Anthropic launches Claude for Chrome browser agent

Anthropic launched Claude for Chrome, a browser extension letting Claude view a webpage’s content and take actions on it directly — clicking buttons, filling in forms — rather than only answering questions in a chat window. The launch was a research preview limited to 1,000 subscribers on Anthropic’s Max plan, with a public waitlist for others.

Anthropic built the release around the risk it introduced rather than treating it as a footnote: prompt injection, in which instructions hidden in a webpage, email or other content the browser reads are followed by the model as if the user had typed them, similar to a flaw Brave researchers had disclosed in Perplexity’s Comet browser six days earlier. Anthropic reported that browser use without its safety mitigations failed against 23.6% of a red-teamed set of prompt-injection attacks; with mitigations in place — including a revised system prompt, blocking of high-risk site categories such as financial services, mandatory user confirmation before actions like publishing or purchasing, and a classifier for suspicious page content — the failure rate fell to 11.2% in autonomous use, with certain browser-specific attack types reduced to zero.

Anthropic did not claim the vulnerability was solved, only reduced, and continued to frame it as an open problem for the category rather than one particular to Claude for Chrome. The rollout expanded gradually: to all Max subscribers by November 2025, then to Pro, Team and Enterprise plans by December. Claude for Chrome arrived roughly two months ahead of OpenAI’s rival Atlas browser, part of a wider 2025 race among AI labs to control the browser as an interface, in which prompt injection recurred as the category’s defining security weakness across products from Anthropic, OpenAI and Perplexity alike.