Menlo Security says it has extended Menlo Agent Runtime Security, or MARS, to cover browser-based AI assistants and coding agents including Microsoft Copilot, Gemini in Chrome, Claude Code, and Claude Cowork. For Windows administrators, the practical promise is straightforward: route what an agent reads and where it can send data through a separate security control point, instead of trusting the agent’s own guardrails to distinguish a webpage, pull request, SharePoint document, or browser tab from an instruction.
The announcement, carried by AiThority, frames MARS as a cloud runtime that sanitizes pages and files before an agent processes them, masks sensitive data, applies per-agent rules, records sessions, and lets an administrator intervene in a live session. Menlo first announced the underlying MARS platform on March 18, 2026, so this is an expansion of an existing product rather than a new runtime.
The material issue is that the expansion arrives while AI assistants are gaining access to the same browser sessions, source repositories, cloud files, and authenticated web applications that security teams have spent years trying to protect. Menlo’s approach is to put a browser-security proxy and isolated cloud browser between an agent and those resources. That can reduce exposure, but it also means deployment quality—not the marketing claim that prompts are “stripped”—will decide whether it provides meaningful protection.
Menlo describes MARS as a platform that executes agent browser sessions in remote, disposable cloud containers. Its technical white paper says it can interpose on three paths: normal HTTP traffic, browser automation, and LLM API requests. An agent that already uses a browser or HTTP client can be configured to use Menlo as a cloud proxy; an agent without a browser tool can instead use Menlo’s MCP server and cloud browser through Chrome DevTools Protocol or higher-level browser-automation interfaces.
That architecture matters more than the brand names in the announcement. The service can only inspect and govern traffic it actually receives. If a Claude Code installation, GitHub workflow, Copilot session, browser extension, direct API client, local tool, or unmanaged endpoint reaches data outside the configured proxy, tunnel, MCP server, or supported browser route, MARS is not in that path.
Menlo says it removes hidden instructions, malicious scripts, steganographic content, and dangerous document elements before the agent sees them. The company’s public materials specifically describe document sanitization through content disarm and reconstruction, or CDR, plus “invisible content removal” and shadow-model scanning. Its public product page also says the platform can redact sensitive information before an agent processes a page or file.
Those are sensible layers, particularly for attackers hiding instructions in HTML comments, white-on-white text, metadata, or embedded content. But the company has not published detection rates, supported file-type limits, bypass testing, false-positive data, or an independent evaluation of the new capabilities. Its “first Browser Security Platform” claim is Menlo’s own claim, not an independently established market finding.
The broader technical record also argues against treating sanitization as a complete solution. Mandiant’s March 2026 AI Risk and Resilience report documented a prompt-injection test using text inside a one-by-one-pixel image: effectively invisible to a person but still processed by an AI system. Mandiant also documented agents being directed to email private data, query sensitive systems through tool flaws, and perform actions outside their intended authority. Filtering untrusted content before it enters an agent is valuable, but it cannot safely substitute for least-privilege permissions, restricted tool access, egress controls, and auditing.
A browser-integrated assistant can see content in an active browser context. Menlo’s own public description calls browser assistants such as Copilot and Google Gemini “privileged, unmanaged agents” because they may read tabs that contain proprietary code or personal data. In a Windows environment, this is the most immediate use case for a browser security product: prevent a sensitive value rendered in an authenticated Edge or Chrome tab from becoming AI context, and restrict uploads or outbound navigation from that session.
Claude Code and similar coding agents create a different set of exposures. They can read local repositories, invoke shell commands, inspect build output, use GitHub APIs, access environment variables, and operate with whatever credentials a developer or CI runner provides. A sanitized webpage does not protect a repository if the agent has broad local filesystem access or an over-privileged token. Nor does it prevent a prompt injection delivered through a Git commit, issue, pull-request description, dependency manifest, README, or an MCP tool response unless that content path is also intercepted and policy-enforced.
