Claude in Chrome is an official Anthropic extension that adds a side panel to the browser. Claude reads the page in front of you, clicks, types and fills forms while you keep control. The difference with an agent hosted elsewhere fits in one sentence. It works inside your session, already signed in to your tools.
This guide covers the install, the plans that unlock it and the three permission modes. It also covers the actions the extension refuses to perform and the guardrails to set before a team rollout. Tandem supports more than 50 companies on their artificial intelligence rollouts, and the permissions question always lands before the use-case question.
What exactly is Claude in Chrome?
Claude in Chrome is a browser extension published by Anthropic under the name Claude in Chrome. It adds a side panel that sees the content of the active tab and can act on it. You hand it a task, it runs while you do something else, and you can group several tabs to give it more context.
Anthropic positions the extension on specific ground, the tools that have no programming interface. A supplier portal, an admin console, an internal billing system. Wherever a clean integration does not exist, the browser remains the only way in.
Installing the Claude extension in Chrome
The install takes under two minutes and follows four steps. The browser must be desktop Google Chrome. Other Chromium-based browsers and mobile devices are not supported.
- Open the Chrome Web Store and install the Claude extension published by Anthropic.
- Sign in with your organisation's Claude account.
- Pin the extension through the puzzle icon, then the pin, otherwise you will lose it in the menu.
- Grant the permissions requested at install, then set the permission mode before the first task.
The extension asks for around fifteen Chrome permissions. Three deserve a pause. The debugger permission lets it click, type and take screenshots. The scripting permission lets it read page text. The tab permissions let it open, close and group your windows.
Which plans unlock Claude in Chrome?
The extension is limited to paid plans. It has no separate price and consumes your plan's usage limits. As checked in November 2026, it is available on Pro, Max, Ultra, Team and Enterprise, and absent from the free tier.
| Plan | Extension access | Admin controls |
|---|---|---|
| Free | No | Not applicable |
| Pro, Max, Ultra | Yes | Per-site permissions, managed by the user |
| Team, Enterprise | Yes, switched on by an owner | Allowlist and blocklist for the whole organisation |
On Enterprise, an account owner has to switch the extension on, otherwise the side panel stays in its classic version. For the detail of the plans and their limits, the subscription grid stays current on its own.
The three permission modes, and the one to avoid
The permission mode decides everything. It is set in the side panel and carries over between sessions. Three options exist, from the most careful to the most exposed.
- Manual. Claude asks for your approval before every action, and first proposes a plan listing the sites it wants to reach.
- Automatic. Claude chains actions, a safety check reviews each one, blocks those it judges dangerous and prompts you when needed.
- Skip approvals. Claude waits for nothing and no automatic check runs. Keep it for tasks you are completely sure about.
A per-site layer sits on top. A prompt appears when a site requires approval, and you choose to allow that single action, to allow every action on that site, or to refuse. Even with a standing allowance, Claude asks again before downloading a file or entering sensitive information, as the permissions guide spells out.
What the extension refuses to do, in every mode
A list of actions stays blocked in all three modes, including the one without approvals. It is the most useful guarantee to keep in mind before opening the extension to a team.
- Purchases, financial transactions and account creation.
- Entering bank card or identity document data.
- Permanent deletions, whether of emails, files or messages.
- Downloads from untrusted sources and changes to system files.
- Executing instructions found in an email or in page content.
Why an agent in the browser rather than an agent in the cloud
A classic web agent runs in a remote window. It lacks context, you have to hand it the credentials, and you watch it work without being able to take back the keyboard. The browser agent starts from the opposite place. It inherits your open sessions, sees the tabs you give it and hands control back at any moment.
I tested that shift in detail on Perplexity's browser, and the finding holds for Anthropic's extension. An agent working in your own window already knows your accounts, so it stops asking for what it could read by itself. I laid out the comparison in an article about AI browsers.
Three business uses that justify the extension
Consumer demos revolve around page summaries and travel booking. Inside a company, three situations make the extension genuinely useful.
- A tool with no programming interface. Supplier portal, banking extranet, legacy line-of-business software. The extension replaces rigid automation with an agent that reads the screen and adapts.
- An interface that changes often. A classic script breaks the first time a button moves. An agent that looks at the page holds up better.
- A task spread across several tabs. Matching an order, an invoice and a customer record takes a human ten minutes and an agent a few seconds, because it sees all three pages.
As soon as a programming interface exists, the trade-off flips. A connector through an MCP server is faster, steadier and far easier to audit than an agent that clicks.
Prompt injection, the risk that does not go away
An agent that reads web pages also reads the instructions an attacker hides in them. That is prompt injection, and it is the main risk of the whole category. Anthropic published its own numbers when it launched the research pilot in August 2025, across 123 test cases covering 29 attack scenarios. With no mitigations, 23.6% of attacks succeeded in autonomous mode. With the added mitigations, the rate drops to 11.2%, and to zero on four browser-specific attack families.
Eleven percent is still a long way from zero, and Anthropic says so plainly. The tested attacks included form fields hidden in the page code, invisible to a human. Others slipped instructions into a tab title or a web address.
The problem reaches well beyond Anthropic. OpenAI says the same about its own browser, and the United Kingdom's national cyber security centre reckons prompt injection will never be fully solved. A browsing agent therefore ships with a perimeter defined in advance.
The rules we set on our engagements fit in three lines. No access to banking tools and health data. Automatic mode by default, never the skip mode. And a human validation on anything that leaves the company. The full grid lives in our guide to securing an AI agent.
What an administrator should lock down before rolling it out
On Team and Enterprise, two settings do most of the work. The allowlist limits Claude to approved sites, and nothing else opens. The blocklist bars sites whatever permissions the user granted.
The rollout order that works starts small. Open an allowlist of five to ten business domains, let it run for two weeks, watch what teams ask for next, then widen it. The opposite, opening wide then restricting, produces settled habits you have to take away from people who adopted them.
The extension or the desktop app, which one to open?
In my Claude tips posted on LinkedIn in July 2026, the first line recommends the desktop app over the browser. It still holds for deep work, context folders and long tasks. The extension plays on other ground, the tasks that live in a tab and die with it.
The simple rule we give in training fits in one question. If the task needs your files and your context, open the app. If it needs a site where you are already signed in, open the extension.
Should you roll out Claude in Chrome in your company?
Yes, on a closed perimeter, and only once permissions are set before the first task. The extension solves a real problem, the business tools no integration covers, and it solves it in minutes where an automation project takes weeks.
It replaces neither a clean connector when one exists, nor the desktop app for deep work. And it demands a discipline most organisations discover on the way. A short allowlist, a dedicated Chrome profile, and nobody in skip mode.
