The product is generally available to every paid Claude plan. It can use a user’s existing logins to view pages, type text, click links, navigate between pages, and fill forms. Anthropic says an action classifier checks proposed browser actions against the user’s original request and blocks actions that do not match; users can disable automatic approval. In the company’s current stronger prompt-injection evaluation, attacks succeeded 3.8% of the time against Opus 5 before additional safeguards, while no attacks succeeded against Sonnet 5 or Opus 5 when probes and the safety classifier were used.
The mechanism is layered control around an agent’s browser tool loop: web content is scanned before it reaches the model, and proposed actions are checked before execution. Why now is that Anthropic says its pilot period was used to improve model training, probes, and classifiers enough to support wider release and more autonomous actions. The implication is that browser-agent competition is increasingly about the operational safety stack governing real credentials and interfaces, not only about model capability. The evidence boundary is that these figures are Anthropic’s reported results from its own evaluations, and the company explicitly says prompt injection remains a moving target. Watch whether independent testing reproduces the reported resilience, whether real-world incidents emerge, and how often organizations permit auto-approved workflows beyond approved domains.