Claude in Chrome 正式开放，支持在浏览器中自主执行操作

Claude in Chrome is now generally available on every paid Claude plan. Claude can now also take actions autonomously in the browser, instead of needing approval for every one. A safety classifier validates each action before it’s performed to ensure it’s safe and matches your request.

Many of the tools you use every day connect to Claude . But many others don’t, such as internal dashboards, legacy systems, and vendor portals. Claude in Chrome lets Claude access those. It can view the page you’re on and take actions like reading and typing text, clicking links, navigating between pages, and filling out forms, using your existing logins.

We first announced Claude in Chrome as a pilot last year, so we could test it while also shoring up our defenses against prompt injection : malicious instructions hidden in websites, emails, or documents that try to trick an AI agent into acting against the user’s wishes. These defenses, described below, give us the confidence to make Claude in Chrome generally available.

Safeguarding against prompt injection

As we outlined when we announced the pilot, an AI agent that works in your browser is also vulnerable to prompt injection. So we’ve worked to improve our safeguards before releasing Claude in Chrome more widely.

In a prompt injection attack, malicious actors hide instructions in web content such as a web page, an email, or a form field. You may never see them, but these instructions can redirect the agent to do something you never asked for. For example, if you’ve asked Claude to draft replies to your emails, a hidden instruction in one message could tell Claude to forward your other emails to the attacker instead.

At launch, we described how we tested Claude’s defenses against these attacks and the safeguards we had in place at the time; we later released a more detailed description of our browser-use safeguards . Since then, we’ve improved how we train both the model and our probes , and added an additional set of classifiers that make it possible for Claude to safely take more autonomous actions in Chrome. In the next section, we discuss the results of our evaluations, which show the efficacy of these safeguards.

Claude recognizes more attacks. We train Claude against a growing library of prompt injection attacks, sourced from our internal automated attackers, external red-teamers, and real-world monitoring. When a new attack succeeds against a current model, it’s added to the library, where it informs the training of future models and our deployed safeguards so they learn to recognize it. Since we first wrote about our prompt injection defenses for browser use in November 2025, we’ve made Claude substantially more resistant to these attacks.

Probes screen web content before Claude acts on it. Web content reaches Claude through tool results. To take an action like reading a page or opening an email, the model makes a tool call; the tool result lets the model read the output (in this case, the content of the page or the email). We train probes to scan those results for potential prompt injections. When a probe detects a likely attack, Claude is warned to treat the content with suspicion and, if needed, to check with you before taking an action. We first deployed these probes with Claude Opus 4.5, and have since expanded the types of attacks they cover.

Actions are verified before they run . In Claude in Chrome, Claude will now automatically approve actions it determines to be safe, using the same mechanism as auto mode in Claude Code. (You can switch this off in your settings if you’d prefer to continue to approve Claude’s actions manually.) A classifier reviews actions Claude is about to take, such as navigating to a new website or entering text into a page, and checks them against what you originally asked for. If the action doesn’t match your request, it’s blocked.

Measuring Claude’s robustness against prompt injection

We’ve tested these safeguards to ensure that Claude in Chrome is safe to use for browser-based work. Here, we report the results from our most recent evaluations.

On our initial evaluation testing Claude Cowork’s resilience against prompt injection attacks (first developed when we released the Claude in Chrome pilot), no attack succeeded against Claude Fable 5, Claude Opus 5, or Claude Sonnet 5 in the Cowork harness , even without the probes and classifiers discussed above.

Because we saturated that evaluation (as evidenced by the 0% success rate), we decided to retire it. On our current evaluation , which uses stronger attacks sourced by professional red-teamers, attacks that reached the model succeeded against Opus 4.5 17.6% of the time and against Opus 5 3.8% of the time, before any additional safeguards. With the strongest safeguards available in November 2025, attacks against Opus 4.5 running with probes succeeded 16.7% of the time. Against every model from Opus 4.8 onwards, when running with probes and the safety classifier, no attacks succeeded against Claude Sonnet 5, Claude Opus 5, or Claude Mythos 5. We saw a 0.3% attack success rate against Fable 5. We have manually verified that all successful breaks are in low-severity scenarios and are working to mitigate them.

