Claude in Chrome now clicks on its own

On Wednesday, August 26, Anthropic — the company behind Claude — said the Chrome extension is generally available. It ships on every paid plan. The change that matters is not “another chat in the browser.” It is this: the system can now act on the page by itself.

Chat is a question and an answer. An agent, in the sense the industry is using now, is a system that takes a job and keeps going. In Chrome, that means reading the screen, typing, clicking a link, moving between pages, filling a form. It uses the login you already have. The company says it is for tools with no clean plug: an internal dashboard, a legacy system, a vendor portal.

Until now, every click needed a yes. As of yesterday, Claude can auto-approve actions it judges safe — the same mechanism as auto mode in Claude Code, Anthropic’s programming tool. You can turn that off in settings and keep approving by hand. Before each action, a classifier checks the step against what you asked. If it does not match, it is blocked.

Why the wait? An agent in the browser is an easy target for a trick called prompt injection: a hidden instruction in a page, an email, or a form field, trying to steer the system into doing something nobody asked for. Anthropic’s own example: you ask Claude to draft email replies; a hidden line in one message tells it to forward the rest of the inbox to an attacker.

The company says it trained the model against a growing library of those attacks, and that “probes” scan page content before Claude acts. In the latest tests, with the safeguards on, no attack got through against Claude Sonnet 5 or Opus 5. On Fable 5, the rate was 0.3%, in cases Anthropic calls low-severity. The firm admits the target moves: what holds today does not close the file for good.

Who can use it today is not “any Chrome.” It is the official Chrome Web Store, on a computer. It does not run on other Chromium browsers, or on a phone. Files on the machine and other apps still go through the desktop app. On enterprise plans, an admin can limit Claude to approved sites.

The takeaway for a reader who only wants to know what is going on is simple. The AI left the chat window. It now has a hand on the browser — and the fight is whether the filter in the middle of the click can survive the trick hidden in the page.