Claude In Chrome Can Now Act Without Approval For Every Step. Is It Safe?

August 26, 2026

Claude in Chrome now acts without approval for every step. See what Anthropic confirmed, what prompt-injection tests show, and how to limit risk.

Claude in Chrome is safer than its original pilot according to Anthropic's own tests, but it is not risk-free. The extension can now take browser actions without asking you to approve every step. Anthropic says probes inspect web content and a classifier checks every proposed action, yet it also warns that novel prompt injections could still cause data exfiltration and recommends keeping Claude away from sensitive sites.

The practical answer is not a simple yes or no. Claude in Chrome may be reasonable for bounded work on trusted sites, especially with a separate browser profile and manual approval enabled. It is a poor default for banking, healthcare, legal documents, confidential work accounts, or any browser profile where one successful mistake could expose unrelated data.

What Is Confirmed

Anthropic announced on August 26, 2026 that Claude in Chrome is generally available on every paid Claude plan. The extension can view pages, read and type text, click links, navigate among tabs, and fill forms using the accounts already signed in through Chrome.

The material change is the approval model. Claude can now automatically perform actions it judges to be safe instead of waiting for the user before every action. Anthropic says a safety classifier reviews each action against the user's original request. If the action does not match, it should be blocked.

Anthropic's current Claude in Chrome safety guide describes two additional facts users should understand before turning it on:

That second point is a privacy boundary, not a minor implementation detail. A browser tab can expose names, addresses, account balances, private messages, legal text, health information, work records, or another person's personal data. Claude cannot selectively remove sensitive details from a screenshot before seeing them.

The Chrome Web Store listing reports about 14 million users and says the extension handles personally identifiable information, personal communications, location, web history, user activity, and website content. That disclosure does not mean every category is collected in every task. It does show the breadth of information a browser agent may encounter when it is allowed to work across logged-in sites.

How Automatic Approval Works

Automatic approval is not the same as unlimited permission.

Anthropic says the system evaluates proposed actions before they run. Lower-risk actions can proceed without interruption. Actions that look unsafe can be blocked or paused for the user. Certain categories, such as entering sensitive information or downloading a file, can still require confirmation.

The protection has three relevant layers:

  1. Model training: Claude is trained to distinguish user instructions from malicious instructions found in content.
  2. Content probes: Tool results from web pages, emails, and documents are scanned for likely prompt injection before Claude acts on them.
  3. Action classification: A separate check compares the proposed action with the user's original request before execution.

This is stronger than trusting a language model to police itself with a sentence in its system prompt. It also changes what a user approval means. In manual mode, the human reviews each proposed browser action. In automatic mode, the classifier becomes the routine approval gate, and the human is interrupted only when the system detects enough risk.

That can reduce approval fatigue. It also means the safety of a long task depends on whether the automated checks recognize the dangerous step before it occurs.

What Anthropic's Prompt-Injection Tests Show

Anthropic reports materially improved results, including favorable results for the generally available configuration.

On its current evaluation, which uses stronger attacks from professional red-teamers, prompt injections that reached the model succeeded against Opus 5 3.8% of the time before the extra probes and automatic-approval classifier were applied. With probes and the safety classifier enabled, Anthropic reports:

Model Reported attack success with probes and action classifier
Claude Sonnet 5 0%
Claude Opus 5 0%
Claude Mythos 5 0%
Claude Fable 5 0.3%

Anthropic says it manually verified that the successful Fable 5 cases were low severity and is working to mitigate them.

Those results are meaningful. They are evidence that layered defenses can reduce the tested attacks substantially. They are not proof that every possible injection has been eliminated.

The evaluation tells us how the tested models and safeguards performed against Anthropic's current attack set under its test conditions. It does not establish a universal failure rate for every site, task, browser state, new adversarial technique, model update, or future extension version. Anthropic says this directly: prompt injection remains a moving target.

What Is Still Unclear

How The System Performs Against New Attacks In Real Browsing

No fixed test set can contain attacks that have not been invented yet. Anthropic says successful new attacks are added to its growing library, which is a sensible feedback loop. It also means reported evaluation results describe the defenses against known and generated test cases, not an all-time guarantee.

The company's safety guide warns that novel attacks could produce outcomes such as data exfiltration. No source reviewed for this article establishes that the generally available automatic-approval configuration has been exploited in the wild.

Both statements matter:

Which Page Content Enters A Saved Session

Anthropic says side-panel sessions are saved to Claude history and can be reopened on other devices. It also says screenshots of active tabs become part of the conversation.