Prompt injection remains a moving target. While this approach defends against current attacks, we also need to ensure our safeguards stay ahead of the evolving methods of attackers. With each model release, we continue to invest in developing more sophisticated automated systems for attack discovery, red-teaming, and building stronger classifiers.

Getting started

To start using Claude in Chrome, install it from the Chrome Web Store . On Enterprise plans, admins can manage it in Organization Settings and limit it to approved domains. See the admin setup guide .

You’ll still need to use the Claude desktop app to work with files on your computer or with other applications. Claude in Chrome doesn’t run on other Chromium browsers or on mobile yet.

‍

¹ Not all attacks reach—i.e., are seen by—the model. In some cases, the actions Claude takes result in it never encountering the malicious instructions.

Explore more product news and best practices for teams building with Claude.

Customize Claude Code with mods

Product announcements Customize Claude Code with mods Customize Claude Code with mods Customize Claude Code with mods Customize Claude Code with mods Sep 30, 2026 Claude for Government is now generally available

Product announcements Claude for Government is now generally available Claude for Government is now generally available Claude for Government is now generally available Claude for Government is now generally available Sep 25, 2026 Build plugins for Claude

Product announcements Build plugins for Claude Build plugins for Claude Build plugins for Claude Build plugins for Claude Sep 23, 2026 Claude Marketplace: one place to discover plugins, agents, and services from our partners

Product announcements Claude Marketplace: one place to discover plugins, agents, and services from our partners Claude Marketplace: one place to discover plugins, agents, and services from our partners Claude Marketplace: one place to discover plugins, agents, and services from our partners Claude Marketplace: one place to discover plugins, agents, and services from our partners Transform how your organization operates with Claude

Product updates, how-tos, community spotlights, and more. Delivered monthly to your inbox.

Homepage Homepage Next Next Thank you! Your submission has been received! Oops! Something went wrong while submitting the form. (function () { // ---------- Claude helper ---------- function buildClaudeUrl(text) { const url = new URL('https://claude.ai/new'); url.searchParams.set('q', text || ''); return url.toString(); }

// ---------- Auto-grow helpers ---------- function sizeTextarea(el) { // Ensure UA defaults don't force a starting height el.setAttribute('rows', el.getAttribute('data-min-rows') || '1'); el.style.minHeight = '0px'; el.style.height = 'auto'; // allow shrink el.style.height = el.scrollHeight + 'px'; // fit content }

function initAutogrow(root = document) { root.querySelectorAll('textarea[data-autogrow]').forEach((el) => { if (el.dataset.autogrowInit) return; el.dataset.autogrowInit = 'true';

// Respect your existing pattern for default text const preset = el.getAttribute('data-default-text'); if (preset != null && !el.value) el.value = preset;

// Initial sizing sizeTextarea(el);

// Resize as you type el.addEventListener('input', () => sizeTextarea(el));

// In case fonts/styles load late and change line-height window.addEventListener('load', () => sizeTextarea(el), { once: true }); }); }

// ---------- Claude form initializer ---------- function initClaudeForms(root = document) { root.querySelectorAll('form[data-claude-form]').forEach((form) => { if (form.dataset.claudeInit) return; form.dataset.claudeInit = 'true';

const textarea = form.querySelector('[data-claude-textarea], textarea'); const trigger = form.querySelector('[data-claude-button], button[type="button"], a[data-claude-button]');

if (!textarea || !trigger) { console.warn('Claude form: missing textarea or trigger in', form); return; }

// If the trigger is a but has no type, force "button" so it won't submit if (trigger.tagName === 'BUTTON' && !trigger.hasAttribute('type')) { trigger.type = 'button'; }

// Keep from navigating away while still opening Claude if (trigger.tagName === 'A') { trigger.addEventListener('click', (e) => e.preventDefault()); }

// Optional: support data-default-text on the textarea const preset = textarea.getAttribute('data-default-text'); if (preset != null && !textarea.value) textarea.value = preset;

// Click opens Claude; submission is optional trigger.addEventListener('click', () => { const text = (textarea.value || '').trim(); if (!text) { textarea.focus(); return; }

window.open(buildClaudeUrl(text), '_blank', 'noopener');

const mode = form.getAttribute('data-claude-mode') || 'intercept'; if (mode === 'also') { // Submit after opening Claude form.submit(); } // intercept mode: do nothing (no submit) });