Microsoft Security Research described that exact condition in June 2026 after finding a Claude Code GitHub Action issue. Microsoft said attacker-controlled issue text, pull-request content, and comments could influence the agent’s tool use; Anthropic subsequently mitigated the reported flaw in Claude Code version 2.1.128 by blocking access to sensitive
The Cloud Security Alliance separately reported in April that prompt-injection payloads in GitHub pull requests, issue bodies, and comments could trigger credential exfiltration through AI code-review agents, including products associated with Anthropic, Google, and Microsoft. Its key conclusion was more useful than the product-specific details: once untrusted content is fed into an agent with repository secrets and tools, normal GitHub endpoints can become the exfiltration channel. A network policy that blocks unfamiliar external domains may not see a problem when the data leaves through a normal pull-request comment or repository artifact.
Menlo’s data-governance layer may help if it redacts the relevant credentials or blocks the agent’s upload and posting action. Yet the announcement does not say whether MARS directly supports GitHub Actions runners, Microsoft-hosted versus self-hosted runners, Windows developer workstations, Windows Sandbox, WSL, Azure DevOps, GitHub Copilot coding workflows, or the various hosted and local modes of Claude Code. Those omissions are consequential for IT teams deciding whether this is a browser-session control, an agent-runtime control, or a product that can cover both after engineering integration.
That is the right administrative direction. An enterprise should not assign an agent a human employee’s standing access and call that governance. Agents need separate identities, constrained permissions, explicit data scopes, a known owner, short-lived credentials where possible, and logs that preserve the origin of both their instructions and their outputs.
But a per-agent policy model creates a deployment question that Menlo does not answer publicly: how are identities established for agents that are embedded in a browser, launched locally on a Windows endpoint, called from a CI pipeline, or operating through a vendor-hosted service? Token attribution can identify a MARS session, but it does not by itself prove that every action across the surrounding model, tool, repository, SaaS connector, and endpoint belongs to the same controlled identity.
Anthropic has made a similar point in its own security material. The company says model-level prompt-injection defenses can reduce attacks but will never be fully effective on their own because models are probabilistic. Its prescribed defense is overlapping controls across the model, the runtime environment, and the external content the agent can reach. That is a useful benchmark for assessing MARS: Menlo addresses the environment and content paths it controls, while customers still need to limit what the agent is permitted to do when a malicious instruction gets through.
For Windows shops, that suggests a division of responsibility. MARS may become a valuable enforcement layer for browser-connected agents, especially where Copilot or Gemini can see authenticated tabs and where agents retrieve files from OneDrive, SharePoint, or the open web. Endpoint security, conditional access, privileged-access management, repository controls, CI/CD secret scoping, and application allowlisting still govern the access an agent already has before it opens a browser session.
That does not invalidate the launch, but it limits what can be independently confirmed. There is no public confirmation from Microsoft, Google, or Anthropic that their products have a certified or native MARS integration. Menlo’s own white paper shows general integration methods—cloud proxy, MCP server, API proxy, secure tunnel, and browser automation—rather than a product-by-product deployment guide.
IT leaders should therefore press Menlo for a working architecture before approving it for production. The decisive questions are whether traffic from each agent is forced through MARS, whether the service sees plaintext at the necessary inspection point, which file formats and browser interactions are sanitized, how sensitive content is redacted without breaking the agent’s task, and whether the controls cover locally executed code and CI pipelines rather than only web browsing.
MARS’s expansion is timely because prompt injection has moved from a model-safety discussion into a permissions problem. The product may give security teams a practical control surface for AI assistants that live in Edge, Chrome, SharePoint, OneDrive, and browser-driven automation. It will earn that role only when organizations can prove that their agents’ real data paths—especially local code, CI secrets, browser tabs, and cloud connectors—cannot step around it.
The material issue is that the expansion arrives while AI assistants are gaining access to the same browser sessions, source repositories, cloud files, and authenticated web applications that security teams have spent years trying to protect. Menlo’s approach is to put a browser-security proxy and isolated cloud browser between an agent and those resources. That can reduce exposure, but it also means deployment quality—not the marketing claim that prompts are “stripped”—will decide whether it provides meaningful protection.
