Claude in Chrome reaches general availability after year-long pilot

Anthropic made Claude in Chrome — the browser extension that lets Claude read a webpage and act on it directly, rather than only answer questions about it — generally available on every paid Claude plan, a year after launching it as a capped pilot built explicitly to buy time against the risk the product introduced: prompt injection, in which instructions hidden in a webpage are carried out by the model as though the user had typed them.

Anthropic used the anniversary to publish what it said the pilot year had bought. It reported that unmitigated prompt-injection attacks against last year’s Claude Opus 4.5 succeeded 17.6% of the time on its hardest red-teamed test set; against Claude Opus 5, also unmitigated, that fell to 3.8%, which Anthropic attributed mainly to training on a larger library of injection attempts rather than to any Chrome-specific fix. Layering on two further defences — probes that scan page content for likely injections and warn the model to treat it with suspicion, and a classifier that screens intended actions before they run — brought reported attack success to zero against both Sonnet 5 and Opus 5, and 0.3% against Fable 5, against the same attacks.

As with the pilot’s original figures, these numbers come from Anthropic’s own red-teaming against attacks it built and already knew about, not an independent audit or a guarantee against novel techniques — a distinction underlined the same week by a security researcher’s report of a working prompt-injection chain into full code execution against a different Anthropic product, Claude Code. Anthropic did not describe prompt injection as solved, and continued to frame the browser extension’s risk as reduced rather than eliminated even as it dropped the waitlist that had gated access since the 2025 pilot.