The public materials do not provide a field-by-field map showing exactly how every screenshot, DOM fragment, tool result, action decision, or intermediate page state is stored for every plan and configuration. Users should therefore reason from the visible boundary: if a page is visible to Claude while it works, treat that page's information as potentially entering the session context.

This is different from giving a chatbot one copied paragraph. Browser authority can expose a changing sequence of pages, tabs, messages, forms, and account states during a multi-step task.

How Often Automatic Checks Pause In Everyday Work

Anthropic publishes attack-success results, but the launch post does not give a general false-positive rate, false-negative rate, or frequency of approval pauses across ordinary user workflows. Those operational details affect both safety and usability.

A classifier that interrupts too often can recreate approval fatigue. A classifier that interrupts too rarely can miss meaningful scope changes. Users need direct experience with low-stakes tasks before deciding whether the default mode is appropriate for their browser profile.

Whether Every Relevant Prior Extension Finding Is Resolved

This launch should not be confused with the separate July report that another Chrome extension could trigger fixed Claude workflows. That earlier finding concerned extension-to-extension trust and synthetic user-intent signals. The current announcement focuses on prompt-injection defenses, content probes, and automatic action classification.

Anthropic's general-availability post does not serve as a dedicated remediation notice for every previously reported browser-extension issue. A newer release and stronger action checks may change practical exploitability, but users should not treat a product launch as proof that every distinct security report has been resolved unless the vendor or researcher says so.

Why A Browser Agent Changes The Privacy Question

A normal AI chat has a relatively obvious input boundary: you type or upload something, and the service processes it.

A browser agent expands that boundary. It can see information already available to your signed-in browser and take actions through the authority of those sessions. The relevant question becomes:

What can the agent observe, what can it change, what can malicious page content influence, and what unrelated accounts are reachable from the same browser profile?

Consider a seemingly harmless request: “Review my inbox, find the invoice, and update the vendor portal.” Completing it may require the agent to:

  1. read email content;
  2. open an attachment or link;
  3. move to a separate logged-in site;
  4. enter data into a form; and
  5. submit or save a change.

If an email or page contains a hidden instruction, the attack does not need to break Chrome's encryption or steal a password directly. It needs to influence an agent that already has permission to see the content and act through authenticated sessions.

That is why “the action used my existing login” is not, by itself, a safety argument. Existing login state is what gives a browser agent useful authority and creates its potential blast radius.

What A Prompt Injection Could Try To Do

Prompt injection places adversarial instructions inside data the agent is expected to read. It might appear in:

The attacker may try to redirect the agent toward a new objective, such as opening another site, revealing information from a different tab, changing a form entry, sending a message, or copying data into an attacker-controlled location.

Anthropic's probes and action classifier are specifically meant to catch these transitions. The safest user configuration still reduces the authority available if one transition is missed.

A Practical Risk Matrix For Claude In Chrome

Browser task Main exposure Safer starting configuration
Summarizing public documentation Untrusted page instructions Separate profile, manual approval at first
Filling a non-sensitive public form Incorrect entries or unintended submission Manual approval before submit
Working in an internal dashboard Confidential data and write authority Enterprise allowlist, least-privilege account, manual approval
Reading email Private communications and indirect injection Separate account/profile, avoid broad inbox access
Handling legal or health records Regulated or privileged information Do not use Claude in Chrome for the workflow
Banking or investments Financial data and irreversible actions Keep the extension out of the profile
Scheduled recurring browser work Unattended scope drift Narrow site allowlist, test account, audit trail, reversible actions only

Anthropic itself recommends against using Claude in Chrome for financial accounts, legal documents, medical information, sensitive work accounts, or sites containing other people's personal information. It also says Claude in Chrome is not available to organizations covered by HIPAA and recommends against pages containing regulated data.

The Separate-Browser-Profile Rule

The most useful control is architectural: give the agent less to reach.

A dedicated Chrome profile can have:

This does not eliminate prompt injection. It reduces the damage available to a successful injection, mistaken action, or compromised extension.

The profile should also use least-privilege accounts. If the task needs read access, do not sign in with an administrator account. If a vendor portal supports a test environment, test the workflow there before giving the agent production access.

Should You Turn Off Automatic Approval?

Use manual approval when:

Automatic approval is more defensible when the task is bounded, reversible, and limited to low-sensitivity sites in a separate profile. Even then, start with manual mode so you can observe the actions Claude normally takes.