MARS is a control point, not a cure for prompt injection
Menlo describes MARS as a platform that executes agent browser sessions in remote, disposable cloud containers. Its technical white paper says it can interpose on three paths: normal HTTP traffic, browser automation, and LLM API requests. An agent that already uses a browser or HTTP client can be configured to use Menlo as a cloud proxy; an agent without a browser tool can instead use Menlo’s MCP server and cloud browser through Chrome DevTools Protocol or higher-level browser-automation interfaces.That architecture matters more than the brand names in the announcement. The service can only inspect and govern traffic it actually receives. If a Claude Code installation, GitHub workflow, Copilot session, browser extension, direct API client, local tool, or unmanaged endpoint reaches data outside the configured proxy, tunnel, MCP server, or supported browser route, MARS is not in that path.
Menlo says it removes hidden instructions, malicious scripts, steganographic content, and dangerous document elements before the agent sees them. The company’s public materials specifically describe document sanitization through content disarm and reconstruction, or CDR, plus “invisible content removal” and shadow-model scanning. Its public product page also says the platform can redact sensitive information before an agent processes a page or file.
Those are sensible layers, particularly for attackers hiding instructions in HTML comments, white-on-white text, metadata, or embedded content. But the company has not published detection rates, supported file-type limits, bypass testing, false-positive data, or an independent evaluation of the new capabilities. Its “first Browser Security Platform” claim is Menlo’s own claim, not an independently established market finding.
The broader technical record also argues against treating sanitization as a complete solution. Mandiant’s March 2026 AI Risk and Resilience report documented a prompt-injection test using text inside a one-by-one-pixel image: effectively invisible to a person but still processed by an AI system. Mandiant also documented agents being directed to email private data, query sensitive systems through tool flaws, and perform actions outside their intended authority. Filtering untrusted content before it enters an agent is valuable, but it cannot safely substitute for least-privilege permissions, restricted tool access, egress controls, and auditing.
The named products have very different security boundaries
Menlo bundles Microsoft Copilot, Gemini in Chrome, Claude Code, Claude Cowork, and autonomous web agents into one agent-security story. They are not equivalent deployment targets.A browser-integrated assistant can see content in an active browser context. Menlo’s own public description calls browser assistants such as Copilot and Google Gemini “privileged, unmanaged agents” because they may read tabs that contain proprietary code or personal data. In a Windows environment, this is the most immediate use case for a browser security product: prevent a sensitive value rendered in an authenticated Edge or Chrome tab from becoming AI context, and restrict uploads or outbound navigation from that session.
Claude Code and similar coding agents create a different set of exposures. They can read local repositories, invoke shell commands, inspect build output, use GitHub APIs, access environment variables, and operate with whatever credentials a developer or CI runner provides. A sanitized webpage does not protect a repository if the agent has broad local filesystem access or an over-privileged token. Nor does it prevent a prompt injection delivered through a Git commit, issue, pull-request description, dependency manifest, README, or an MCP tool response unless that content path is also intercepted and policy-enforced.
Microsoft Security Research described that exact condition in June 2026 after finding a Claude Code GitHub Action issue. Microsoft said attacker-controlled issue text, pull-request content, and comments could influence the agent’s tool use; Anthropic subsequently mitigated the reported flaw in Claude Code version 2.1.128 by blocking access to sensitive
/proc files. The incident was not about a browser exploit. It was an agent-plus-tools failure: untrusted natural language reached an agent operating inside a CI environment that could access secrets.The Cloud Security Alliance separately reported in April that prompt-injection payloads in GitHub pull requests, issue bodies, and comments could trigger credential exfiltration through AI code-review agents, including products associated with Anthropic, Google, and Microsoft. Its key conclusion was more useful than the product-specific details: once untrusted content is fed into an agent with repository secrets and tools, normal GitHub endpoints can become the exfiltration channel. A network policy that blocks unfamiliar external domains may not see a problem when the data leaves through a normal pull-request comment or repository artifact.
Menlo’s data-governance layer may help if it redacts the relevant credentials or blocks the agent’s upload and posting action. Yet the announcement does not say whether MARS directly supports GitHub Actions runners, Microsoft-hosted versus self-hosted runners, Windows developer workstations, Windows Sandbox, WSL, Azure DevOps, GitHub Copilot coding workflows, or the various hosted and local modes of Claude Code. Those omissions are consequential for IT teams deciding whether this is a browser-session control, an agent-runtime control, or a product that can cover both after engineering integration.
