Anthropic announced on August 26 that Claude in Chrome is now generally available. It's on every paid Claude plan, and the bigger change is that Claude can now act in the browser without asking you to approve each step — with a safety classifier checking every action just before it runs.
Quick glossary
- GA (general availability) — the stage where a feature leaves testing and ships to all intended users.
- Prompt injection — instructions hidden in a web page, email, or form field that try to hijack an AI agent.
- Classifier — a separate model that judges whether content or an action falls into a given category, such as unsafe.
What changed
Claude in Chrome exists to reach the web that has no connector: internal dashboards, legacy systems, and vendor portals. It reads the page you're on, types text, clicks links, moves between pages, and fills out forms — using the logins you already have.
Two things are new here.
- Generally available on every paid plan. It started as a pilot in 2025 and expanded in stages; this announcement makes it GA.
- Autonomous actions. Claude now automatically approves actions it judges safe, using the same mechanism as auto mode in Claude Code. You can switch this off in settings and go back to approving each action yourself.
Three layers of defense
Letting an agent act without prompting you requires defenses first. The announcement describes three.
- Model training — Claude is trained against a growing library of prompt injection attacks drawn from internal automated attackers, external red-teamers, and real-world monitoring. When a new attack succeeds, it joins the library and informs future models and safeguards.
- Probes — web content reaches the model as tool results. Probes scan those results for likely prompt injections; when one is detected, Claude is warned to treat the content with suspicion and, if needed, to check with you before acting.
- Verification before execution — a classifier reviews an action Claude is about to take, such as navigating to a new site or entering text, and blocks it if it doesn't match what you originally asked for.
The published evaluation numbers
Anthropic published its results. All figures below come from the official announcement.
- On the initial evaluation built for the pilot, no attack succeeded against Claude Fable 5, Opus 5, or Sonnet 5 — even without the probes and classifiers. Having saturated it, Anthropic retired that evaluation.
- On the current evaluation, which uses stronger attacks sourced from professional red-teamers, attacks that reached the model succeeded against Opus 4.5 17.6% of the time and against Opus 5 3.8% of the time, before any additional safeguards.
- With the strongest safeguards available in November 2025, attacks against Opus 4.5 running with probes succeeded 16.7% of the time.
- For models from Opus 4.8 onward running with probes plus the safety classifier, no attacks succeeded against Claude Sonnet 5, Opus 5, or Mythos 5, and 0.3% succeeded against Fable 5. Anthropic says it manually verified that every successful break was a low-severity scenario and that mitigation work is under way.
A footnote adds an important caveat: not all attacks reach the model — depending on the path Claude takes, it may never encounter the malicious instructions at all. Anthropic also states plainly that prompt injection is a moving target, and that defending against today's attacks doesn't mean staying ahead of tomorrow's.
Getting started, and the limits
- Install the extension from the Chrome Web Store.
- On Enterprise plans, admins manage it in Organization Settings and can limit it to approved domains.
- You still need the Claude desktop app to work with files on your computer or with other applications.
- It doesn't run on other Chromium browsers or on mobile yet.
How it relates to the built-in browser announced the same day
Anthropic announced Cowork's built-in browser on the same day. They aren't competing options — they have different jobs. The built-in browser is Claude's own browser, separate from yours, for handing off a web task entirely. Claude in Chrome is for your browser, where you're already signed in, working on the page in front of you. Pick which one Cowork uses by default in Settings > Cowork > Preferred browser.
Note: the documentation hasn't fully caught up
As of this writing (August 27, 2026), the official help article "Get started with Claude in Chrome" still labels the Chrome side panel as beta, while describing it as available in Cowork and Claude Code. The likely reason is that converting the side panel into a Cowork session is still rolling out to Pro plans — though that is an inference, not a stated fact. We'll update this once the documentation settles.
For what the extension can do, see our Claude in Chrome guide; for safe usage habits, see using Claude in Chrome safely.
Sources
- Anthropic official blog — Claude in Chrome is generally available (2026-08-26)
- Anthropic Help Center — Get started with Claude in Chrome
- Claude in Chrome product page
Related articles
- Claude in Chrome Guide: Claude Working in Your Browser
- How to Use Claude in Chrome Safely — Official Guide
- Claude in Excel Guide — the Claude Add-in That Works Inside Excel
- Claude in PowerPoint Guide — The Add-in That Builds Slides Inside PowerPoint
- Claude in Word Guide: Tracked Changes, Cited Answers, Template Filling