Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Claude in Chrome Keep a Record of What It Did?
Anthropic keeps the record in the conversation: screenshots of the active tab become part of it, and the side panel session is saved to your history. A team that needs evidence should ask who can export that record, how long it is kept, and what the model received on each screen.
An auditor asks which pages the agent read during a payment run, and the answer has to come from something the organization can produce months later. Claude in Chrome runs as an extension that reads the active tab and acts on it, so the pages it opened are pages the model saw, and the first place to look for them is the conversation the extension runs in. Anthropic's help center is explicit about that part: the model receives screenshots of the active tab, and whatever is visible in that tab becomes part of the conversation (Anthropic, Safely, 2026). The result is a record of a kind, and it is the record a person would scroll through to reconstruct a run. It is not the same object as an audit log that names each page and each action, records who approved each one, keeps them for a stated period and hands them to someone who was not in the session. The distance between those two objects is what the title question turns on, and it is the distance a security team has to close in writing before an agent touches a payment run. That work starts with the four questions an auditor will ask.
Key findings
- For Claude in Chrome to answer an auditor on its own, the values on each rendered page would have to be replaced with consistent tokens before the model reads the screen, so the record holds ACCT_001 and the real values resolve only at the approved destination (What Is an AI Control Record?).
- It would also require a named person approving each payment, submission and record change, with that approval written into the same record (What Is Supervised Delegation?).
- Anthropic's pages describe the conversation as the place the screenshots are kept and do not describe a separate audit log, an export, or an administrator's view of another user's session (Anthropic, Safely, 2026).
- Anthropic's help center states that "Claude takes screenshots of your active browser tab to understand webpage content" and that "Whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation" (Anthropic, Safely, 2026).
- The same help center says side panel sessions are saved to your history, and the getting-started page describes a panel that "sees what's on the page and can act on it," with "Automatically approve" as the default (Anthropic, Safely, 2026; Anthropic, Get started, 2026).
- AWS's Well-Architected guidance sets the test: "audit logs attribute every action unambiguously to either an agent or a human actor," which a chat transcript does not meet (AWS, 2026).
What does Claude in Chrome record from a run?
The record is the conversation. Anthropic's pages describe no separate history screen for the extension: the side panel is a Claude conversation, and the session is saved with the rest of them (Anthropic, Safely, 2026). The model takes "screenshots of your active browser tab to understand webpage content," and whatever is visible in one of those tabs "is captured in the screenshots and becomes part of the conversation" (Anthropic, Safely, 2026). It answers what the model saw, at the moment it saw it, better than a list of addresses would. One of the 15 AI agents reviewed documents asking a person by default before every consequential action, and five document a per-action record an administrator can export (Do AI Agents Ask Before Making a Payment?).
It does not answer what the agent did. The extension acts on the page, since "Claude sees what's on the page and can act on it" (Anthropic, Get started, 2026). Anthropic describes action confirmations for certain high-risk actions, such as downloading a file or entering sensitive information, and a permission prompt before financial sites (Anthropic, Safely, 2026). Those are controls on the action, not entries in a log, and the pages reviewed give them no timestamp, page address or name.
| What a run leaves behind | What Anthropic documents | What an auditor can do with it |
|---|---|---|
| Screenshot of the active tab | Visible content "becomes part of the conversation" | Confirm what the model saw, if the conversation is produced |
| The conversation | Side panel sessions are saved to your history | Read the run as a narrative |
| Action confirmations | A prompt for certain high-risk actions | Show a prompt appeared, not who answered |
| A record for an administrator | Not described in the pages reviewed | Nothing, unless the organization keeps its own |
Who can read that record, and who can export it?
The record sits in the account of the person who ran the session. Anthropic's pages describe the user's own history, the sites the extension may visit and the actions that pause; an administrator's view of another person's session, an export file and a retention period are not part of that description (Anthropic, Safely, 2026). The evidence belongs to the employee, not the employer, and if that person leaves, the conversation goes with the account.
What makes a record institutional is a question the education sector settled long before agents arrived. The Department of Education defines an education record as information "directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of" one (U.S. Department of Education, 2026). The same FAQ adds that "The information may be recorded in any way, including, but not limited to, handwriting, print, computer media," so format does not settle it either (U.S. Department of Education, 2026). As a test rather than a rule, a chat history maintained by the person who ran the session is a personal artifact; an institution holds a record only when it maintains one.
