Menlo Security MARS for AI Assistants and Coding Agents

Proceed with caution

Why

The threat is real and well-evidenced (Brave demonstrated a full account-takeover via indirect prompt injection in an agentic browser), and Menlo is a substantial vendor ($140M ARR, 1,000+ enterprises, 8M+ users), so this is not vaporware. But the specific capability is 5 days old, carries no availability statement, no GA date, no pricing and no independent test data, and its core claim — stripping injection payloads from content — sits against OWASP's explicit position that no fool-proof prevention is known. Several competing agent-security products launched the same week, so there is no first-mover urgency. Buying a cloud browser runtime as a trust root for our agents is itself a blast-radius decision; it warrants evidence, not a launch announcement.

Next

Request a scoped Menlo evaluation covering the exact agent paths this ecosystem runs — Claude Code with WebFetch, the mcp.pragma.vision OAuth-entitled MCP server, and file ingestion — and demand three artifacts before any spend: (1) a written availability and pricing statement for the assistant and coding-agent extension, since the launch release contains no availability language at all, (2) a red-team result on indirect prompt injection using the Brave/Comet-class chain (hidden instruction -> authenticated read -> exfiltration) rather than a booth demo, and (3) an explicit statement of which non-browser surfaces (MCP, bash, local files) are out of coverage. In parallel, harden the free layers already available: Claude Code isolated web-fetch context, network-command approval, bash sandboxing, and fail-closed permission matching.