代理安全與瀏覽器自動化
Claude in Chrome Opens Automated Actions to All Paid Plans, Using Content and Per-Action Classifiers to Thwart Prompt Injection
Anthropic is bringing its browser agent to all paid plans. Users can approve a plan once, allowing Claude to click, type, and execute workflows across tabs. Every autonomous action is additionally reviewed by a safety classifier, but official testing still found a 0.3% attack success rate, and screenshots may also capture sensitive data.
On August 26, Anthropic made [Claude in Chrome generally available](https://claude.com/blog/claude-in-chrome-generally-available) and removed the requirement for users to confirm every action individually. Paid users can allow the agent to read pages, click, fill out forms, and operate across tabs, or launch a “modify code—verify in the browser—fix again” loop from Claude Code. Work can also continue across desktop, web, and mobile. This enables agents to operate internal dashboards, legacy admin systems, and vendor portals that lack APIs, but it also turns an authenticated browser session into a highly privileged tool.
The new safeguards do not rely solely on the model refusing malicious instructions. Untrusted page content entering the context is first checked by a prompt injection classifier. In auto-approve mode, every proposed action is then evaluated again to determine whether it aligns with the original request; actions suspected of exceeding authorization are blocked or paused. Anthropic says that in its Cowork test harness, Sonnet 5 and Opus 5 suffered no successful attacks when probes and the auto-approve classifier were enabled, while Fable 5 had an attack success rate of 0.3%. However, these are internal vendor evaluations. The models used, thinking settings, and which attacks actually reached the model all affect the denominator, so the results should not be interpreted as evidence that browser agents are immune to prompt injection.
The risk boundaries remain clear. The [safety guide](https://support.claude.com/en/articles/12902428-use-claude-in-chrome-safely) states that the agent captures screenshots of the tabs it is operating and cannot first exclude passwords, personal data, or confidential documents visible on screen. Anthropic therefore does not recommend using it with financial, medical, legal, or other regulated data, and organizations subject to HIPAA cannot enable it. Enterprise administrators can configure domain allowlists and blocklists, while Chrome itself allows access by extensions to be restricted to specific sites. Deployment teams should treat automated mode as a supervised, privileged execution environment and separately constrain account permissions, data scope, and actions to those that are reversible, rather than using classifier results as a substitute for authorization controls.