// (Optional) Keep an href in sync for right-click/open-in-new-tab UX if (trigger.tagName === 'A') { const syncHref = () => trigger.setAttribute('href', buildClaudeUrl((textarea.value || '').trim())); syncHref(); textarea.addEventListener('input', syncHref); textarea.addEventListener('change', syncHref); } }); }

// ---------- Boot ---------- function initAll(root = document) { initAutogrow(root); initClaudeForms(root); }

if (document.readyState === 'loading') { document.addEventListener('DOMContentLoaded', () => initAll(), { once: true }); } else { initAll(); }

@Claude @Claude @Claude

Download app Download app Download app

Artifacts Artifacts Artifacts

Design Design Design

Connectors Connectors Connectors

Plugins Plugins Plugins

Skills Skills Skills

Claude in Chrome Claude in Chrome Claude in Chrome

Claude for Microsoft 365 Claude for Microsoft 365 Claude for Microsoft 365

AI agents AI agents AI agents

Code modernization Code modernization Code modernization

Coding Coding Coding

Commerce Commerce Commerce

Customer support Customer support Customer support

Cybersecurity Cybersecurity Cybersecurity

Legal Legal Legal

Sales Sales Sales

Financial services Financial services Financial services

Government Government Government

Healthcare Healthcare Healthcare

Higher education Higher education Higher education

K-12 teachers K-12 teachers K-12 teachers

Life sciences Life sciences Life sciences

Nonprofits Nonprofits Nonprofits

Small business Small business Small business

Scientists Scientists Scientists

Developer docs Developer docs Developer docs

Developer blog Developer blog Developer blog

Console Console Console

Engineering at Anthropic Engineering at Anthropic Engineering at Anthropic

Overview Overview Overview

Marketplace Marketplace Marketplace

Claude on AWS Claude on AWS Claude on AWS

Blog Blog Blog

Claude partner network Claude partner network Claude partner network

Customer stories Customer stories Customer stories

Powered by Claude Powered by Claude Powered by Claude

Service partners Service partners Service partners

Availability Availability Availability

Check files Check files Check files

Regional compliance Regional compliance Regional compliance

Report abuse Report abuse Report abuse

Security and compliance Security and compliance Security and compliance

Status Status Status

Support center Support center Support center

Anthropic Anthropic Anthropic

Anthropic news Anthropic news Anthropic news

Policy on the AI Exponential Policy on the AI Exponential Policy on the AI Exponential

Transparency Transparency Transparency

Privacy choices /* Dialog styling */ dialog#consent-container { margin: 0; padding: 8px; opacity: 0; transform: translateY(16px); transition: opacity 0.3s ease-out, transform 0.3s ease-out; }

dialog#consent-container.show { opacity: 1; transform: translateY(0); }

dialog#consent-container::backdrop { background: transparent; }

dialog button span { display: inline !important; }

/* Toggle switch styling */ .toggle_switch { position: relative; display: inline-block; width: 36px; height: 24px; }

.toggle_switch input { opacity: 0; width: 0; height: 0; }

.toggle_slider { position: absolute; cursor: pointer; top: 0; left: 0; right: 0; bottom: 0; background-color: #87867f; transition: .4s; border-radius: 24px; }

.toggle_slider:before { position: absolute; content: ""; height: 18px; width: 18px; left: 3px; bottom: 3px; background-color: white; transition: .4s; border-radius: 50%; }

input:checked + .toggle_slider { background-color: #d97757; }

input:checked + .toggle_slider:before { transform: translateX(12px); }

input:disabled + .toggle_slider { cursor: not-allowed; opacity: 0.5; }

@media only screen and (max-width: 501px) { dialog#consent-container { left: 8px !important; bottom: 8px !important; right: 8px !important; } #consent-banner { padding: 24px 16px 16px !important; } #simple-options { grid-template-columns: repeat(3, 1fr) !important; grid-template-rows: auto auto !important; } #customize-btn { grid-column: span 1 !important; } dialog button span { display: none !important; }

Cookie settings

Enables security and basic functionality.

Enables tracking of site performance.

Enables ads personalization and tracking.

Responsible disclosure policy Responsible disclosure policy Responsible disclosure policy

Usage policy Usage policy Usage policy