Anthropic pilots Claude in Chrome

Background

Most AI assistants answer questions inside a chat box. An extension that can act on web pages goes further: it works inside the browser a person is already signed in to, and it can operate the page itself rather than only talk about it. That is where a lot of everyday work happens — forms, accounts, dashboards — and it is also where the security problem lives. A web page is not a trusted document. It can carry text written to be read by a model rather than by a person: a comment, a post, a product description, a block hidden from view. If the assistant treats such text as instructions, it can be steered into doing something the user never asked for. This is prompt injection (提示注入), and it is the central security question for any agent that reads live web content.

The pilot

On 25 August 2025, Anthropic began piloting Claude in Chrome, a browser extension that can act on web pages ^[1]. The pilot was deliberately small: it was limited to 1,000 Max plan users ^[1]. Alongside it, Anthropic published the results of its own prompt-injection testing rather than only describing safeguards in general terms. In autonomous mode, the share of attacks that succeeded fell from 23.6% to 11.2% with the new mitigations in place ^[1]. The testing behind that figure covered 123 test cases across 29 attack scenarios ^[1]. On a second measure — a challenge set built around four types of browser-specific attack — Anthropic said attack success fell from 35.7% to 0% with its mitigations ^[1].

Guards and limits

Even with the mitigations, the extension asks users to confirm high-risk actions such as publishing, purchasing or sharing personal data ^[1]. Some categories of site are blocked outright: financial services, adult content and pirated content ^[1]. For organizations, Team and Enterprise administrators can turn Claude in Chrome on or off across the whole organization and configure site allowlists and blocklists ^[1].

Rollout

The pilot widened over the following months. On 24 November 2025 the extension reached all Max subscribers in beta ^[1]. On 18 December 2025 it expanded to the Pro, Team and Enterprise plans ^[1].

Why it matters

The two success-rate figures should be read separately. 11.2% is a reduction, not an elimination: on that test set roughly one attack in nine still worked. The 0% figure comes from a different, browser-specific challenge set and says nothing about the 29 scenarios behind the other number. Publishing both, with the test sizes attached, lets a reader see how much of the risk the mitigations actually remove rather than taking the safeguard on trust.

The second thing worth noting is where control sits. Confirmation prompts put the decision in front of the user at the moment a risky action is about to happen ^[1]; blocked site categories and administrator allowlists move part of that decision to whoever configures the tool ^[1]. For a company deciding whether an agent may touch its internal sites, an organization-wide switch and a site list are the difference between a tool that can be governed and one that cannot.

Capping the pilot at 1,000 users ^[1] kept the number of people exposed while the failure modes were still being mapped. The order of the rollout follows the same logic: a small pilot first, then beta for all Max subscribers ^[1], then the plans whose administrators need org-wide controls ^[1]. A browser is where a person's logged-in sessions live, so an agent running there carries the user's authority by default — which is why confirmations and site rules are part of the product rather than an afterthought.