Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Menlo MARS Secure Claude Code and Gemini in Chrome?
No: the model receives the values the page renders, because MARS cleans the page rather than replacing what it carries, and Claude Code's terminal sits outside the product. Check which of an agent's requests pass through the Menlo Cloud, then what the model is shown on the page that arrives.
No, and the reason sits in what the page hands the model rather than in what the vendor does with the session. A browser security platform can clean a page in its own cloud, mask the fields its classifier recognizes and watch the session live, and what reaches the model is still the page's own account number, its own customer name and the rest of what it displayed. The run then moves to a shell, a file read or an MCP server, where no browser control sits. Menlo Security's release puts MARS in front of what agents read on the web, and the two products in the title reach that boundary differently: Gemini in Chrome is a browser agent, while Claude Code is a coding agent whose browser work is one part of its run. A security team asked to approve such an agent on real work, with a customer's account number and a support ticket on the same screen, has three things to settle: which requests pass through the Menlo Cloud, what the model receives on the pages that do, and what record survives the run. One record type makes the answers concrete, a documentation page a coding agent fetches mid-task.
Key findings
- For MARS to settle the question, the values on a page would have to be replaced with consistent tokens before any model reads it, so a sample account number arrives as ACCT_001 and stays that way for the run (Can a Coding Agent Use a Credential It Cannot Read?).
- It would also require a named person approving each consequential action and a record of what the model received on every screen, kept where the customer's monitoring reads it (What Is an AI Control Record?).
- Menlo's release describes cleaning, masking, site control, logs and takeover; it does not state that the values on a page are replaced before a model reads them, and it describes no coverage of a coding agent's terminal (Menlo Security, MARS, 2026).
- Menlo calls MARS "the first Browser Security Platform to strip prompt injection and hidden instructions out of what agents read," a first it asserts for its own product and backs with a Black Hat demonstration (Menlo Security, MARS, 2026).
- Security teams get per-agent logs and "the ability to take over live agent browser sessions," and the release does not say what an entry in those logs contains (Menlo Security, MARS, 2026).
- Google labels the agent mode "an experimental feature" and assigns the result to the user: "You're responsible for Gemini's actions during a task, including mistakes and unexpected results like purchases" (Google, 2026).
What does MARS sit in front of when Claude Code reads a page?
MARS is Menlo's browser security platform, and the control point its release describes is a cloud browser in front of agent web activity, not the agent's tools. Its headline names Copilot, Gemini in Chrome and Claude Code as the assistants and coding agents it extends to, which is a claim about supported products rather than about how each one is reached (Menlo Security, MARS, 2026). The agent drives a session Menlo serves, and the page it receives is the one the cloud cleaned.
The release says MARS "provides token-based authentication for the agents driving secure browser sessions" and that, through Menlo AI Adaptive DLP, it masks sensitive information and controls which sites each agent may reach, controls on the session and the site rather than on the value a page shows (Menlo Security, MARS, 2026). Each governs where the agent goes and what the page carries, and none changes the text the model receives once the page is served.
For Gemini in Chrome the boundary and the product line up: the agent is browsing, and the page it works on is the one the cloud served. For Claude Code the pairing is looser. The release names it as a coding agent MARS extends to, and the part of its run that can pass through a browser session is the part a browser platform can see. The rest is the shell, the file reads and the MCP servers, where a browser control has no session.
What does the model receive when Claude Code opens a documentation page?
The record type is a documentation page. A coding agent working a support ticket opens a payment API's reference page, and the page carries a code sample with a customer's account number and a comment in the markup that tells the reader to send the sample to an address outside the run. Without a cleaning step the model receives the sample and the hidden instruction, and the account number stays in its context.
Inside MARS the fetch arrives from the Menlo Cloud: the release says MARS "runs that web activity in the Menlo Cloud and cleans the pages and files, including downloads and uploads, before the agent sees them," so the cleaning sits on the route to the agent, not inside its process (Menlo Security, MARS, 2026). The account number is a different question: masking withholds a value the DLP policy recognizes, and the release describes no consistent placeholder the agent can type into a later form and no step that resolves a real value at a destination.
What the model holds is a cleaned page, with a masked field or a rendered one depending on the policy. The record that answers is the one (Does Gemini in Chrome Keep a Record of What It Did?) describes for a browser agent: what the model saw, screen by screen, with the fields as tokens.
What do the vendors themselves say?
