August 27, 2026. Anthropic made Claude in Chrome generally available on August 26 for every paid Claude plan, roughly a year after it launched as a limited pilot. The bigger change than the availability is the autonomy: Claude can now take browser actions without approving each one with you, with a safety classifier validating every action against what you originally asked before it runs. Independent coverage landed the same day. For small businesses and agencies, this is the automation surface that APIs never reached, because the tools that eat the most staff time, vendor portals, supplier logins, internal dashboards and legacy admin panels, are exactly the ones with no integration to call.
What Anthropic shipped
- General availability on paid plans. Pro, Max, Team and Enterprise users can install the extension from the Chrome Web Store. It does not yet run on other Chromium browsers or on mobile.
- Autonomous actions by default. Claude auto-approves actions a classifier judges safe and consistent with the request, and blocks actions that do not match what was asked. Manual approval remains available as a setting.
- A three-layer defense against prompt injection. The model is trained against a growing library of real attacks, separate probes screen web content before Claude acts on it, and the action classifier checks each step. Anthropic publishes the eval results alongside the release.
- Enterprise controls. On Enterprise plans the extension is off by default, and admins can enable it and restrict it to approved domains.
- It uses your existing logins. Claude operates the browser as you, which is what makes portals with no API reachable, and is also the sharpest thing to govern.
The safety numbers, read honestly
Anthropic's earlier browser-safety evaluation ended at a 0 percent attack success rate on its newest models, so the company retired it and published results from a harder one built on attacks sourced from professional red-teamers. On that evaluation, attacks that reached the model succeeded against Claude Opus 4.5 17.6 percent of the time and against Opus 5 3.8 percent of the time before safeguards. With probes and the action classifier running, no attacks succeeded against Sonnet 5 or Opus 5, and 0.3 percent succeeded against Fable 5, which Anthropic says were low-severity cases it is working to close. The company's own caveat is the right one to carry: prompt injection remains a moving target, and these numbers describe current attacks, not future ones.
What it means for operators
The practical unlock is every workflow that dies in a browser tab: pulling statements from a supplier portal, reconciling listings in a vendor dashboard, filing the same form across three government sites, updating a legacy system that will never get an API. Those are the jobs SMBs still staff by hand, and they are now automatable with the tools a business automation build already uses. The governance move worth copying is Anthropic's own enterprise default: off until an admin turns it on, then limited to approved domains. Agencies rolling this out on client accounts should treat the agent like a new hire, which is how we approach agent setup projects: give it a scoped login with the permissions the task needs rather than an owner account, keep autonomous mode away from payment pages and anything irreversible, and widen access as the audit trail earns it. This also closes the gap left when OpenAI folded its standalone Atlas browser earlier this month, moving the browser-agent race decisively into extensions living inside the browser people already use.
Where to be careful with autonomous mode
Because the agent inherits your session, its reach equals your reach. Run it from a profile whose logins you would hand a new assistant on day one, not from the profile holding your banking. Start with read-heavy tasks, data pulls and form fills you can verify, before letting it write anywhere customer-facing, and leave manual approval on for any site where a wrong click has a cost. The 0.3 percent figure is small, and it is not zero, and Anthropic is the one saying attackers keep evolving. Treat that sentence as the operating manual.
Frequently Asked Questions
It is generally available on every paid Claude plan, meaning Pro, Max, Team and Enterprise, installed from the Chrome Web Store. It does not yet work on other Chromium browsers or on mobile, and on Enterprise plans it is off by default until an admin enables it.
It views the page you are on and takes actions like reading and typing text, clicking links, navigating between pages and filling out forms, using your existing logins. That makes it useful for tools without integrations, such as vendor portals, internal dashboards and legacy systems.
Anthropic reports that with its probes and action classifier enabled, no attacks in its red-teamer evaluation succeeded against Sonnet 5 or Opus 5, and 0.3 percent succeeded against Fable 5 in low-severity cases. The company states plainly that prompt injection remains a moving target, so cautious scoping still matters.
Start scoped. Run it on a browser profile with only the logins the task requires, begin with read-heavy work like data pulls and form fills, keep manual approval for sites where mistakes are costly, and expand access as the results and audit trail justify it. Anthropic's enterprise default of off plus approved domains is a good template.