Claude in Chrome Is Now Generally Available — But a Security Flaw Still Isn't Fixed

Anthropic took its browser-controlling AI agent out of beta on August 26, 2026, opening Claude in Chrome to every paid Claude plan instead of the 1,000-person Max-only pilot it launched with a year earlier. The extension can now click, type, and fill out forms across your open tabs on its own, and Anthropic says a year of red-teaming has pushed the odds of a hijack down close to zero. Independent security researchers testing the same release found a browser-extension flaw that lets a hijack happen with no user click at all — and say it's been sitting there, unpatched, for eight versions.

Both things are true at once, and that gap is the actual story. Here's what changed with general availability, what Anthropic's own numbers show, and what the researchers who don't work for Anthropic found when they went looking.

Quick Take

• What launched: Claude in Chrome, Anthropic's browser extension that lets Claude read pages and take actions — clicking, typing, navigating, filling forms — reached general availability on August 26, 2026, per Anthropic's announcement.
• Who gets it now: Claude Pro ($20/month), Max ($100–$200/month), Team, and Enterprise subscribers. It's still not included on the free plan.
• What's new versus the 2025 pilot: Claude can act autonomously instead of asking for confirmation on every step, backed by a safety classifier that screens each proposed action before it runs.
• Anthropic's safety claim: internal red-team testing reportedly dropped successful hijack attempts from 23.6% in the original unprotected 2025 pilot to under 0.1% with the new layered defenses in place.
• The catch: security firm Manifold Security says a rogue-extension bypass it first reported in May 2026 still works in the current release — if you've enabled "Act without asking," a malicious browser extension can trigger Claude to read your Gmail, Docs, or Calendar with no approval click required.

What Claude in Chrome Actually Does

Once installed, Claude in Chrome sits in a side panel and can see whatever tab you're on. Point it at a task — comparing prices across shopping sites, filling out a repetitive form, pulling data off a dashboard — and it navigates, clicks, and types using your existing logins, instead of relying on an API.

What changed at general availability is confirmation. During the pilot, Claude asked before most actions. Now it can string together multi-step tasks on its own, with a safety classifier evaluating each action before it runs rather than a human approving every click. Purchases and publishing still require explicit confirmation regardless.

This lands the same week Cowork, Anthropic's desktop agent app, gained a built-in Chromium browser of its own — a separate surface from this extension. If you're weighing ChatGPT Work, Claude Cowork, and Gemini Spark as an AI coworker, this extension is the browsing layer underneath Anthropic's entry.

The Safety Numbers, and Where They Come From

Anthropic has been unusually open about how badly this could go wrong. In the original 2025 pilot, its own red team ran 123 attack scenarios and found Claude carried out malicious instructions hidden on a webpage 23.6% of the time with no safeguards active — including one case where a fake "security" email talked Claude into deleting a user's entire inbox.

For general availability, Anthropic added two layers: an input-side probe that scans everything Claude reads for injected instructions before it reaches the model, and an output-side classifier that checks every proposed action. Anthropic reports this combination cuts successful attacks to under 0.1% of its internal test cases — a real, plausible improvement.

Worth being precise, though: that's Anthropic's own test suite, on scenarios Anthropic chose. "Our red team couldn't break it as often" isn't the same claim as "this can't be broken." Anthropic has drawn that same distinction elsewhere in the Claude line — when a researcher found a 60–80% success rate against Claude Code's Auto Mode (a different, terminal-based product with related defenses) using a custom attack chain, Anthropic closed the report as informative, not a vulnerability, calling the feature best-effort rather than a guarantee. Reasonable position, but it's a reason to treat any vendor's own "near-zero" figure with the same skepticism you'd apply to a benchmark it wrote itself.

The Flaw Nobody's Patched Yet

The more concrete problem is specific to the extension, and it doesn't require beating any classifier. Security firm Manifold Security disclosed a bypass to Anthropic in May 2026: a malicious browser extension — not a malicious webpage — can trigger Claude into acting on the user's behalf with no genuine click involved. According to SecurityWeek, Malwarebytes, and The Hacker News, the exploit can read Gmail, Google Docs, and calendar entries.