The release Menlo published on August 5, 2026 is an announcement with a demonstration attached rather than a test, so what it establishes is the design: a cloud browser, cleaning before the agent reads, masking through Adaptive DLP, site reach, logs and takeover.
Google's help page says that with auto browse a user can "ask Gemini in Chrome to complete multi-step tasks for you on the web," and its examples are comparing products, booking travel and making reservations, consumer tasks rather than the screens a work account carries (Google, 2026).
Neither page describes a step that replaces a value on a page with a token before the model reads it. Menlo is the one product in the 86-product review whose public pages describe masking what an agent reads from web content, and its public documentation does not describe tokens the agent can work with in place of the values it reads on a screen (How Many AI Security Products Control What an AI Agent Sees?). The table sets out the Menlo statements a buyer will want to test.
| Dimension | Menlo Security, per its documentation | What a buyer should verify |
|---|---|---|
| Where the control sits | "runs that web activity in the Menlo Cloud" and cleans pages and files before the agent sees them (Menlo Security, MARS, 2026) | Which of an agent's requests actually pass through the cloud |
| What the model receives | A cleaned page, with sensitive information masked through Menlo AI Adaptive DLP (Menlo Security, MARS, 2026) | Whether a field the agent must use is masked, tokenized or read as rendered |
| The record | Per-agent logs and "the ability to take over live agent browser sessions" (Menlo Security, MARS, 2026) | What a log entry holds, and whether it shows the page the model read |
Does MARS cover what Claude Code reads outside the browser?
Anthropic's sandboxing page states that the sandbox covers shell commands only, and that Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks run outside it, so the file tools and the page fetches a coding agent uses are not sandboxed (Anthropic, 2026).
Routes into the model sit outside a page-level control: a file read returns a customer record, an MCP server what it chooses, and WebFetch a page with no browser session to clean. The page is explicit that "A denyRead entry doesn't stop the Read tool," because Read, Edit and Write "follow permission rules instead" (Anthropic, 2026).
A registry measurement of "98,380 skills collected from two major registries" confirmed malicious behavior in 157 skills, and its two dominant strategies were "credential theft via remote code execution, and agent manipulation through adversarial instructions embedded in documentation" (USENIX Association, 2026). The 157 cases are 0.16 percent of two sampled registries, not a prevalence rate, and the useful lesson is that a documentation page is a delivery route for an instruction.
A team that wants the terminal covered configures it there, and (How Do I Keep API Keys Out of Claude Code's Context Window?) walks through those settings.
What record does MARS leave, and what does the obligation require?
Security teams get per-agent logs and "the ability to take over live agent browser sessions," and the release does not say what an entry in those logs contains (Menlo Security, MARS, 2026).
A Hugging Face position paper argues that "fully autonomous AI agents should not be developed," which puts the burden on the record of what an agent did (Mitchell et al., 2025).
For a covered financial firm the record is an obligation: a firm must keep "written policies and procedures for an incident response program" for unauthorized access to customer information, with notice due within 30 days of awareness (SEC, 2024).
The Department of Education's letter sets the frame for schools: "In general, student information may only be disclosed to an online educational service company in compliance with FERPA," and the letter does not mention AI (U.S. Department of Education, 2026). The PCI Council's FAQ on scripts draws its line by page type: the criterion "only applies to e-commerce merchants with a webpage that includes a TPSP's/payment processor's embedded payment page/form" and not to a merchant page that redirects the customer (PCI Security Standards Council, 2025).
The approval side is set out in (What Is Supervised Delegation?), and the review before a team signs in (How Do I Get Security to Approve Autonomous Coding Agents?).
What does a governed environment change?
A governed environment is a control class that acts where a screen is rendered, before any model reads it. Values a policy names are replaced with consistent tokens for the run, so the model works with ACCT_001 and the same token follows the value across pages. Real values resolve only at approved destinations, at the moment of an approved action. A named person approves each payment, submission and record change, and every screen as tokens, every action and every approval lands in a record that exports to the customer's monitoring.
On this page's question the class changes two things. The page a coding agent fetches renders with a token where the account number sat, so an instruction hidden in that page collects a token. The run's shell, file reads and MCP servers stay outside it, and a team that wants those covered governs them with the agent's permission rules.
