在浏览器中给 Claude 布置任务，跨标签页操作，并在桌面端、移动端和网页应用中继续对话。
添加到 Chrome
添加到 Chrome添加到 Chrome
Category [Product announcements](https://claude.com/blog/category/announcements)Product [Claude Cowork](https://claude.com/product/cowork) Claude appsDate August 26, 2026Reading time 5 minShare [Copy link](https://claude.com/blog/claude-in-chrome-generally-available#)https://claude.com/blog/claude-in-chrome-generally-available
Claude in Chrome 现已面向所有付费 Claude 套餐全面开放。Claude 现在还可以在浏览器中自主执行操作，而无需对每一步都请求批准。在执行每个操作之前，安全分类器都会对其进行验证，以确保操作安全且符合你的请求。
你日常使用的许多工具都能连接 Claude。但还有更多工具无法连接，例如内部仪表盘、遗留系统和供应商门户。Claude in Chrome 让 Claude 能够访问这些工具。它可以查看你当前所在的页面，并执行诸如阅读和输入文本、点击链接、在页面之间导航以及填写表单等操作，同时使用你现有的登录状态。
我们去年首次将 Claude in Chrome 作为试点项目发布，以便在测试的同时加强我们针对提示注入的防御能力：提示注入是指隐藏在网站、电子邮件或文档中的恶意指令，试图诱骗 AI 智能体做出违背用户意愿的行为。下文所述的这些防御措施，让我们有信心将 Claude in Chrome 全面开放。
防范提示注入
正如我们在发布试点时所述，在浏览器中工作的 AI 智能体同样容易受到提示注入的攻击。因此，在更广泛地发布 Claude in Chrome 之前，我们一直在努力改进防护措施。
在提示注入攻击中，恶意行为者会将指令隐藏在网页、电子邮件或表单字段等网络内容中。你可能永远看不到这些指令，但它们可以引导智能体去做你从未要求过的事情。例如，如果你让 Claude 起草邮件回复，某条消息中隐藏的指令可能会告诉 Claude 将你的其他邮件转发给攻击者。
在发布时，我们描述了如何测试 Claude 针对这些攻击的防御能力以及当时已部署的安全防护措施；随后，我们又发布了关于浏览器使用安全防护措施的更详细说明。自那以后，我们改进了模型和探针的训练方式，并增加了一组额外的分类器，使 Claude 能够在 Chrome 中安全地执行更多自主操作。在下一节中，我们将讨论评估结果，这些结果显示了上述安全防护措施的有效性。
**Claude 能识别更多攻击。** 我们针对不断扩充的提示词注入攻击库来训练 Claude，这些攻击样本来自内部自动化攻击者、外部红队以及真实世界监控。当一种新攻击对当前模型奏效时，它就会被加入攻击库，用于指导未来模型的训练和已部署安全防护措施的改进，使其学会识别这种攻击。自我们于 2025 年 11 月首次撰文介绍针对浏览器使用的提示词注入防御措施以来，Claude 对这些攻击的抵抗力已显著增强。
探针会在 Claude 采取行动前对网页内容进行筛查。网页内容通过工具结果传递给 Claude。要执行读取页面或打开电子邮件等操作，模型需要发起工具调用；工具结果让模型能够读取输出（在此场景下，即页面或电子邮件的内容）。我们训练探针扫描这些结果，以发现潜在的提示词注入。当探针检测到可能的攻击时，Claude 会收到警告，要求其对内容保持警惕，并在必要时先与你确认再采取行动。我们最初在 Claude Opus 4.5 中部署了这些探针，此后已扩展了它们所覆盖的攻击类型。
操作在执行前会经过验证。在 Chrome 中的 Claude 里，Claude 现在会自动批准其判定为安全的操作，其机制与 Claude Code 中的自动模式相同。（如果你更倾向于继续手动批准 Claude 的操作，可以在设置中关闭此功能。）一个分类器会审查 Claude 即将执行的操作，例如导航到新网站或在页面中输入文本，并将其与你最初提出的请求进行核对。如果操作与你的请求不符，该操作将被阻止。
衡量 Claude 对提示词注入的鲁棒性
我们已对这些防护措施进行了测试，以确保 Claude in Chrome 在基于浏览器的任务中可安全使用。在此，我们报告最新评估的结果。
在我们最初的评估中，测试了 Claude Cowork 对提示词注入攻击的抵御能力（该评估最初是在我们发布 Claude in Chrome 试点时开发的），在 Cowork 测试环境中，即使没有上述探针和分类器，也没有任何攻击能够成功突破 Claude Fable 5、Claude Opus 5 或 Claude Sonnet 5。
针对 Claude Opus 4.5、Sonnet 5、Opus 5 和 Fable 5 的提示词注入攻击成功率。Opus 4.5 在运行扩展思考模式下进行测试，因为它不支持我们较新的默认自适应思考模式。所有其他模型均以中等强度的自适应思考作为默认模式运行。我们在 2025 年 11 月博客文章中讨论的结果是在未启用扩展思考的情况下运行的，但由于 Fable 5 无法关闭思考功能，我们在此报告的是启用思考功能的结果。11 月份使用的评分模型也已不再可用，因此我们转而采用更强大的评分流程，并结合对成功攻击的人工审查，这样可以减少误报。
由于该评估已经饱和（0% 的成功率即为证明），我们决定将其退役。在我们当前的评估中，使用了由专业红队人员提供的更强攻击手段，在未采取任何额外防护措施的情况下，到达模型的攻击对 Opus 4.5 的成功率为 17.6%，对 Opus 5 的成功率为 3.8%。在 2025 年 11 月可用的最强防护措施下，使用探针运行的 Opus 4.5 遭受攻击的成功率为 16.7%。对于从 Opus 4.8 开始的每一个模型，在运行探针和安全分类器的情况下，针对 Claude Sonnet 5、Claude Opus 5 或 Claude Mythos 5 的攻击均未成功。针对 Fable 5 的攻击成功率为 0.3%。我们已人工核实，所有成功的突破均属于低严重性场景，目前正在努力加以缓解。
