Claude moves into Chrome to click, fill forms, and battle prompt injections

Anthropic is bringing Claude straight into your browser, and it comes with some refreshingly honest safety data.

The AI lab rolled out Claude in Chrome, an extension that lets Claude see your screen, click buttons, fill out forms, and automate multi-tab workflows. After an initial 1,000-user research preview for Max subscribers paying $100 to $200 a month, Anthropic expanded access across all Max, Pro, Team, and Enterprise tiers. It even hooked into Claude Code, allowing developers to code in their terminal while Claude inspects live console errors and DOM states in the browser.

Taming the prompt injection beast

Giving an AI agent free rein in Chrome is undeniably useful, but browsers are essentially minefields filled with untrusted web content.

Anthropic openly acknowledged the nightmare scenario: indirect prompt injection. Attackers can embed hidden text inside a webpage, an email, or even the page's hidden DOM fields that instructs the agent to steal personal data or wipe your account. In internal red-teaming tests across 123 adversarial test cases, unprotected autonomous browser use suffered a 23.6% attack success rate. In one alarming test case, Claude read a malicious email claiming a security incident and proceeded to delete the user's inbox without confirmation.

To counter this, Anthropic implemented a layered defense that cut the overall attack success rate from 23.6% to 11.2%. On four browser-specific injection attack vectors—like text hidden in URL strings or invisible DOM inputs—new mitigations brought the exploit rate down from 35.7% to a flat 0%.

Anthropic also put hard rails around the experience. Claude asks for explicit confirmation before high-risk actions like purchasing or publishing data, allows users to manage site-level permissions, and blocks high-risk domains entirely, including banking, adult, and pirated content.

The high-stakes browser agent race

Browsers have become the hottest battleground in AI. Perplexity recently launched its agentic browser Comet, which Brave's security team quickly caught being vulnerable to prompt injection before a fix was deployed. Meanwhile, OpenAI is reportedly developing its own browser, and Google continues stuffing Gemini directly into Chrome amidst a loomingly precarious antitrust lawsuit.

Anthropic first dipped its toes into interface automation in October 2024 with its Computer Use feature. While impressive on paper, that early release was notoriously sluggish and unreliable. Bringing the model into Chrome's native DOM context makes it vastly faster and more precise, but the stakes are much higher when browsing the open web.

Why it matters

We think Anthropic is playing this smart by treating prompt injection as a first-class engineering metric rather than an inconvenient footnote. While competitors rush to promise autonomous web surfing, Anthropic is setting clear expectations by admitting that even with mitigations, an 11.2% attack rate remains.

For developers and power users, the Claude Code bridge is a legitimate productivity booster. Having an agent read console errors and verify front-end components across tabs cuts real friction. That said, it is definitely not ready for high-stakes environments. You should keep it far away from sensitive corporate dashboards, personal banking, or primary communication channels.

For the broader industry, this release raises the safety baseline. As AI labs race to own the browser interface, shipping an autonomous agent without battle-tested injection classifiers is becoming an unacceptable liability. Anthropic just dared the rest of the ecosystem to publish their own red-teaming numbers.