A stored screenshot raises the same question from the other side, because a record that keeps the values is a liability as well as evidence (What Happened to the Screenshots ChatGPT Agent Kept in Your Chat History?); the one vendor here with an audit trail leaves the employer's access unstated (What Are the Risks of Using Meta Muse for Work?).
What do the vendors themselves say?
Anthropic describes a capable reader with a narrow set of brakes. The extension "sees what's on the page and can act on it," and the side panel defaults to "Automatically approve," pausing when a step needs the person; neither the mode nor the pause is a record (Anthropic, Get started, 2026). The safety page adds the reading side: screenshots of the active tab, a blocked list of sensitive and high-risk sites, and a permission prompt before financial sites, none of which lists the pages the model read (Anthropic, Safely, 2026). Those are real controls, and none of them is a record of the run.
AWS states the requirement an audit log has to meet: "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). A conversation in which a person typed a request and the model acted does not separate the two actors that way, and the confirmation prompts sit in that thread without a name attached.
| Dimension | Anthropic, per its documentation | What a buyer should verify |
|---|---|---|
| What the model receives | Screenshots of the active tab; visible content joins the conversation | Whether values on a payment page reach the model as values |
| Default action mode | "Automatically approve," pausing when needed | Which actions pause, and whether the pause is recorded |
| Record of the run | The conversation, saved to your history | Export format, retention and admin access |
What should a security team ask for in writing, and why is a click not enough?
Put four questions to the vendor before the run: which pages did the agent open, and in what order; what values did it see on the payment page; who approved each action, by name; and where the record is kept, for how long and who can export it. Anthropic's pages answer the first through the conversation and the second by implication, since the screenshot shows what was visible. They do not answer the third or the fourth (Anthropic, Safely, 2026). Ask what the model received from the rendered payment screen, not only which sites it may visit.
Page-level attribution matters because the payment page can sit in two places. The PCI Security Standards Council's FAQ on scripts says its criterion "only applies to e-commerce merchants with a webpage that includes a TPSP's/payment processor's embedded payment page/form," and it does not apply when the merchant redirects the customer (PCI Security Standards Council, 2025). An embedded form and a redirect leave different traces, so the architecture decides which page the agent read. AgentDAM gives the reason to press: web agents "are prone to inadvertent use of unnecessary sensitive information" (Zharmagambetov et al., 2025).
A confirmation prompt answers none of the four: it records that the software stopped, not that a person read the screen and approved the amount. Automation bias research explains why: it describes "the tendency to over-rely on automation," a tendency that has been studied across academic fields (Goddard et al., 2012). Anthropic's prompt injection guidance still assumes the person is the last check: "Claude may interpret these malicious instructions as legitimate requests from you" (Anthropic, Safely, 2026). A record of what that person saw and when they answered would let an investigator test that claim; the pages do not describe one.
Saved logins belong on that list too: in a profile signed in to work applications, the pages the agent can read include the ones behind those sessions (Does Claude in Chrome Use Your Saved Logins and Open Sessions?), and the safe-for-work review reaches that point from the other direction (Is Claude in Chrome Safe to Use for Work?).
What does a governed environment change?
Four properties turn a session into evidence, and each belongs to the environment rather than the chat. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.The first is substitution at the render layer: values on a page are replaced with consistent tokens before any model reads the screen, so the agent works with ACCT_001 and VEND_002 for the whole run and the record holds tokens rather than account numbers. The second is restoration at an approved destination: real values resolve only at the destination the policy names, at the moment of an approved action, so the payment reaches the payee on file and the model never holds the number it submits. The third is approval by a named person for each payment, submission and record change, written into the record with a time. The fourth is export: every screen the agent saw, every action and every approval lands in a record the customer keeps and can send to its own monitoring.
Those properties answer the auditor's questions: the page list comes from the record of screens, the token map settles the values, the approver is a field, and retention is the customer's decision. A successful injection also collects less, because the context holds tokens for the covered fields. Anthropic's stress test, which found that "In at least some cases, models from all developers resorted to malicious insider behaviors" while noting it has "not seen evidence of agentic misalignment in real deployments," is the reason to keep the record before anyone needs it (Anthropic, 2025). The two designs on the same record are compared in RedactSure vs Claude in Chrome: 2026 Comparison & Alternative.
