Claude in Chrome is generally available, and it now clicks without asking first

Anthropic announced Claude in Chrome as a pilot last year, with one stated reason for the limited release: an agent that works in your browser is exposed to prompt injection, and the defenses were not ready. On August 26 the pilot ended. Claude in Chrome is now generally available on every paid Claude plan, and it acts on your pages using your existing logins.

What actually changed

The extension installs from the Chrome Web Store. Claude reads and types text, clicks links, navigates between pages and fills out forms, works across tabs, and the conversation continues in the desktop, mobile and web apps.

During the pilot, every one of those actions needed your approval. Now Claude automatically approves the actions it determines to be safe, using the same mechanism as auto mode in Claude Code. You can switch that off in settings and go back to approving each one. On Enterprise plans, administrators manage the extension in Organization Settings and can limit it to approved domains.

Two limits are worth knowing before you install it. Claude in Chrome does not run on other Chromium browsers or on mobile. And it does not touch files on your computer or other applications, so the desktop app is still the one for that work.

The two defenses that make the autonomy possible

Web content reaches Claude through tool results: to read a page or an email, the model makes a tool call and reads what comes back. Anthropic trains probes that scan those results for prompt injections. When a probe flags a likely attack, Claude is told to treat the content with suspicion and to check with you before acting. These probes first shipped with Claude Opus 4.5.

The second layer is the one that earns the automatic approval. A classifier reviews the action Claude is about to take, such as navigating to a new site or entering text into a page, and checks it against what you originally asked for. If the action does not match the request, it is blocked.

The numbers, and which one to read

On the current evaluation, which uses stronger attacks sourced from professional red-teamers, attacks that reached the model succeeded against Opus 4.5 17.6% of the time and against Opus 5 3.8% of the time, before any additional safeguards. With the strongest safeguards available in November 2025, attacks against Opus 4.5 running with probes still succeeded 16.7% of the time.

With probes and the safety classifier both running, no attacks succeeded against Claude Sonnet 5, Claude Opus 5 or Claude Mythos 5. Fable 5 came in at a 0.3% attack success rate, and Anthropic says it manually verified that every successful break was low severity.

The headline number is 0%, but the number that tells you how to think about this is 3.8%. That is the model alone, without probes and without the classifier. The defense is the stack, not the model, and Anthropic says as much: prompt injection remains a moving target, and the attack library it trains against grows every time a new attack lands.