Do not treat a stream of approval prompts as a substitute for understanding the workflow. Humans can approve unsafe actions out of habit. The better control is to combine narrower authority, clear task scope, automated checks, and confirmation for consequential steps.

What Teams Should Configure Before Enabling It

Team and Enterprise administrators can use allowlists and blocklists and can disable the extension organization-wide. A sensible rollout should answer these questions before access expands:

  1. Which domains are necessary for the approved use case?
  2. Which accounts and roles will users operate under?
  3. Which data classifications are prohibited from browser-agent sessions?
  4. Which actions must always receive human review?
  5. Where are session content and activity records available for investigation?
  6. How will a suspected prompt injection stop active tasks and revoke browser authority?
  7. How will extension and model changes be reevaluated?

An allowlist should be restrictive enough to express the use case, not simply mirror every site an employee might visit. Remember that a trusted domain can still display untrusted email, comments, support messages, advertisements, or embedded content.

Where OpenVeil Fits—and Where It Does Not

OpenVeil is a privacy-focused hosted AI workspace for chat, private search, files, voice, images, and video. In normal private-chat use, chat history is stored in the user's browser rather than as a normal server-side chat-history record.

That creates a narrower standing authority than a browser agent when you do not need the AI to inspect and operate logged-in websites. You can choose the passage needed for a task, remove identifying details, or describe a problem without granting access to a browser profile.

The boundary is important. OpenVeil is not fully offline, anonymous, zero-log, or HIPAA compliant. Active prompts, selected local history, uploads, searches, media, and outputs still require processing by OpenVeil and the providers needed to perform the feature. OpenVeil does not secure Claude in Chrome, inspect browser extensions, block prompt injection, protect unrelated accounts, or make intentionally submitted information immune from other risks.

The useful comparison is about scope: a chat workspace handles what you deliberately submit, while a browser agent can observe and act through a changing authenticated environment. If you do not need that authority, do not grant it by default.

Frequently Asked Questions

Is Claude In Chrome Safe?

Anthropic reports strong results for its current probes and action classifier, including no successful tested attacks against Sonnet 5, Opus 5, or Mythos 5 with those safeguards. Anthropic also says risk is not zero and warns that novel attacks could lead to data exfiltration. Safety depends on the task, browser profile, sites, account privileges, approval mode, and consequences of a wrong action.

Does Claude In Chrome Ask Before Every Action?

Not in the default Cowork side-panel configuration. Anthropic says Automatically approve is the default: Claude proceeds with actions assessed as lower risk and pauses or blocks when a classifier detects risk. Users can switch to Manually approve to review every action.

Does Claude In Chrome Take Screenshots?

Yes. Anthropic says Claude takes screenshots of the tabs it is working in. Visible content becomes part of the conversation, and Claude cannot filter sensitive information out before seeing it.

Are Claude In Chrome Sessions Saved?

Anthropic says side-panel sessions are saved to history and can be reopened on other devices. It advises users not to open the side panel on pages showing information they do not want stored with the session.

Can Prompt Injection Still Affect Claude In Chrome?

Anthropic says its probes and action classifier substantially reduce the tested attacks, but the risk is not zero. Novel techniques may evade current evaluations. The company calls prompt injection the biggest risk facing browser-using AI tools.

Should I Use A Separate Chrome Profile?

Yes, especially for agentic browsing. Anthropic recommends a separate profile without access to sensitive accounts. The profile should contain only the accounts, sites, and privileges necessary for the approved task.

Can I Use Claude In Chrome For Health Or Financial Work?

Anthropic recommends against using it on financial, legal, medical, regulated, or otherwise sensitive workflows. It says the product is not available to HIPAA-covered organizations and asks for permission before accessing financial sites.

The Bottom Line

Claude in Chrome's general availability is a real expansion of AI-agent authority. The extension can act across logged-in websites without asking for approval at every step, and Anthropic has added meaningful defenses: model training, content probes, action classification, site controls, and high-risk confirmations.

The same source materials establish the limit. Prompt injection remains possible, screenshots can pull visible sensitive information into saved sessions, and users remain responsible for actions taken on their behalf.

The safest practical rule is simple: use automatic browser agents only inside a deliberately limited environment. Keep sensitive accounts out of the profile, start in manual mode, restrict sites and privileges, and preserve human confirmation for consequential actions. If the job only requires private drafting or analysis, a narrower chat workflow can avoid granting browser authority in the first place.

Sources

When privacy, account control, uploads, and search matter, OpenVeil gives you a private AI workspace designed for that job.