Claude in Chrome Is Finally Generally Available, With Attack Success Rates Near Zero!

Hi, it's me, Shiichan! Today I've got exciting news from Anthropic about browser automation.

Claude Blog claude.com

What was announced?

Anthropic's official Claude Blog announced that the Claude in Chrome browser extension is now generally available on every paid Claude plan.

Claude in Chrome lets Claude see the page you're on and take actions like reading and typing text, clicking links, navigating between pages, and filling out forms. Since it uses your existing logins, Claude can now reach tools that aren't directly connected to it, such as internal dashboards, legacy systems, and vendor portals.

The bigger change is that Claude no longer needs approval for every single action — it can now take actions autonomously. Before each action runs, a safety classifier checks it and blocks anything that looks risky.

The story so far

Claude in Chrome first launched as a pilot last year, in 2025. Back then it was still in a testing phase: Claude needed your approval for every single action while Anthropic worked on strengthening its defenses against prompt injection — malicious instructions hidden in web pages, emails, or forms that try to hijack an AI agent. Any AI agent operating inside a browser is naturally exposed to this kind of attack, so Anthropic spent time hardening its defenses before opening things up further.

What changes

Here's what's different now:

• Claude in Chrome is available on every paid Claude plan
• Claude can take actions autonomously without approving each one (you can still switch this off and go back to manual approval in settings)
• Claude can now reach tools it isn't directly connected to, like internal dashboards, legacy systems, and vendor portals
• On Enterprise plans, admins can manage it from Organization Settings and restrict it to approved domains

Many of the tools people use every day already connect to Claude, but plenty still don't — and Claude in Chrome is meant to fill that gap.

Dive Deep

The blog post goes into real detail on how the prompt-injection defenses work and how they were measured.

The safety approach rests on two main pieces:

• Probes: Claude receives web page or email content as the result of a tool call, and probes scan that content the moment it arrives, looking for hidden instructions. If a probe flags something suspicious, Claude treats the content with suspicion and, if needed, checks with you before acting. Probes were first deployed with Opus 4.5 and have since been trained to cover more types of attacks.
• Auto-approval classifier: This uses the same mechanism as auto mode in Claude Code. Before Claude takes an action — like navigating to a new site or entering text — the classifier checks it against what you originally asked for. If it doesn't match, the action gets blocked.

The evaluation numbers were pretty specific too:

• In the first evaluation (published in November 2025), no attack succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in the Cowork harness, even without probes or the classifier. Anthropic retired this evaluation because it was saturated.
• On a newer evaluation using stronger attacks from professional red-teamers (detailed in the Opus 5 system card), attacks that reached the model — without any additional safeguards — succeeded 17.6% of the time against Opus 4.5 and 3.8% of the time against Opus 5.
• With the strongest safeguards available in November 2025 (probes), Opus 4.5's success rate dropped to 16.7%.
• With probes plus the auto-approval classifier, every model from Opus 4.8 onward saw a 0% attack success rate against Sonnet 5, Opus 5, and Claude Mythos 5. Fable 5 came in at 0.3%.
• Anthropic manually verified that every successful attack was a low-severity scenario, and says it's still working to mitigate them.

Getting started is simple: install it from the Chrome Web Store. On Enterprise plans, admins can manage Claude in Chrome from Organization Settings and limit it to approved domains, with an admin setup guide available too.

There are limits, though: you'll still need the Claude desktop app for tasks that touch local files or other applications, and Claude in Chrome itself doesn't yet run on other Chromium browsers or on mobile.

Wrap-up

• Claude in Chrome is now generally available on every paid Claude plan
• The pilot required approval for every action; now a safety classifier lets Claude act autonomously
• Probes plus an auto-approval classifier form a two-layer defense against prompt injection
• The latest evaluation found a 0% attack success rate against Sonnet 5, Opus 5, and Claude Mythos 5, and 0.3% against Fable 5
• Enterprise admins can restrict it to approved domains, making it easier to roll out internally
• Worth a read for engineers who want to automate work across internal systems and legacy tools through the browser, and for anyone who cares about AI agent security!