在加入探针和自动审批安全分类器后，针对 Claude Sonnet 5 和 Opus 5 的攻击无一成功，而针对 Fable 5 的攻击成功率为 0.3%。Opus 4.5 的模型行为使得到达模型的攻击数量较少，但其攻击成功率仍然最高。
提示词注入仍然是一个不断变化的目标。虽然这种方法能够防御当前的攻击，但我们还需要确保我们的防护措施能够领先于攻击者不断演变的手法。随着每个模型的发布，我们持续投入开发更复杂的自动化攻击发现系统、红队测试以及构建更强的分类器。
快速上手
要在 Chrome 中使用 Claude，请从 Chrome 网上应用店安装。在企业版套餐中，管理员可以在组织设置中对其进行管理，并将其限制在已批准的域名内。请参阅管理员设置指南。
你仍然需要使用 Claude 桌面应用来处理电脑上的文件或与其他应用程序交互。Claude in Chrome 目前还不能在其他 Chromium 浏览器或移动设备上运行。
¹ 并非所有攻击都能到达——即被模型看到——模型。在某些情况下，Claude 所采取的行动使其永远不会遇到恶意指令。
Give Claude a task in your browser, work across tabs, and continue the conversation in the desktop, mobile, and web apps.
Add to Chrome
Add to ChromeAdd to Chrome
Category [Product announcements](https://claude.com/blog/category/announcements)Product [Claude Cowork](https://claude.com/product/cowork) Claude appsDate August 26, 2026Reading time 5 minShare [Copy link](https://claude.com/blog/claude-in-chrome-generally-available#)https://claude.com/blog/claude-in-chrome-generally-available
Claude in Chrome is now generally available on every paid Claude plan. Claude can now also take actions autonomously in the browser, instead of needing approval for every one. A safety classifier validates each action before it’s performed to ensure it’s safe and matches your request.
Many of the tools you use every day connect to Claude. But many others don’t, such as internal dashboards, legacy systems, and vendor portals. Claude in Chrome lets Claude access those. It can view the page you’re on and take actions like reading and typing text, clicking links, navigating between pages, and filling out forms, using your existing logins.
We first announced Claude in Chrome as a pilot last year, so we could test it while also shoring up our defenses against prompt injection: malicious instructions hidden in websites, emails, or documents that try to trick an AI agent into acting against the user’s wishes. These defenses, described below, give us the confidence to make Claude in Chrome generally available.
Safeguarding against prompt injection
As we outlined when we announced the pilot, an AI agent that works in your browser is also vulnerable to prompt injection. So we’ve worked to improve our safeguards before releasing Claude in Chrome more widely.
In a prompt injection attack, malicious actors hide instructions in web content such as a web page, an email, or a form field. You may never see them, but these instructions can redirect the agent to do something you never asked for. For example, if you’ve asked Claude to draft replies to your emails, a hidden instruction in one message could tell Claude to forward your other emails to the attacker instead.
