Claude in Chrome is now fully unleashed

The scariest part of handing an AI agent control of your browser isn't that it might click the wrong button. It's the risk that some hidden text on a web page tells the bot to exfiltrate your private emails behind your back.

Anthropic wants to prove it has solved that trust issue. On August 26, the company officially made its Claude in Chrome extension generally available to all paid Claude subscribers. Crucially, the agent can now perform autonomous actions in the browser without asking for your sign-off at every single click.

Three guardrails for autonomous browsing

Claude in Chrome bridges the gap between Claude and your daily workflow, specifically targeting web tools that lack direct API integrations, like internal company dashboards, vendor portals, and legacy systems. Claude uses your active browser logins to read pages, click links, fill out forms, navigate across tabs, and sync ongoing conversations across desktop, mobile, and web apps.

To make autonomous mode safe, Anthropic deployed a layered defense system.

First, Claude is trained on an expanding library of prompt injection attacks gathered from internal automated tools, external red-teamers, and real-world monitoring.

Second, specialized probes screen web content before Claude acts on it. When a tool retrieves page text or an email, probes scan for malicious instructions. If an attack is suspected, Claude is flagged to proceed with caution or ask for user confirmation.

Third, an action classifier validates every step against your original intent. Operating on the same mechanism as auto mode in Claude Code, this classifier inspects every intended action, such as visiting a new URL or submitting input, and blocks it if it deviates from your initial request. Users who prefer manual oversight can toggle off automatic approvals in settings.

Zero-break test results and current limits

Anthropic shared updated red-teaming benchmarks to back up its security claims. Under strong attacks without safeguards, the attack success rate dropped from 17.6% on Opus 4.5 down to 3.8% on Opus 5.

When running with full safeguards, including probes and the safety classifier, attack success plummeted to 0% for Claude Sonnet 5, Claude Opus 5, and Claude Mythos 5. Fable 5 logged a tiny 0.3% success rate, which Anthropic confirmed involved only low-severity scenarios.

There are clear boundaries, though. The extension currently runs exclusively on Google Chrome, excluding mobile browsers and other Chromium-based alternatives. For local file operations, users still need the Claude desktop client. Enterprise administrators can restrict extension access to approved domains via organization settings.

Why it matters

We think Anthropic's architectural choice here is particularly sharp. Instead of relying solely on the core frontier model to outsmart every sneaky prompt injection, Anthropic introduced external probes and an explicit intent classifier to police actions before execution. Decoupling action verification from raw model execution is what makes autonomous web agents practical in the real world.

For knowledge workers and developers, this makes dealing with clunky internal dashboards and non-API SaaS tools dramatically less painful. If you spend hours cross-referencing vendor portals or filling out repetitive web forms, it is well worth testing now.

That said, prompt injection remains a moving target. While 0% attack rates in benchmark harnesses sound reassuring, zero-day injection techniques in the wild will inevitably surface. Organizations should be cautious and leverage enterprise domain whitelisting before letting agents roam completely unchaperoned on mission-critical workflows.