Anthropic's Claude in Chrome goes GA, attack success under 0.3%

Anthropic is extending Claude in Chrome from a 2025 pilot to general availability on every paid Claude plan, meaning the assistant is now allowed to read the open page and perform actions such as reading and entering text, clicking links, moving between pages and filling in forms. It supports multiple tabs, and Anthropic says it works not only on the desktop app but also on the mobile app and the web app. Not every site is reachable: connections to internal dashboards and legacy systems, or to sites that block the connection, are not supported, and it does not work outside Chrome on Chromium-based browsers or in mobile environments.

Prompt injection is the reason this is a riskier product than a normal chat assistant. A page, email or form can carry a hidden instruction that the user never sees, and an agent can be steered into acting on it, for example forwarding a sensitive email if Claude is helping with replies. Anthropic says it uses an attack library built from internal tests, external red teams and its own monitoring to harden the model, and that the probe and safety classifier have cut attacks sharply: in its October evaluation over 129 scenarios and 10 runs each, reaching Claude Opus 4.5 succeeded 17.6％ and Claude Opus 5 3.8％; with probe and classifier, models from Claude Opus 4.8 on saw almost no successful attacks. Anthropic also notes not every attack reaches the model, and that attack methods keep changing, so it plans to release attacks with new models and to keep improving red-teaming and the classifiers. The stakes for business users, then, are likely to hinge on how well that cat-and-mouse cycle keeps up.