Nothing in the class depends on a vendor's filter recognizing an instruction, so it holds on a page the filter has never seen. OpenAI's governance paper calls human approval "a standard way to limit egregious failures" and asks that at least one human entity be accountable for every uncompensated direct harm (Shavit et al., 2023), the standard the class meets. The two designs are compared on this vendor in (RedactSure vs Menlo Security: 2026 Comparison & Alternative).
What the record shows
What the model receives on a rendered page decides the answer, and the page a coding agent fetches is rendered before the model reads it. A cleaning step in front of the page removes an instruction the filter recognizes; a substitution at the render layer replaces the value itself, so a hidden instruction can only collect a token. Menlo's coverage is the web session its cloud serves, with masking, site reach, logs and takeover on top, and none of those reaches the shell, the file reads or the MCP servers where a coding agent spends the rest of its run. The check: run one documentation page your agent reads on a real ticket with test values, then write down what the model held, which fields were masked rather than substituted, and who approved the next action.
Methodology and limitations
This page rests on Menlo Security's release for MARS, the two vendors' documentation for the products in the title, a USENIX Security registry measurement, a Hugging Face position paper, an OpenAI whitepaper, an SEC release, a Department of Education letter, a PCI Council FAQ and existing RedactSure research pages. Vendor pages were read between October 20, 2026 and October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
None of the products was tested for this page, and "not described" means the pages reviewed rather than a claim about every deployment. Vendor features change, so a release after October 22, 2026 is unreviewed until the check is repeated. The example describes a record type, not an organization; statements about RedactSure describe its design, and RedactSure is deploying now with enterprise and government customers.
Contractual, regulatory or FERPA determinations belong to counsel, assessors and the organization's compliance officers; nothing replaces a pilot on the organization's own screens.
Frequently asked questions
Does Menlo MARS secure Claude Code and Gemini in Chrome?
No, not on the point that decides exposure. MARS cleans the pages an agent reads in the Menlo Cloud, masks what its DLP policy recognizes, controls which sites the agent may reach and lets a team take over a session. The model still receives the values the page renders, and Claude Code's terminal, file reads and MCP servers sit outside a browser platform. Coverage is the web half.
What does the model receive when Claude Code opens a page through MARS?
The page after cleaning. Menlo's release says its cloud cleans pages and files before the agent sees them, which removes the hidden instructions the filter recognizes. It describes masking through Adaptive DLP and no consistent placeholder in place of a masked value, so a field the policy does not classify arrives as the page renders it. The model works on that text, and whatever the page said about the account number stays in its context.
Does MARS cover Claude Code's terminal or its file reads?
No. Anthropic's documentation places the sandbox on shell commands and puts Read, Edit, Write, WebFetch, WebSearch, MCP servers and hooks outside it. A browser platform mediates a browser session, and none of those routes opens one, so a file read, an MCP response or a WebFetch of a documentation page arrives without passing through the cloud. The release describes no path that would put them there.
What record does MARS leave of what an agent read?
Per-agent logs and a live session a security team can take over. The release does not say what a log entry holds, so a buyer cannot tell whether it records the page the model held, which fields were masked, or what the agent did after it left the browser. Those are the three things an auditor asks for, and a takeover answers only one of them.
Is masking sensitive information the same as tokenizing it?
No. Masking withholds a value that the policy recognizes, while a token replaces that value with a consistent placeholder the agent can use and resolves it later at an approved destination. The release describes masking through Adaptive DLP and no restore step, so a masked field can stop an agent that has to submit the number. Which of the two a workflow needs depends on whether the agent must use the value or only avoid seeing it.
What would a security team ask for before approving this setup?
Where each request goes: which fetches run through the Menlo Cloud and which leave from the host. What the model receives on a page the cloud serves, field by field, and whether a value it must use is tokenized rather than masked. Who approves a payment, a submission or a record change, and what the exported record shows. Then one workflow, run with test values, compared against what actually rendered.
How RedactSure Keeps the Values on a Fetched Page Out of the Model
A cleaning step removes hidden instructions and leaves the account number the page renders, while the shell running the agent sits outside it.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the fetch arrives with the sample's account number in the code block and the model carries it into later steps. Inside the governed environment: the page renders with ACCT_001, the model reads tokens for the rest of the run, and the real number resolves only at the payment destination a person approved.
RedactSure is deploying now with enterprise and government customers. Menlo's release says its cloud cleans the pages and files before the agent reads them.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A page an agent fetches is the first thing a reviewer will ask about. Bring one documentation page your agent reads and see, with test values, the page as the model receives it, the approval and the record. Book a demo