On 25 August 2025, Anthropic began piloting Claude in Chrome, a browser extension that lets Claude click buttons, fill forms and navigate websites for a user, with 1,000 Max plan subscribers. The launch post was unusually candid about security: in Anthropic's own red-teaming, prompt injection attacks hidden in web pages and emails succeeded 23.6% of the time before new defenses and 11.2% after them. Those numbers are a rare public measurement of how exposed browser-using AI agents are to prompt injection, and they show why permissions and confirmations matter as much as model quality.

Key Facts#

  • Launch: Research preview announced on 25 August 2025 for 1,000 users on Anthropic's Max plan, with a waitlist for others.
  • Test set: 123 adversarial test cases covering 29 attack scenarios, run in the extension's experimental autonomous mode.
  • Results: A 23.6% attack success rate without the new safety mitigations and 11.2% with them.
  • Browser-specific attacks: On a challenge set of four attack types unique to browsers, the new mitigations cut the success rate from 35.7% to 0%.
  • Defenses: Site-level permissions, confirmations before high-risk actions, improved system prompts, blocked high-risk site categories and classifiers that look for suspicious instructions.
  • Later expansion: Beta for all Max subscribers on 24 November 2025, then availability on Pro, Team and Enterprise plans on 18 December 2025.

What Happened#

Anthropic framed browser-using AI as inevitable, because so much work happens in the browser, and said that controlled testing with trusted users was necessary before a wider release. Internally, it reported using early versions of the extension to manage calendars, schedule meetings, draft email replies, handle expense reports and test website features.

The security section explained the core problem. A prompt injection hides instructions in content the agent reads, such as a web page, an email or a document, to make it act against the user. Anthropic's example was an email that impersonated an employer, asked for messages to be deleted for "mailbox hygiene" and claimed that no confirmation was needed. Before the new defenses, Claude followed it and deleted the user's emails. With the mitigations in place, Claude flagged the message as a likely phishing attempt and did nothing.

The defenses came in layers. The first was permissions: users can grant or revoke access for each site, and Claude asks before high-risk actions such as publishing, purchasing or sharing personal data. Anthropic said certain safeguards for highly sensitive actions stay active even in autonomous mode. It also improved Claude's system prompts, blocked categories of sites it considers high risk, including financial services, adult content and pirated content, and began testing classifiers that detect suspicious instruction patterns and unusual requests for data.

Anthropic also red-teamed attacks that only an agent would see: hidden form fields in a page's Document Object Model that are invisible to humans, and instructions placed in URL text or tab titles. Those attacks made up the four-type challenge set where success fell to zero.

Background#

Prompt injection has been a known weakness of LLM applications for years, but agents raise the stakes because the model can act, not just answer. In a follow-up post on 24 November 2025, Anthropic explained why browsers are especially exposed: every web page, embedded document, advertisement and script is a potential attack vector, and a browser agent can navigate, fill forms, click and download files on the attacker's behalf.

That later post described three lines of work: reinforcement learning that rewards Claude for recognizing and refusing injected instructions, classifiers that scan all untrusted content entering the model's context, and continuous human red-teaming. Against an adaptive "Best-of-N" attacker given 100 attempts per environment, Anthropic reported much lower attack success rates for Claude Opus 4.5 with the updated safeguards than for the original preview. It still cautioned that "a 1% attack success rate—while a significant improvement—still represents meaningful risk."

Why It Matters for Developers#

Any .NET application that lets a model read untrusted content and then act, whether it is a Playwright-driven browser agent, an assistant that processes Microsoft 365 mail or a support bot that follows links, faces the same threat. Anthropic's layered design translates directly into application code.

  • Scope access narrowly. A per-site or per-resource allowlist limits where injected instructions can send the agent.
  • Gate high-risk actions. Require human confirmation for anything irreversible or externally visible. See the function calling guide and AI agent patterns for approval flows.
  • Treat retrieved content as data, never as instructions. Delimit it clearly in prompts, and screen it with a prompt-attack classifier where available. The Responsible AI and LLM security guide covers these controls.
  • Measure your own attack success rate. Build a test set of injected pages and emails, run it in CI and track the rate over time, as Anthropic did.

A minimal gate that combines the first two ideas might look like this:

C#
public enum Risk { Low, High }

public sealed record AgentAction(string Kind, Uri Target, Risk Risk);

public sealed class ActionGate(
    IReadOnlySet<string> allowedHosts, Func<AgentAction, Task<bool>> confirmWithUser)
{
    public async Task<bool> CanExecuteAsync(AgentAction action)
    {
        if (!allowedHosts.Contains(action.Target.Host)) return false; // site-level permission
        return action.Risk == Risk.Low || await confirmWithUser(action); // confirm high-risk steps
    }
}

Keep in mind that injection can escalate beyond data theft. Our coverage of the Semantic Kernel prompt-injection RCE flaws shows how a crafted instruction reached code execution on the host.

What's Next#

Anthropic said it would use the pilot to find attack patterns that controlled tests miss and to refine its classifiers, models and permission controls. The later expansion to all paid plans added organization-wide controls, letting Team and Enterprise admins enable or disable the extension and configure site allowlists and blocklists. The open question is whether any browser agent can drive the attack success rate low enough for sensitive work. Anthropic's own advice during the pilot was to avoid safety-critical or otherwise sensitive setups, and its later research says the problem is far from solved.

Sources#