Manifold retested the current release — v1.0.80, eight versions after its original report — and told TechRadar the bypass still works: "eight Claude for Chrome releases later, the bypass is still six lines of JavaScript." Severity comes down to one setting. With Claude's default "ask before acting" mode on, the forged action still surfaces an approval click. Switch on "Act without asking" — the exact setting general availability is designed to make people comfortable using — and it runs silently. Anthropic's prompt-injection defenses genuinely improved this year. They don't cover this path, because it isn't a hostile webpage — it's another extension already in your browser.

How It Stacks Up Against the Field

Every major lab now ships a browser agent, each with its own take on free-vs-paid and autonomous-vs-confirmed. Perplexity Comet stays the most accessible: free across iOS, Android, Mac, and Windows, having reached full iOS rollout this month, though it carries its own disclosed history of agent-hijacking flaws. Gemini in Chrome's Auto Browse opened to all U.S. Android users on August 18, 2026, but its autonomous mode still requires a Google AI Pro or Ultra subscription, gating capability behind payment the same way Anthropic does. Microsoft Edge went the opposite direction entirely, retiring "Copilot Mode" as a distinct label and folding the same AI features into the free browser everyone already has.

Claude's position is the most capable on paper and, per Manifold's findings, currently the one shipping with a known, unpatched gap in the exact setting general availability nudges you toward. For the fuller assistant comparison beyond browsing, see our Claude vs. ChatGPT vs. Gemini breakdown; for how the last standalone AI browser fared, see why OpenAI shut down ChatGPT Atlas rather than keep competing here directly.

What This Means If You're Deciding Whether to Use It

If you're on a paid Claude plan and mostly hand it well-defined, low-stakes tasks — pulling data off a page, filling a form on a site you trust — Claude in Chrome now does that with less babysitting, and the defense-in-depth work is worth taking at face value for that use case.

The setting worth avoiding for now is "Act without asking." It costs a click per action to leave confirmation on, but that click is the only thing standing between the Manifold-disclosed bypass and your Gmail until Anthropic actually closes it, rather than mitigating around it with model-level defenses that don't apply to this attack path.

Frequently Asked Questions

Is Claude in Chrome available on the free plan? No. It's included on Pro ($20/month), Max ($100 or $200/month), Team, and Enterprise plans as of the August 26, 2026 general availability launch.

Is Claude in Chrome safe to use? Its layered defenses meaningfully cut webpage-based prompt injection versus the 2025 pilot, per Anthropic's own testing. A separate extension-based bypass Manifold Security disclosed in May 2026 remains unpatched — avoid "Act without asking" until that's fixed.

What's the difference between Claude in Chrome and Claude Cowork? The extension runs Claude inside tabs in Chrome you already have open. Cowork is Anthropic's separate desktop agent app, which this week also gained its own built-in Chromium browser, independent of the extension.

How does Claude in Chrome compare to Perplexity Comet? Comet is free everywhere and has the broadest reach; Claude in Chrome requires a paid plan but adds a safety classifier Anthropic says screens actions. Both have had independently disclosed security flaws, so neither is risk-free.

Does "Act without asking" make Claude in Chrome unsafe? It removes the one thing standing between the Manifold-disclosed bypass and your inbox, since that exploit relies on there being no approval step to interrupt it.

Bottom Line

Claude in Chrome's graduation to general availability is a real step forward on the numbers Anthropic controls, and a reminder that the numbers a vendor controls aren't the whole picture. The reduction in webpage-based prompt injection since the 2025 pilot looks legitimate and worth crediting. The unpatched extension-hijack path that independent researchers have now reported multiple times isn't covered by that same defense, and Anthropic hasn't closed it. Until it does, treat "Act without asking" as the one setting worth leaving off — and if you're weighing this against the field, check our breakdown of how the major AI assistants compare before picking which one gets access to your browser.