Anthropic announced on August 26, 2026 that Claude in Chrome is now generally available, ending the pilot-only access the browser extension launched with a year earlier. The extension does two things: it is a sidebar that can see the page a user is reading, and it is an agent that can act on it — clicking links, typing text, filling out forms, and navigating across multiple tabs using the user's existing logins.
The change that defines general availability is autonomous execution. Claude can now carry out a sequence of browser actions without requiring approval at every step, a behavior gated instead by a safety classifier that checks each action before it runs. Anthropic describes a three-layer defense: expanded adversarial training against prompt-injection attempts, probes that screen web content for hidden instructions before Claude acts on a page, and action-verification classifiers that cross-check an intended action against the user's original request.
Anthropic reported the results of testing against professional red-teamers under this setup: "no attacks succeeded against Claude Sonnet 5, Claude Opus 5, or Claude Mythos 5" when probes and the safety classifier were both active. That is a marked shift from where the project started. When Anthropic first piloted Claude for Chrome with 1,000 Max-plan users in August 2025, it disclosed "a 23.6% attack success rate when deliberately targeted by malicious actors" in browser use without safety mitigations, a figure the pilot's early defenses cut to 11.2% at the time, according to Anthropic's original pilot post.
Claude in Chrome is now available on every paid Claude plan. Anthropic notes it does not yet run on non-Chromium browsers or on mobile, and that using Claude with local files on a computer still requires the separate Claude desktop app.
What it means for brands
This is a signal that agentic browsing — an AI system that doesn't just answer a question but clicks, fills forms, and completes tasks on a live website — is moving from a novelty into a standard paid-tier feature, alongside Perplexity's Comet and the browser features OpenAI has been folding into ChatGPT since discontinuing its standalone Atlas browser. As that category grows, a meaningful share of the traffic hitting a brand's site may come from an AI agent acting for a person, rather than from the person directly clicking through a page.
That changes what "usable" means for a web page. A checkout flow, contact form, or account-creation process now has two audiences: humans and autonomous agents acting on their behalf. Interfaces that are hard for automated tools to parse — CAPTCHAs, non-standard field labels, multi-step flows that depend on JavaScript timing — can block a legitimate customer's AI agent as easily as they block a scraper. Brands that haven't tested whether their key conversion flows actually work when an agent like Claude drives them are optimizing for only part of their real traffic.
Attribution gets harder, too. Because Claude in Chrome operates inside the user's own logged-in browser session rather than as a separate bot or a chatbot referral link, activity it generates can be indistinguishable from a normal human session in standard analytics — unlike a click from a ChatGPT or Perplexity citation, which typically arrives as identifiable referral traffic.
Unlike Perplexity's Comet or OpenAI's product-discovery features in ChatGPT, Anthropic has not attached a shopping or advertising layer to Claude in Chrome; the framing here is general productivity and safety rather than commerce. That likely makes it a lower priority than Perplexity or ChatGPT for pure e-commerce optimization in the near term, but still relevant anywhere a brand relies on web forms — lead generation, support, account management, B2B procurement — that an agent might now complete on a customer's behalf.
What to watch
Anthropic's attack-success figures so far come from internal red-team testing, not from incidents reported by millions of ordinary paid users running the agent against arbitrary sites in the wild; whether that safety record holds at general-availability scale is the open question. Watch also for whether Claude in Chrome expands beyond Chromium browsers or onto mobile, which would substantially widen its reach.
It's also worth watching whether publishers start distinguishing agent-driven traffic from human traffic in their own analytics, or whether Anthropic offers site owners any control over how Claude interacts with their pages — something roughly analogous to the opt-out toggle Google just finished rolling out in Search Console for AI Overviews. Finally, watch adoption of Claude in Chrome's workflow-recording feature, which lets a user teach Claude a task once and have it repeated — a capability that could turn routine actions like form submissions or price checks into recurring automated visits brands will need to recognize and handle.
