Menlo's MARS expansion adds AI-agent controls, but every one of them only enforces inside the Menlo cloud browser. The AI that runs in a desktop app, an IDE, or a CLI stays ungoverned, and the isolation that powers it adds the cloud round-trip Menlo itself concedes creates lag. dope.security governs AI on the device, across every app, with no detour.

What Menlo MARS shipped

On September 29, 2026, Menlo expanded MARS with prompt-injection stripping, content disarm and reconstruction, and DLP for AI agents. On paper it reads like a modern AI-governance suite. Read the fine print and one phrase decides everything: these controls enforce inside the Menlo Cloud. Menlo's model renders web sessions remotely in its cloud browser and streams the result back to the user, and its AI controls live in that same remote browser. If the AI runs there, Menlo can govern it. If it runs anywhere else on the laptop, Menlo cannot see it.

That is the structural line to draw before comparing feature lists. Menlo is a remote browser isolation company, and MARS is RBI pointed at AI. For teams weighing a move, our guide to Menlo Security alternatives lays out the trade-offs, and this post focuses on the one that matters most for AI: where enforcement actually happens.

The catch is in the words "inside the Menlo Cloud"

AI at work does not stay in a browser tab. An engineer runs Claude in a desktop app. A developer wires an MCP server into Cursor. An analyst pastes a client file into a native ChatGPT client. None of that routes through a remote cloud browser, so none of it is governed by a control that only enforces there. Menlo's own capability picture reflects this: strong where the session is isolated, a gap on tenant control, a gap on semantic prompt DLP, and AI coverage bound to the cloud browser rather than the device.

This is the difference between isolating a browser and governing a device. If your people only ever touched AI through one managed browser, the Menlo model would hold. They do not. The AI surface is the whole endpoint, which is why we argue the control has to live there, in detecting shadow AI across desktop apps, IDEs, and CLIs.

The latency Menlo concedes

Remote browser isolation has an honest cost, and Menlo is honest about it: its own marketing has attacked pixel-streaming RBI for lag, latency, and mushy scrolling. Rendering a session in the cloud and streaming it back means every interaction makes a round-trip to a data center and home again. Customers report that isolation breaks interactive apps and that deployments get complex; one CISO reviewer described a five to ten person deployment effort with tickets still open years later. The detour is not a bug in a bad build. It is what streaming a browser from the cloud costs.

See the detour for yourself. dope.security inspects on the device and flies direct, with no cloud browser to stream back, so the latency you measure is the latency you keep. Compare your real round-trip against a cloud-proxy path on the fly direct secure web gateway, or watch it in a live demo.

The takeaway: security that renders your browser in a data center and streams it back cannot be faster than security that never leaves the device.

dope.security runs inspection on the endpoint, so traffic goes straight to its destination. No remote render, no stream, no PoP round-trip. That is the same reason distributed teams feel the difference immediately. Greylock Partners, a device-first VC, moved off a backhauled model to dope.security and closed in 27 days, because the people who live out of laptops notice a detour on every request.

Menlo versus dope.security on AI governance

This is not "Menlo can't do AI." MARS is a real set of controls. It is a question of reach, and reach is set by architecture.

Where Menlo's model fits

If your risk is a user opening a risky site or an AI chat through one locked-down browser, isolation contains it well, and MARS adds prompt-injection stripping and CDR inside that sandbox. For a narrow, browser-only AI policy, that is coherent.

Where dope.security governs what Menlo cannot reach

dope.security is the lead pick because it governs the device, not one browser. Inspection runs on the endpoint with local SSL inspection, so AI usage is visible and controllable wherever it happens.

Browser DLP versus semantic DLP

MARS includes DLP for AI agents, and it is worth being precise about what that is. Menlo's browser DLP matches against a large library of dictionaries, which is pattern matching with a big dictionary. Pattern matching flags known strings and misses the paraphrase, the restructured table, the same secret described in different words. Dopamine DLP classifies by meaning, on the device, which is why it catches PII, PCI, PHI, and intellectual property with far fewer false positives and far fewer easy evasions. When the control reads the document the way a person would, people stop finding ways around it. More on the on-device model is in how an on-device SWG works.

What to evaluate before you commit

Run two tests. First, take an AI action outside the managed browser: use a desktop AI client or a CLI and see whether the control notices. A cloud-browser model will not. Second, measure the interactive feel of a real session through the isolated path versus direct, because your users will feel it every day. Then weigh it against an on-device model that governs the same AI everywhere and adds no round-trip. For the architecture side by side, see endpoint-based SWG versus cloud-proxy SWG, and start a free production trial when you want to measure it on your own fleet.

Frequently Asked Questions

Does Menlo MARS govern AI that runs outside the browser?

No. MARS enforces inside the Menlo cloud browser, so AI used in a desktop app, an IDE, or a CLI is outside its reach. dope.security inspects on the device, so it governs AI across the browser, desktop apps, IDEs, and CLIs from one agent.

Is Menlo slower because of remote browser isolation?

Isolation renders the session in Menlo's cloud and streams it back, which adds a round-trip to every interaction. Menlo's own marketing has criticized pixel-streaming RBI for lag and mushy scrolling, and customers report that isolation can break interactive apps. dope.security runs inspection on the device and flies direct, so there is no stream to wait on.

Can Menlo block personal ChatGPT while allowing the corporate tenant?

Menlo's capability picture shows a tenant-control gap, so separating a personal AI account from the enterprise tenant on the same service is not its strength. dope.security makes that split on the device and blocks the personal account while allowing the corporate one.

How does Menlo's AI DLP compare to Dopamine DLP?

Menlo's browser DLP matches against a large library of dictionaries, which is pattern-based. Dopamine DLP classifies prompts and uploads by meaning on the device, catching sensitive data with fewer false positives and fewer evasions, then blocks it before it leaves.

Do I have to route traffic through a cloud browser with dope.security?

No. There is no remote browser and no backhaul. The agent inspects on the endpoint and traffic goes straight to its destination, which is the source of the latency difference versus a streamed isolation model.

How hard is dope.security to deploy compared to an isolation rollout?

It deploys as a sub-100 MB agent through Intune or Jamf with policy landing on every endpoint in under a minute, rather than a multi-person isolation project. Greylock Partners went from first proposal to signed contract in 27 days.

The honest summary: MARS is a capable browser-isolation suite, and if AI only ever ran in one managed browser it would be enough. AI runs on the whole device, through a streamed path that adds a detour, and governing it everywhere with no round-trip is what dope.security does on the endpoint.