Claude in Chrome Reaches General Availability, With a 0% Red-Team Attack Rate

Claude in Chrome moved to general availability today, rolling out to all paid Claude plans rather than the limited pilot group it launched in. The extension reads pages, types text, clicks links, navigates, and fills forms using a user’s own existing logins — Anthropic positions it for internal dashboards and legacy systems that were never built with an API. The headline addition at GA is autonomous action approval: a classifier now validates each action against what the user actually asked for and can auto-approve safe steps without a per-action click-through, instead of requiring a human confirmation at every step.

The more consequential number is the security one. Anthropic ran red-team evaluations against “stronger attacks” — the industry term for prompt-injection attempts, where malicious instructions hidden in web content try to hijack an agent mid-task — and reports Claude Sonnet 5 and Claude Opus 5 both held a 0% attack success rate, with Claude Fable 5 at 0.3% and every successful break confined to low-severity scenarios. The defense is three layers: the model itself trained on an internal-and-external red-team library, content-screening probes that scan pages before Claude acts on them, and action-verification classifiers that double-check intent before execution.

Anthropic shipped a second, related surface the same day: a built-in browser inside the Cowork desktop app, separate from both a user’s personal browser and the Chrome extension. The split is deliberate — Claude in Chrome handles tasks on pages a user already has open, while the Cowork browser runs independent research and data-collection work without needing the user’s session at all, with Anthropic stating plainly that “the built-in browser is separate from your own. Claude never sees your tabs, bookmarks, or passwords.”

For any organization piloting agentic browsing internally, GA plus a published 0%/0.3% red-team result is the first time this category has a concrete number to benchmark a vendor’s own claims against, rather than a marketing assurance.