Claude in Chrome goes generally available, with prompt-injection warnings attached

Anthropic has moved Claude in Chrome from limited preview to general availability. The Claude Code July 2 release notes list version 2.1.198 with the line "Claude in Chrome launched as generally available," alongside background notifications and a draft-PR handoff for agent workflows. It caps a long rollout: the extension started as a research preview in August 2025, opened to all paid plans in December 2025, and now reaches general availability.

What it does

The extension lets Claude act inside your browser rather than just answering questions about it. Per Anthropic's product page, Claude can "navigate, click buttons, and fill forms on Chrome" — pulling numbers from an analytics dashboard, organizing Google Drive files, or logging a sales call to a CRM without you switching tabs. It also connects to Claude Code, so an agent can drive a live page as part of a development or testing loop, and to Cowork for turning web research into finished documents.

For people building software, the useful part is the feedback loop: an agent that can open your app in a real browser, click through a flow, and read what actually rendered can verify its own changes instead of guessing.

The security caveat is front and center

Anthropic is unusually blunt about the risk. The same product page warns that "malicious actors might try to trick Claude into unintended actions, such as sharing your bank information or deleting important files" — a class of attack called prompt injection, where hidden instructions on a page or in a document hijack the agent's task. Anthropic tells users to start with trusted sites, review sensitive actions before approving them, and watch for unusual behavior, adding plainly that the protections "aren't foolproof."

Those warnings are grounded in the company's own red-teaming. When Anthropic first piloted the extension, Claude took a malicious action in 23.6% of 123 attack scenarios with no safeguards; layered defenses cut that to 11.2% overall, and a specific class of form-field exploits dropped from 35.7% to 0%. Better, but not zero — and Anthropic has said broad, autonomous browsing still carries residual risk.

Not just an Anthropic problem

The timing puts Claude alongside a crowded field of agentic browsers — OpenAI's Atlas with Agent Mode, Perplexity's Comet, Microsoft's Copilot Mode in Edge, and an experimental Gemini agent in Chrome. Every one of them faces the same structural issue. OpenAI has said outright that prompt injection is "unlikely to ever be fully 'solved,'" and shipped an adversarially trained model for Atlas in response to new attacks found in internal testing.

The practical takeaway for anyone turning on a browser agent this week: treat it like a powerful but gullible assistant. Keep it on sites you trust, approve consequential clicks yourself, and never leave it logged into your bank or your production console while it browses the open web. The convenience is real; so is the blast radius when a page lies to it.