At launch, we described how we tested Claude’s defenses against these attacks and the safeguards we had in place at the time; we later released a more detailed description of our browser-use safeguards. Since then, we’ve improved how we train both the model and our probes, and added an additional set of classifiers that make it possible for Claude to safely take more autonomous actions in Chrome. In the next section, we discuss the results of our evaluations, which show the efficacy of these safeguards.
**Claude recognizes more attacks.**We train Claude against a growing library of prompt injection attacks, sourced from our internal automated attackers, external red-teamers, and real-world monitoring. When a new attack succeeds against a current model, it’s added to the library, where it informs the training of future models and our deployed safeguards so they learn to recognize it. Since we first wrote about our prompt injection defenses for browser use in November 2025, we’ve made Claude substantially more resistant to these attacks.
Probes screen web content before Claude acts on it. Web content reaches Claude through tool results. To take an action like reading a page or opening an email, the model makes a tool call; the tool result lets the model read the output (in this case, the content of the page or the email). We train probes to scan those results for potential prompt injections. When a probe detects a likely attack, Claude is warned to treat the content with suspicion and, if needed, to check with you before taking an action. We first deployed these probes with Claude Opus 4.5, and have since expanded the types of attacks they cover.
Actions are verified before they run. In Claude in Chrome, Claude will now automatically approve actions it determines to be safe, using the same mechanism as auto mode in Claude Code. (You can switch this off in your settings if you’d prefer to continue to approve Claude’s actions manually.) A classifier reviews actions Claude is about to take, such as navigating to a new website or entering text into a page, and checks them against what you originally asked for. If the action doesn’t match your request, it’s blocked.
Measuring Claude’s robustness against prompt injection
We’ve tested these safeguards to ensure that Claude in Chrome is safe to use for browser-based work. Here, we report the results from our most recent evaluations.
On our initial evaluation testing Claude Cowork’s resilience against prompt injection attacks (first developed when we released the Claude in Chrome pilot), no attack succeeded against Claude Fable 5, Claude Opus 5, or Claude Sonnet 5 in the Cowork harness, even without the probes and classifiers discussed above.
Success rate of prompt injection attacks against Claude Opus 4.5, Sonnet 5, Opus 5, and Fable 5. Opus 4.5 was run with extended thinking, since it does not support our newer default of adaptive thinking. All other models were run with adaptive thinking at medium effort as the default. The results discussed in ourNovember 2025 blog postwere run without extended thinking enabled, but because thinking cannot be disabled for Fable 5, we report thinking-enabled results here. The grader model used in November is also no longer available, so we moved to a more capable grading pipeline combined with manual review of successful attacks, which produces fewer false positives.
Because we saturated that evaluation (as evidenced by the 0% success rate), we decided to retire it. On our current evaluation, which uses stronger attacks sourced by professional red-teamers, attacks that reached the model succeeded against Opus 4.5 17.6% of the time and against Opus 5 3.8% of the time, before any additional safeguards. With the strongest safeguards available in November 2025, attacks against Opus 4.5 running with probes succeeded 16.7% of the time. Against every model from Opus 4.8 onwards, when running with probes and the safety classifier, no attacks succeeded against Claude Sonnet 5, Claude Opus 5, or Claude Mythos 5. We saw a 0.3% attack success rate against Fable 5. We have manually verified that all successful breaks are in low-severity scenarios and are working to mitigate them.
No attacks succeeded against Claude Sonnet 5 or Opus 5 with probes plus the automatic approval safety classifiers, and 0.3% of attacks succeeded against Fable 5. Opus 4.5’s model behavior resulted in a lower number of attacks reaching the model, but it still had the highest percentage of successful attacks.
Prompt injection remains a moving target. While this approach defends against current attacks, we also need to ensure our safeguards stay ahead of the evolving methods of attackers. With each model release, we continue to invest in developing more sophisticated automated systems for attack discovery, red-teaming, and building stronger classifiers.
Getting started
To start using Claude in Chrome, install it from the Chrome Web Store. On Enterprise plans, admins can manage it in Organization Settings and limit it to approved domains. See the admin setup guide.
You’ll still need to use the Claude desktop app to work with files on your computer or with other applications. Claude in Chrome doesn’t run on other Chromium browsers or on mobile yet.
¹ Not all attacks reach—i.e., are seen by—the model. In some cases, the actions Claude takes result in it never encountering the malicious instructions.