Anthropic tests Claude to control Chrome

Anthropic has started testing an extension that lets Claude view web pages, click, fill out forms and complete tasks inside Chrome. The first phase is limited to 1,000 Max plan users, who can join a waitlist.

The idea is for Claude to do more than answer questions. It could act in your browser by organizing your calendar, scheduling meetings, drafting email replies or completing routine expense reports. In practice, you would give it a task and the agent would use the open pages to carry it out for you.

The problem: the web can trick AI

Giving an agent browser access also opens an avenue for attack. Web pages, emails and documents can hide instructions designed to confuse the agent. This type of deception is known as instruction injection, or prompt injection.

Hidden text could tell Claude to ignore the user's instructions and take another action. For example, a page could try to get the agent to:

• Delete emails or files.
• Extract private information.
• Share data with someone else.
• Make a purchase or transfer money.

Anthropic tested Claude for Chrome with 123 evaluation cases and 29 attack scenarios. Without the new protections, targeted attacks succeeded in 23.6% of cases.

In one test, a malicious email claimed that messages needed to be deleted for security reasons. Claude followed the instruction and deleted emails without asking for confirmation. The example shows why an agent that browses for you cannot treat everything it finds online as a valid command.

What controls does Claude for Chrome include?

Anthropic has added several safeguards before expanding access. The most visible is permission control: you can decide which sites Claude can access and revoke that access from the settings.

It must also ask for authorization before carrying out high-risk actions, such as publishing content, buying something or sharing personal data. Even in experimental autonomous mode, some sensitive operations still require confirmation.

The company also says it has:

• Improved the model's internal instructions for handling sensitive data and actions.
• Blocked categories considered high risk, such as financial services, adult content and piracy sites.
• Created classifiers to detect suspicious instructions and unusual data access.
• Tested attacks hidden in form fields, tab titles, web addresses and invisible elements on a page.

With these measures, the attack success rate fell from 23.6% to 11.2% across the test set. In a specific group of four browser-based attack types, it fell from 35.7% to 0%. Anthropic notes that threats remain to be discovered and that these figures do not mean the problem has been solved.

What this means for you

For now, Claude for Chrome is not a feature available to everyone. It is a research preview for trusted users who agree to let AI act on their behalf and who do not use it in critical environments.

Anthropic recommends starting with familiar sites and avoiding pages containing financial, legal or medical information. You should also remember that Claude will be able to see the data displayed in your tabs, and that confirmation before a dangerous action does not eliminate every risk.

The pilot will help Anthropic observe how the agent behaves in real-world situations, improve its detectors and design more precise permissions. The next step will not just be getting Claude to do more in Chrome. It will be teaching it to better distinguish between a legitimate instruction and a trap hidden on the web.