Claude Chrome extension reaches general availability for all paid Anthropic plans

The Claude extension for Chrome has exited its pilot phase and is now generally available (GA) across every paid Anthropic tier. The model can now act autonomously in the browser — reading and typing text, clicking links, navigating between pages and filling forms — using the user’s existing logins without asking for confirmation at each step. A safety classifier evaluates every action before execution to verify it aligns with the original request.

The primary value is not on public websites but inside tools that lack an API: enterprise dashboards, legacy systems and vendor portals. Claude in Chrome “sees” the page the user is on and operates within that context, so an employee can direct the model to handle repetitive tasks in systems the organization never invested in integrating formally. The pilot was announced last year precisely to test this capability in a controlled setting before a wider release.

The main risk identified at the pilot launch was prompt injection: attackers hide malicious instructions in web content, pages, emails or form fields that the model might read and execute contrary to the user’s intent. A classic example: a request to draft email replies could leak an entire correspondence to an attacker if one message contains a covert instruction. Anthropic used the pilot period to build defensive layers before a broad rollout.

Since November 2025 the company reports a significant improvement in resilience. The model is trained against a continuously expanding attack library fed by internal automated attack generators, external red teams and real-world monitoring. Every successful attack is added to the library and influences both future model training and deployed defenses. In parallel, “probes” scan tool results before they reach the model; when a probe flags a suspected injection, Claude receives a warning to treat the content suspiciously and request approval where appropriate. The probes debuted with Claude Opus 4.5 and their coverage has since been expanded.

At this stage Claude in Chrome auto-approves actions it classifies as safe, using a mechanism similar to the “auto mode” in Claude Code. Users who prefer manual control can disable auto-approval in settings. The classifier runs before every action execution, and when its assessment suggests an action may be problematic, the request is returned to the user for explicit approval.