Defending Against Prompt Injection: How Anthropic Hardens Claude in Chrome

Browser-based AI agents promise real productivity gains—reading pages, filling forms, navigating tabs, and completing multi-step tasks with a user’s existing logins. They also introduce a serious new attack surface: prompt injection.

When an agent processes untrusted web content, hidden instructions can hijack its behavior. Anthropic has spent the past year building layered defenses for Claude in Chrome (now integrated into the Claude Cowork side panel). Here’s how those defenses work, what they achieve, and where the residual risk remains.

What Page-Based Prompt Injection Looks Like

Prompt injection occurs when an AI treats data as instructions. In a browser agent, the data is everything the model can see: page text, DOM attributes, tab titles, URLs, emails, screenshots, and even images.

Attackers hide commands in:

  • Invisible or low-contrast text
  • HTML comments, form fields, or attributes
  • Fake conversation history or “system” messages
  • Visual elements designed to be read by the agent but ignored by humans

A typical scenario: a user asks Claude to summarize recent emails. One message contains white-on-white text instructing the agent to forward confidential messages or export data. Because the agent operates inside the user’s authenticated session, a successful injection can lead to data exfiltration or unauthorized actions without the user noticing.

Browser agents amplify the problem. The attack surface is enormous—every page, ad, and dynamic script is a potential vector—and the agent can take consequential actions such as clicking, submitting forms, or downloading files.

Anthropic’s Multi-Layered Defenses

Anthropic does not claim to have solved prompt injection. Instead, it has stacked several independent safeguards.

Model-level robustness
During training, Claude is deliberately exposed to simulated injections embedded in web-like content. Reinforcement learning rewards the model for detecting and refusing malicious instructions, even when they sound urgent, authoritative, or claim to override safety rules. Newer models in the Opus 4.x series show markedly stronger resistance than earlier versions.

Content classifiers
Every piece of untrusted content entering the model’s context is scanned before it can influence behavior. These classifiers look for adversarial patterns—hidden text, manipulated images, deceptive UI elements—and flag or neutralize them.

Action screening
A second check evaluates every proposed action before execution. In the default “Automatically approve” mode used by the Cowork side panel, Claude proceeds with low-risk steps but blocks or pauses for confirmation on anything that appears unsafe or inconsistent with the original user request. High-risk operations (purchases, sharing personal data, irreversible changes) still require explicit human approval regardless of mode.

User and administrative controls

  • Per-site permissions that can be granted or revoked at any time
  • Allowlists and blocklists (especially useful for Team and Enterprise admins)
  • Default restrictions on certain high-risk categories of sites
  • Hard prohibitions on specific dangerous actions

These layers operate together. Content is filtered on the way in; the model is trained to resist residual injections; and actions are reviewed on the way out.

Measured Progress

Anthropic has published internal evaluation results. Early testing of browser use without mitigations showed an attack success rate of roughly 23.6% across a suite of 123 cases. Adding the layered defenses reduced that figure substantially. On a focused set of browser-specific attack types, the success rate dropped to 0% in one evaluation. More recent tests with current models and classifiers report success rates under 1%, and in some configurations below 0.08%, against adaptive “Best-of-N” attackers.

These numbers represent meaningful progress. They do not mean the risk is zero. Novel techniques continue to appear, and independent researchers have demonstrated residual vulnerabilities in earlier versions of the extension.

Practical Guidance for Users

Anthropic’s own safety documentation emphasizes human judgment alongside the technical controls:

  • Begin with sites you already trust. Avoid unfamiliar pages or those heavy with user-generated content until you understand the agent’s behavior.
  • Prefer manual approval mode, or closely monitor automatic mode, when working with sensitive data.
  • Consider a separate browser profile that has no access to banking, health, government, or other high-value accounts.
  • Watch for sudden changes in behavior—unexpected sites, unrelated topics, or requests for sensitive information—and stop the task immediately.
  • Start with simple, low-stakes tasks before moving to complex multi-step workflows.

Enterprise administrators can further restrict the feature with organization-wide allowlists and the ability to disable the extension entirely.

The Road Ahead

Prompt injection remains an active research problem. As agents gain more autonomy and access to more tools, the incentive for attackers grows. Anthropic has stated it will continue red-teaming, refining classifiers, and publishing progress transparently.

For now, Claude in Chrome is usable and significantly safer than an unprotected browser agent. The combination of model training, runtime classifiers, action gating, and user controls lowers the practical risk. It does not eliminate it. Users who treat the agent as a powerful but fallible collaborator—rather than a fully trusted autonomous worker—will get the most value while staying on the safer side of the trade-off.

The technology is advancing quickly. The security challenge is advancing with it.