The real operational test is policy coverage
MARS’s strongest stated feature is not hidden-prompt removal. It is its attempt to extend identity, DLP, activity logging, session recording, and approval policy from employees to non-human actors. Menlo says each agent can be given token-based authentication and separate policy attribution, while administrators can see its actions and take over an active browser session.That is the right administrative direction. An enterprise should not assign an agent a human employee’s standing access and call that governance. Agents need separate identities, constrained permissions, explicit data scopes, a known owner, short-lived credentials where possible, and logs that preserve the origin of both their instructions and their outputs.
But a per-agent policy model creates a deployment question that Menlo does not answer publicly: how are identities established for agents that are embedded in a browser, launched locally on a Windows endpoint, called from a CI pipeline, or operating through a vendor-hosted service? Token attribution can identify a MARS session, but it does not by itself prove that every action across the surrounding model, tool, repository, SaaS connector, and endpoint belongs to the same controlled identity.
Anthropic has made a similar point in its own security material. The company says model-level prompt-injection defenses can reduce attacks but will never be fully effective on their own because models are probabilistic. Its prescribed defense is overlapping controls across the model, the runtime environment, and the external content the agent can reach. That is a useful benchmark for assessing MARS: Menlo addresses the environment and content paths it controls, while customers still need to limit what the agent is permitted to do when a malicious instruction gets through.
For Windows shops, that suggests a division of responsibility. MARS may become a valuable enforcement layer for browser-connected agents, especially where Copilot or Gemini can see authenticated tabs and where agents retrieve files from OneDrive, SharePoint, or the open web. Endpoint security, conditional access, privileged-access management, repository controls, CI/CD secret scoping, and application allowlisting still govern the access an agent already has before it opens a browser session.
Menlo has not published the details buyers need
The August 6 announcement does not disclose pricing, availability dates, licensing requirements, regional cloud availability, performance impact, supported Windows editions, browser prerequisites, data-retention periods for session recordings, or an integration matrix for the named assistants. Menlo’s public press-release archive, checked on August 6, lists its June 9 browser-threat report as its latest entry and does not yet list this MARS expansion. AiThority is the only outlet located carrying the specific August 6 announcement.That does not invalidate the launch, but it limits what can be independently confirmed. There is no public confirmation from Microsoft, Google, or Anthropic that their products have a certified or native MARS integration. Menlo’s own white paper shows general integration methods—cloud proxy, MCP server, API proxy, secure tunnel, and browser automation—rather than a product-by-product deployment guide.
IT leaders should therefore press Menlo for a working architecture before approving it for production. The decisive questions are whether traffic from each agent is forced through MARS, whether the service sees plaintext at the necessary inspection point, which file formats and browser interactions are sanitized, how sensitive content is redacted without breaking the agent’s task, and whether the controls cover locally executed code and CI pipelines rather than only web browsing.
MARS’s expansion is timely because prompt injection has moved from a model-safety discussion into a permissions problem. The product may give security teams a practical control surface for AI assistants that live in Edge, Chrome, SharePoint, OneDrive, and browser-driven automation. It will earn that role only when organizations can prove that their agents’ real data paths—especially local code, CI secrets, browser tabs, and cloud connectors—cannot step around it.
References
- Primary source: AiThority
Published: 2026-08-06T08:01:16+00:00
Menlo Security Extends MARS to Secure AI Assistants and Coding Agents Like Microsoft Copilot, Gemini in Chrome, and Claude Code Against Prompt Injection and Data Exfiltration
Menlo Security, the leader in Browser Security for human and agentic workforces, expanded Menlo Agent Runtime Security (MARS)aithority.com - Related coverage: menlosecurity.com
Menlo AI Agent Security | Menlo Security
Secure autonomous AI agents, prevent data loss, and unlock legacy data for agentic use. Menlo AI Agent Security protects AI workflows at cloud scale.
