a measured comparison found that consistent pseudonyms with restoration cut semantic utility errors fivefold (Does Masking Data on Screen Break Browser Agents?).
Where does the screen capture live, and who can read it?
Anthropic's answer is a sentence about location: screenshots are "Captured and stored in your environment, not by Anthropic" (Anthropic, Computer use, 2026). The sentence settles the vendor's side and leaves the rest open: "your environment" is not one place. It is the working directory the harness chose for the run, the trace store that records every step and the image a person pastes into a chat to ask a colleague what went wrong.
The retention article that most teams find first does not cover this case. The privacy center page that carries the retention table covers consumer products only and sends commercial questions to a separate article, and says deleted conversations are "Deleted from our back-end storage systems within 30 days" (Anthropic, Privacy Center, 2026). Reading that sentence as the term for an API tool on a developer's host is a category error: the article describes a chat product's back end, and the frame in question was never there.
Who can read the frame is a question about the host. Anyone with an account on the machine, anyone with access to the trace store and anyone copied on the ticket can open it. A per-frame permission, an expiry and a delete control are not described in the pages reviewed, which leaves the copies to the same access rules as any other file the task writes.
What do the vendors themselves say?
The computer use page defines the tool by what the model gets: it "provides screenshot capabilities and mouse/keyboard control for autonomous desktop interaction" (Anthropic, Computer use, 2026).
The Claude Code security page describes a different boundary. It documents "Sandbox bash commands with filesystem and network isolation, reducing permission prompts while maintaining security," a control over the terminal that says nothing about a frame on the host (Anthropic, Security, 2026). It is explicit about the limit: "The boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can" (Anthropic, Security, 2026).
The engineering post records that "effective sandboxing requires both filesystem and network isolation" and that sandboxing "safely reduces permission prompts by 84%" (Anthropic Engineering, 2025). The browser extension differs: Does Claude in Chrome Use Your Saved Logins and Open Sessions? summarizes its help center pages, and Is Claude in Chrome Safe to Use for Work? applies them to work accounts.
| Dimension | Anthropic, per its documentation | What a buyer should verify |
|---|---|---|
| What the model receives | The tool "provides screenshot capabilities and mouse/keyboard control" | Whether the harness sends one frame or every frame in the run |
| Terminal controls | Bash sandboxing with filesystem and network isolation, documented for Claude Code, a different product | That no one reads a terminal control as covering a frame |
What does the retention statement cover, and what does it leave out?
Anthropic's page says the tool is eligible for zero data retention, an eligibility a buyer should confirm for its own plan before treating it as the term that applies (Anthropic, Computer use, 2026). Eligibility is the operative word. A vendor can make a product eligible for a retention regime without every account, region or contract sitting inside it, so the sentence answers a question about the product and not yet about your organization.
What the statement covers is storage by Anthropic. What it leaves out is every copy the harness makes, the trace the team exports, the frames a debugging session keeps and the screenshot pasted into a ticket. Those copies sit inside the organization's retention schedule, and a schedule written for documents and chat logs may never have been applied to a folder of images.
The practical result is a short list of questions for the account team: which data the term covers, where the frames go, how long they stay, what deletion looks like and which subcontractors touch them. Does My AI Vendor See the API Keys My Coding Agent Reads? works through the same discipline for credentials: anything in the request is sent for the request, and the retention term governs the copy rather than the transmission.
Who approves the click that submits the payment?
The tool clicks and types, and the documentation reviewed describes no approval step inside the tool. Approval before a payment is documented for a minority of the agents reviewed: 6 of the 15 describe asking a person before completing a payment or purchase, and Claude Computer Use is not among them, because its approval step is the developer's to write (Do AI Agents Ask Before Making a Payment?). The computer use documentation describes isolation instead, which puts the approval in the harness the developer writes. That is a real place for it, and it is also where an approval becomes a queue of frames that a person waves through.
The research on that failure is old and specific. A systematic review of automation bias found the tendency "has been studied in various academic fields," which is why an approval step has to show the person the frame, the amount and the destination (Goddard et al., 2012). An approval that shows a timestamp and a task name asks the person to trust the agent's summary of a screen they cannot see.
The record side has a pattern to borrow. A Scientific Reports paper on governed tool use requires that "each governed action carries a typed Action Certificate that a planner-independent checker must accept before execution," a check that can sit outside the model, though its evidence is a small test battery and it assumes the tool contract is authoritative (Kadyrbek et al., 2026). AWS's guidance says "audit logs attribute every action unambiguously to either an agent or a human actor," the property a payment approval record needs (AWS, 2026). A run that cannot name the person who approved a frame does not have that property.
What does a governed environment change?
