Anthropic has introduced Claude for Chrome, a new browser extension that allows its AI assistant to take direct actions inside Google Chrome. Currently available in a limited research preview, the extension can navigate websites, click buttons, and fill out forms on behalf of the user.
The tool is designed to handle practical tasks. For example, users could give Claude access to Gmail to scan sent emails from the past two months, identify which ones haven’t received replies, and draft follow-ups. On a real estate site, Claude could interpret a text description of a property search, apply the appropriate filters, and return listings that match.
While the feature shows clear convenience potential, it also raises security concerns. One of the main risks is prompt injection attacks — situations where malicious instructions are hidden within content the AI is asked to process. If, for instance, a user tasked Claude with managing email, an attacker could embed a line in a message instructing it to forward sensitive correspondence elsewhere. Without safeguards, the system might obey.
To address these risks, Anthropic has built in multiple protections. Users can control site-level permissions, deciding which websites Claude can access. Before performing high-risk actions like publishing, making purchases, or sharing personal information, Claude will request explicit confirmation. Even in its experimental “autonomous mode,” which allows more independent operation, the AI maintains restrictions on particularly sensitive tasks.
Anthropic has also taken technical steps to reduce the effectiveness of prompt injection attacks. According to the company, mitigation efforts have cut the attack success rate nearly in half — from 23.6% to 11.2% — compared to its existing Computer Use feature. Still, the company is cautioning participants not to rely on Claude for Chrome in situations involving money, passwords, or highly sensitive data while testing is underway.
For now, access is limited to 1,000 users on the Claude Max plan, with broader availability planned after feedback from early testers. Interested users can join a waitlist for future access.