www.menlosecurity.com
- Related coverage: gartner.com
Gartner Predicts 25% of All Enterprise GenAI Applications Will Experience At Least Five Minor Security Incidents Per Year By 2028
By 2028, 25% of all enterprise generative AI (GenAI) applications will experience at least five minor security incidents per year, up from 9% in 2025, according to Gartner, Inc., a business and technology insights company.www.gartner.com - Related coverage: cloud.google.com
AI risk and resilience: A Mandiant special report | Google Cloud
Trends from Mandiant AI security engagements—plus how to adopt robust governance, red teaming, and AI-powered defense to stay ahead of threats.cloud.google.com
- Related coverage: info.menlosecurity.com
- Related coverage: anthropic.com
How we contain Claude across products \ Anthropic
Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.www.anthropic.com - Related coverage: code.claude.com
Security - Claude Code Docs
Learn about Claude Code's security safeguards and best practices for safe usage.code.claude.com - Related coverage: securityweek.com
Claude AI APIs Can Be Abused for Data Exfiltration - SecurityWeek
Attackers can use indirect prompt injections to trick Anthropic’s Claude into exfiltrating data the AI model’s users have access to.www.securityweek.com
- Related coverage: oasis.security
Claude.ai Prompt Injection Vulnerability | Oasis Security
Three Claude.ai vulnerabilities chained into a full attack: prompt injection to silent data exfiltration. Oasis Security research disclosure.www.oasis.security - Related coverage: menlosecurity.com
Secure AI Agents with Menlo Agent Runtime Security | Menlo Security
Secure your AI agents. Learn how Menlo MARS defends autonomous agents against prompt injection and data leaks while enabling seamless legacy web access.www.menlosecurity.com - Related coverage: labs.cloudsecurityalliance.org
Comment and Control: GitHub AI Agents as Credential Exfiltrators – Lab Space
Comment and Control: GitHub AI Agents as Credential Exfiltrators Key Takeaways Security researchers Aonan Guan, Zhengyu Liu, and Gavin Zhong disclosed on April 15, 2026 that three prominent AI agents — Anthropic's Claude Code Security Review, Google's Gemini CLI Action, and Microsoft's GitHub...labs.cloudsecurityalliance.org - Related coverage: microsoft.com
Securing CI/CD in an agentic world: Claude Code Github action case | Microsoft Security Blog
Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing...www.microsoft.com - Related coverage: github.com
Overview · anthropics/claude-code · GitHub
GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.
github.com
- Related coverage: labs.cloudsecurityalliance.org
CSA research note indirect prompt injection in the wild 20260426 csa styled
PDF documentlabs.cloudsecurityalliance.org
- Related coverage: quisitive.com
- Related coverage: info.menlosecurity.com
- Related coverage: techradar.com
Your security team doesn’t know about half its users | TechRadar
Meet the users your security team doesn't know existwww.techradar.com - Related coverage: techradar.com
Three high-risk AI vulnerabilities discovered in Claude.ai – end-to-end attack chain exfiltrates sensitive info without user knowing | TechRadar
A legitimate Google ad could lead to data exfiltrationwww.techradar.com - Related coverage: makeset.be
Agents IA pour PME : ce qui marche vraiment en 2026 - Makeset
L'IA agentique est le buzzword de 2026. Mais 40% des projets d'agents IA vont échouer. Voici ce qui marche vraiment pour les PME - et ce qui n'est que du vent.makeset.be - Related coverage: podcasts.apple.com
Google AI: Release Notes - Émission - Apple Podcasts
Écoutez le podcast Google AI: Release Notes de la chaîne Google AI sur Apple Podcasts.
podcasts.apple.com
- Related coverage: gemini.google
Introducing Gemini, your new personal AI assistant
We’ve reimagined what an assistant can be on your phone, rebuilt with Google's most capable AI models.gemini.google - Related coverage: claudelog.com
Claude News | ClaudeLog
Latest Anthropic announcements, Claude product updates, and AI news. Track Claude releases, features, and industry developments in a comprehensive timeline.claudelog.com - Related coverage: antaranews.com
Miliaran Pengguna Nantinya Bukan Lagi Manusia: Menlo Security Meluncurkan Platform Keamanan Browser Pertama di Industri untuk Mengatur Agen AI - ANTARA News
- Menlo Security, sang perusahaan pemimpin untuk Keamanan Browser manusia dan agen, tepat hari ini mengumumkan Platform Keamanan Browser pertama yang dirancang ...www.antaranews.com