---
type: "post"
id: "claude-in-chrome-is-generally-available-analysis-b82a25"
slug: "claude-in-chrome-is-generally-available-analysis-b82a25"
title: "Claude in Chrome is generally available"
description: "Anthropic’s general release of Claude in Chrome turns browser automation from a supervised extension experiment into a paid-plan agent surface with conditional autonomous execution."
retrieval_nugget: "Anthropic’s general release of Claude in Chrome turns browser automation from a supervised extension experiment into a paid-plan agent surface with conditional autonomous execution."
published_at: "2026-09-22"
updated_at: "2026-09-22"
record_date: "2026-09-22"
date_kind: "published_at"
topics: []
source_urls: ["https://websitemain.claude.com/blog/claude-in-chrome-generally-available"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:claude-in-chrome-is-generally-available-analysis-b82a25"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:d36a06a40ab6145ce9580e3a3bcea7e016a0f0bfed122ce067227d1da65a98cb","reviewed_at":"2026-09-22T16:36:44.498Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":2,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Anthropic’s general release of Claude in Chrome turns browser automation from a supervised extension experiment into a paid-plan agent surface with conditional autonomous execution.","observed_facts":[{"text":"Claude in Chrome is generally available on every paid Claude plan.","source_urls":["https://websitemain.claude.com/blog/claude-in-chrome-generally-available"]},{"text":"Anthropic says the browser agent can use existing logins to view pages, type text, click links, navigate, and fill forms.","source_urls":["https://websitemain.claude.com/blog/claude-in-chrome-generally-available"]},{"text":"Anthropic reports that no attacks succeeded against Sonnet 5 or Opus 5 with probes plus the automatic approval safety classifiers in its current evaluation.","source_urls":["https://websitemain.claude.com/blog/claude-in-chrome-generally-available"]}],"mechanism":"The mechanism is layered control around an agent’s browser tool loop: web content is scanned before it reaches the model, and proposed actions are checked before execution.","why_now":"Why now is that Anthropic says its pilot period was used to improve model training, probes, and classifiers enough to support wider release and more autonomous actions.","implications":["The implication is that browser-agent competition is increasingly about the operational safety stack governing real credentials and interfaces, not only about model capability.","Enterprise controls that limit the extension to approved domains may become a practical gate for deploying browser agents into internal workflows."],"evidence_boundary":"The evidence boundary is that these figures are Anthropic’s reported results from its own evaluations, and the company explicitly says prompt injection remains a moving target.","watch_conditions":["Watch whether independent testing reproduces the reported resilience, whether real-world incidents emerge, and how often organizations permit auto-approved workflows beyond approved domains.","Watch whether support expands beyond Chrome and whether browser autonomy becomes available in more enterprise-controlled configurations."],"related_records":[],"new_branch_reason":"This starts a distinct analytical record because the supplied evidence documents a general-availability release coupled with a new autonomous-action safety architecture, rather than only an earlier browser-agent pilot."}
routes: {"html":"https://newruntime.com/posts/claude-in-chrome-is-generally-available-analysis-b82a25/","markdown":"https://newruntime.com/posts/claude-in-chrome-is-generally-available-analysis-b82a25.md","json":"https://newruntime.com/posts/claude-in-chrome-is-generally-available-analysis-b82a25.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# Claude in Chrome is generally available

## Retrieval answer

Anthropic’s general release of Claude in Chrome turns browser automation from a supervised extension experiment into a paid-plan agent surface with conditional autonomous execution.

Anthropic’s general release of Claude in Chrome turns browser automation from a supervised extension experiment into a paid-plan agent surface with conditional autonomous execution.

The product is generally available to every paid Claude plan. It can use a user’s existing logins to view pages, type text, click links, navigate between pages, and fill forms. Anthropic says an action classifier checks proposed browser actions against the user’s original request and blocks actions that do not match; users can disable automatic approval. In the company’s current stronger prompt-injection evaluation, attacks succeeded 3.8% of the time against Opus 5 before additional safeguards, while no attacks succeeded against Sonnet 5 or Opus 5 when probes and the safety classifier were used.

The mechanism is layered control around an agent’s browser tool loop: web content is scanned before it reaches the model, and proposed actions are checked before execution. Why now is that Anthropic says its pilot period was used to improve model training, probes, and classifiers enough to support wider release and more autonomous actions. The implication is that browser-agent competition is increasingly about the operational safety stack governing real credentials and interfaces, not only about model capability. The evidence boundary is that these figures are Anthropic’s reported results from its own evaluations, and the company explicitly says prompt injection remains a moving target. Watch whether independent testing reproduces the reported resilience, whether real-world incidents emerge, and how often organizations permit auto-approved workflows beyond approved domains.

Source: https://websitemain.claude.com/blog/claude-in-chrome-generally-available

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)