Claude in Chrome

Why 3: it carries out multi-step browser tasks, with a classifier vetting consequential actions, but still asks before purchases or sharing personal data, so key steps wait for you.

What it does. Piloted with 1,000 Max subscribers in August 2025, it became generally available on every paid plan on 26 August 2026. Since 12 August 2026 its side panel runs as a Cowork session, so skills and connectors work in the browser and a task started in a tab can be finished in the desktop, web or mobile apps. With auto-approve on, a classifier checks consequential actions such as submitting forms or sending messages and blocks those that don't match the request; it still asks before purchases or sharing personal data.

Where it falls short. It works with your logged-in sessions, so prompt injection is the main risk. Anthropic's own tests found attacks succeeded 23.6% of the time in the 2025 pilot (11.2% with mitigations); in 2026 it reports none succeeding against Sonnet 5, Opus 5 and Mythos 5 with safeguards on, and 0.3% against Fable 5. These are vendor tests, and the method changed in between.