What the record shows
Four things make an agent's work evident: what the model was shown on the screen, the action it took, the person who approved it, and a record the organization keeps and can export. Claude in Chrome supplies the first as a screenshot inside the conversation and describes the second as a prompt rather than an entry, and it leaves the fourth to the account holder. The answer is therefore qualified: a record exists, and it is not the record an auditor asks for. Security teams should test this on one payment: run it in a test account with the extension, then ask the person who ran it for the list of pages the agent opened, the values it saw on the payment page and the name of the approver. Compare what arrives with the four items above, and the missing items are the work.
Methodology and limitations
The page rests on Anthropic's Claude in Chrome help pages, the AWS Well-Architected Agentic AI Lens, the U.S. Department of Education's FAQ on education records, PCI SSC FAQ 1588, one peer-reviewed systematic review, one peer-reviewed evaluation of web agents and one vendor research report, all read between October 21, 2026 and October 22, 2026. Public documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested hands-on. "Not described" means the pages reviewed do not address the point, not that a feature is absent, and vendor features change, so the page carries the date of the reading. RedactSure is deploying now with enterprise and government customers, and the example describes a record type, a payment run, rather than an organization. Determinations about records, retention and disclosure belong to the organization's counsel, its assessors and its security and compliance officers, and nothing replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does Claude in Chrome keep a log of every page it opened?
No. The record is the conversation: screenshots of the active tab become part of it, and the side panel session is saved to your history. That shows the pages the model saw, in order, but it is not a page-by-page log with addresses, times and actions, and no export of one is described. A team that needs a page list should produce it from the conversation or its own monitoring.
Where is that record stored, and how long does it last?
In the account of the person who ran the session, with the rest of that person's Claude history. The help center says side panel sessions are saved to your history but states no retention period, no export format and nothing about account changes. Those terms belong in the contract or in admin settings, and they are worth settling before the first payment run.
Can an administrator read or export the agent's session?
Not from the pages reviewed. Anthropic's pages describe the user's own history and the controls on what the extension may visit and do. An administrator's view of another person's session, and an export of the run, are not described, which leaves the record with the individual. For work that needs an institutional record, the organization has to decide whether that is acceptable or supply its own.
Does the approval prompt create evidence that a person reviewed the action?
Only that a prompt appeared. Claude in Chrome asks for confirmation before certain actions, such as downloading a file or entering sensitive information, and the side panel defaults to "Automatically approve," pausing when needed. The prompt shows the software stopped. It does not record who answered, what they saw or how long they looked, and automation bias research is why those details matter.
What should an auditor ask for after a payment run?
Four things: the pages the agent opened, the values it saw on the payment page, the name of the person who approved each action, and the place the record is kept. None of the first three is a page field in the documentation, and the fourth depends on the account. Ask for them in writing before the run, then compare the answer with the payment system's own log, which records the transfer independently of anything the extension kept, and note which of the four arrived.
Does a separate browser profile keep the record separate?
No. A separate profile separates the cookies and sessions the agent uses. It does not create a record the organization can export, and the conversation still lives with the account that ran it. Anthropic recommends a profile for other reasons, which concern the signed-in applications the agent can reach. Treat the profile as a boundary on where the agent goes, not as a record-keeping control, and check what the account keeps.
How RedactSure Keeps a Payment Run's Pages in a Record an Auditor Can Read
An auditor's question about a payment run cannot be answered from a chat transcript that lives in one employee's account and leaves when that employee does. Anthropic's page says whatever is visible "becomes part of the conversation," so the chat is the only record of it.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the extension reads the rendered payment page, the account number enters the model's context, and the only trace is the employee's chat. Inside, the page renders with ACCT_001 and VEND_002, the model works with those tokens, real values resolve at the approved destination, and a named approver releases the payment. The record holds what the model was shown, the action and approver.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
One payment run shows whether the record an auditor needs exists at all. Bring one payment from your workflow and see, with test values, the rendered page, the approval and the record. Book a demo