Contents
Anthropic moved Claude in Chrome out of pilot and into general availability on every paid Claude plan this week, and the headline change is not the browser extension itself. It is the default behavior switching from approve-every-action to act-then-verify. Since the pilot launched a year ago, every click, form fill, and page navigation needed a human nod before it happened. Now Claude can string together a multi-step browser task on its own, and a safety classifier checks each action after the fact instead of a person checking it before.
That is a meaningful trust jump for anything that touches a live browser session with your cookies and your logins attached, so it matters why Anthropic believes it can make it safely.
What actually changed
Autonomous actions, not just autonomous suggestions. Claude in Chrome can now read the page you are on, type into fields, click links, navigate between pages, and fill out forms while carrying your existing logged-in state, without pausing for approval on each step. That reach is deliberate: internal dashboards, legacy admin panels, and vendor portals that never got a native Claude integration are exactly the surfaces this unlocks, because there is no API to connect to, only a UI to operate.
A three-layer defense against prompt injection. Browser agents are attractive prompt injection targets because a malicious instruction hidden in a web page, an email, or a form field can hijack the agent without you ever seeing it. Anthropic’s stack layers three defenses: the model itself is trained on a continuously growing library of real attacks pulled from automated red-teamers and production monitoring; probes screen page and email content before Claude acts on it and flag suspicious material for a manual check; and a classifier reviews each action immediately before it runs, comparing it against your original request and blocking anything that does not match.
The numbers behind the confidence. Anthropic retired its original pilot-era injection benchmark because it had saturated at a 0% success rate, and moved to a harder evaluation built by professional red teams. On that tougher test, unguarded attacks succeeded 17.6% of the time against Claude Opus 4.5 and 3.8% against Claude Opus 5. With probes and the action classifier both switched on, that fell to 0% for Sonnet 5, Opus 5, and Mythos 5, and 0.3% for Fable 5. Every attack that still got through was manually confirmed to be low severity.
Try it: does the action get through
About the demo
This models the shape of Anthropic’s layered defense, not a call to any real API or dataset. Toggle the defense layers and pick an attack scenario to see how the outcome shifts.Pick a scenario and toggle the layers.
Set the scenario to the disguised system-override attempt and switch every layer off. The simulated attack slips through, because nothing on the page is actually reading the page’s content for intent, or checking the resulting action against what you asked for. Turn the probe and classifier back on and it gets caught, because those two are doing categorically different jobs: one reads content before Claude trusts it, the other reads the planned action before it executes.
Where this leaves you
The trade Anthropic is asking users to make is real: less friction for the 97%-plus of actions that are exactly what you asked for, in exchange for trusting a classifier’s judgment on the rest. A 0% to 0.3% measured success rate against professional red-teamers is a strong number, but it is also a number that will age, since Anthropic itself says prompt injection is a moving target and each new model release needs its own round of attack discovery.
My practical take: turn on Claude in Chrome for the tools that genuinely lack a real integration, an internal dashboard or a vendor portal you touch daily, rather than pointing it at your primary inbox on day one. Keep manual approval switched on for anything that can move money, send external communications, or touch credentials, at least until a few more evaluation cycles have run against it in the wild. The classifier is good. It has not yet been tested against every attacker who read this announcement too.