It changes what the frame contains, not whether a frame exists. On a rendered page, the values a policy names are replaced with consistent tokens such as CARD_001 before the screen is captured, so a screenshot of a payment page shows a placeholder where the number sits while the model still reads the form and the submit button (What Is Render-Layer Tokenization?).
The second change is where a real value resolves. It resolves at an approved destination, at the moment of an approved action, so the card number reaches the processor's payment form and not the trace, the ticket or the next frame. A named person approves each payment or record change, and the approval carries a name, a time and the frame the person saw.
The third change is the record. Every screen the model read, every action and every approval is exported to the organization's own monitoring, so a retention schedule can be applied to something specific and an auditor can compare the model's view with the bank's logs. Enterprise Browser or Render-Layer Tokenization? works through what separates a browser control from an enterprise browser. None of this stops the agent taking a screenshot; it decides what the screenshot is worth to whoever finds it.
What the record shows
Whether a screenshot is kept is a question about a rendered frame and the host that captured it. Anthropic's page places the image in the developer's environment and makes request retention an eligibility, leaving the copy, the trace and the ticket to the team that runs it (Anthropic, Computer use, 2026). No vendor control governs what the frame contains: the sandbox governs commands and the retention term governs Anthropic's copy. That leaves one test. Take one payment task, list every path the harness wrote, then open one frame and compare the card field with the string the model received. If both hold the number, the frame is the record and the token is missing.
Methodology and limitations
The page rests on Anthropic's computer use tool documentation, its Claude Code security page and sandboxing write-up, its privacy center retention article, one OWASP entry, AWS guidance, a peer-reviewed review of automation bias, a Scientific Reports paper and a 2023 preprint on indirect prompt injection. Vendor pages were read between October 20, 2026 and October 22, 2026. Public documentation read in full gives a sound view of where each product applies its control.
No product named here was tested for this page. A statement that a page does not cover something means the pages reviewed do not state it, not that the capability is absent; features change and the page carries its date. The payment page example describes a record type, not an organization. Compliance determinations belong to the organization's counsel, and nothing here replaces a pilot of one workflow on its own screens.
Frequently asked questions
Does Anthropic keep the screen that Claude computer use captures?
No: Anthropic's computer use page says screenshots are "Captured and stored in your environment, not by Anthropic," and the tool is eligible for zero data retention (Anthropic, Computer use, 2026). That covers the vendor's copy and the request. It does not cover the frame your harness writes, the trace it exports or the image in a ticket, so the storage question ends where your own environment begins.
Where does the captured screen go if Anthropic does not store it?
Into your own environment, wherever the application that runs the loop writes it. That can be the working directory, a temporary folder, a trace store built for debugging, a test artifact or a ticket. The documentation reviewed describes no default path and no expiry for those copies. Name the directory and the trace store in the retention schedule, then delete both on the task's own schedule.
Does zero data retention mean the model never sees the screenshot?
No. Retention and transmission are different questions. The frame is sent to the model on the request that asks for the next action, and the retention term describes what the vendor keeps afterwards rather than what the model reads during the run. A screenshot can reach the model without being stored by the vendor, and a copy can still sit on your side.
Who approves a payment submission that the agent clicks?
The person your harness puts in front of it. The documentation reviewed describes no approval step inside the tool, and recommends isolating the model from sensitive data and actions instead. That leaves approval to the application that runs the loop, which should show the approver the frame, the amount and the payee. A queue that shows only a task name and a timestamp asks for trust rather than a decision.
What does the model receive from a payment page screen?
The model receives the image the tool captured, because the documentation defines the tool by its "screenshot capabilities and mouse/keyboard control for autonomous desktop interaction" (Anthropic, Computer use, 2026). The frame includes the card number, the cardholder name, the billing address and the total. A field hidden from a script but drawn on the screen is still in the image, which is why substitution has to happen before capture, not after.
What should a team ask for in writing before running an agent on payment pages?
Five things: where each frame is written and for how long, whether the request is covered by a zero-retention term for your plan, what the model receives from the screen, which named person approves a submission, and where the record of screens and approvals is exported. Ask for the answer as a sentence the vendor will stand behind, then test it on one task with test card values.
How RedactSure Keeps a Payment Screenshot From Holding the Card Number
A payment screenshot keeps every value the page drew, and a control that governs clicks cannot change what the frame already holds. Anthropic's page puts the frame in your environment, so the copy is yours to govern.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opened the payment page and the model received the full frame with the card number, the name, the total and the button, and the harness wrote it to disk. Inside the governed environment, the page renders with CARD_001, a named person approves the submission, and the real number resolves only at the processor's form at the moment of that approval. The model still reads the form and presses submit.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
One payment task shows whether the frame your host keeps carries the card number or a token, and who signed off. Bring that task and see, with test values, what the model reads and where the real value lands. Book a demo