Claude for Chrome: what it does, and a careful first week

What it does in your browser

Claude in Chrome is a browser extension that lets Claude read, click and navigate websites alongside you (Anthropic help). Open the side panel and Claude sees the page you are on. It can read it, click, type, move between pages and fill in forms.

Drag tabs into Claude's own tab group and it works across all of them at once. Save a prompt that worked as a shortcut, and call it back by typing / in the chat. Anthropic says Claude already knows its way around Slack, Google Calendar, Gmail, Google Docs and GitHub. Background tasks keep running while you switch tabs, as long as Chrome is open.

On Pro, Max and Team, the side panel runs as a Claude Cowork session. On Enterprise it does where your admin has turned it on. Your chats are saved to your history, and your skills, plugins and connectors work there too. A Claude skill you already built is there in the side panel with nothing extra to set up.

It costs plan usage. Anthropic's troubleshooting page says browser work is more compute heavy than a normal chat, so expect it to use more of your limit (troubleshooting).

Install it and grant access

You need a paid plan (Pro, Max, Team or Enterprise). Open Google Chrome, find Claude in Chrome in the Chrome Web Store and click Add to Chrome. Sign in with your Claude account, then pin it with the puzzle piece icon and the thumbtack next to Claude. Other Chromium-based browsers are not supported, and neither are phones.

Chrome then asks you to grant permissions. Read the list before you click. The one that matters most is debugger, which Anthropic says is what lets Claude actually control your browser, clicking, typing and taking screenshots.

To drive Chrome from the Claude Desktop app, click your initials, then Settings, then Customize, then Connectors. Find Claude in Chrome and click Configure. That connector is off by default in each chat, so you turn it on per conversation.

On Team and Enterprise, the owner controls it under Organization settings > Claude in Chrome (admin controls). On Team plans the extension is on by default. Owners can also set an allowlist (the sites Claude is permitted to use) and a blocklist (sites it should never touch). Anthropic's advice to owners is to start with a restrictive allowlist and widen it as you get comfortable.

The three permission modes

You pick the mode from a drop-down on the chat input (permissions guide). In Anthropic's words:

• Manually approve. "Claude pauses and asks for approval before each action." In the Cowork side panel each request gives you Allow all for this website, Allow this time only, or Deny.
• Automatically approve. "Claude keeps working and reviews each action for safety, automatically blocking anything it determines to be unsafe and pausing to ask you when needed." This is the side panel default.
• Skip all approvals. "Claude doesn't pause to ask and nothing checks its actions automatically." Anthropic says to use it only when you completely trust every action, connector, file and app in the task.

What it will always ask about, and what it won't do

Three actions need your yes in every mode: granting an authorization, changing permission settings and entering potentially sensitive information into a page. On a site set to Always allow, Claude also asks before it downloads a file.

Some it won't do at all. The permissions guide lists making purchases, creating accounts, permanent deletions such as emptying trash or deleting emails, and completing instructions from emails or web content. That last one is the guard against a page that tries to give Claude orders.

You can see and revoke the sites you have approved. Click the extension icon, then the three dots, then Extension settings, and you land on the Permissions page.

Anthropic's own safety warnings

Anthropic is blunt about this, so here it is in its words. Its getting-started page says: "Claude in Chrome is enhanced with our safety classifiers but is still risky."

Its safety page names the main risk: "The biggest risk facing browser-using AI tools is prompt injection attacks where malicious instructions hidden in web content (websites, emails, documents) could trick Claude into taking unintended actions." It adds: "The risk is not zero." Anthropic says its current setup brought attack success under 0.08 percent in its own internal testing against known attack techniques (safety page). Low, and still above zero.

Then the part an advisor should read twice. Claude takes screenshots of the tabs it works in, and "Whatever is visible in one of those tabs is captured in the screenshots and becomes part of the conversation." Claude can't filter sensitive content out of what it sees. Anthropic strongly advises against using it on work accounts with sensitive company data, on sites with other people's personal information, on legal documents or contracts, and on financial accounts. Its section on your responsibility opens with "You remain responsible for all browser actions taken by Claude performed on your behalf."

The product page puts it in plainer words. Skip banking, health records and anything with credentials you wouldn't share (product page).

Where Anthropic's pages disagree

Anthropic's own pages disagree on three points today. When they differ, take the stricter reading and go by what the extension shows you.

• Financial sites. The safety page says Claude asks for permission before it opens financial sites. The troubleshooting page lists financial services, banking and investment platforms as blocked by default.
• Sensitive information. The safety page lists inputting sensitive data as something Claude is prohibited from. The permissions guide says it needs your explicit permission instead.
• Beta or not. The product page says it is now generally available. The safety page still says it is in beta in the Chrome browser.

Your first week, written down

Here's what I'd do before Claude in Chrome goes anywhere near a client. Anthropic's own tips are to use a separate browser profile without access to sensitive accounts, and to start with simple tasks like research or form filling. This plan puts those tips into a week.

On Pro or Max you have no admin allowlist, so the separate Chrome profile works like a blocklist. If a site isn't signed in there, Claude can't reach your account on it. Copy this into your notes and fill it in as you go.

CLAUDE IN CHROME: FIRST WEEK
Plan (Pro / Max / Team / Enterprise):
Chrome profile used for Claude:
Start date:

DAY 1: SET UP
[ ] Make a new Chrome profile just for Claude.
    Do not sign it in to email, banking, CRM or client portals.
[ ] Install Claude in Chrome in that profile only. Pin it.
[ ] Set the mode to Manually approve for the whole week.
[ ] Team or Enterprise owner: Organization settings >
    Claude in Chrome. Add only this week's test sites
    to the allowlist.

SITES TO ALLOW THIS WEEK (use Allow this time only)
- Public pages you already trust: a vendor's pricing page,
  a news site, a public directory
- One test doc or form you made yourself, with no client
  names in it

SITES TO KEEP OUT OF THIS PROFILE
- Email, calendar and CRM that hold client records
  (use a connector for those)
- Banking, brokerage, payroll and tax portals
- Client portals, data rooms, e-signature tools
- Any page with another person's personal details
- Admin consoles and password managers

KEEP ON ASK FIRST (never Allow all for this website)
- Sending a message or posting anything
- Submitting any form
- Downloading a file
- Entering personal or account details
- Granting a sign-in or authorization
- Changing or deleting any record

THREE TEST TASKS (one a day, watch every step)
1. Research. Open these three public pages: ____ ____ ____
   Put each one's price and what it includes in a table.
   Give me the link for every number.
2. Compare tabs. Drag three public articles into Claude's
   tab group. One short paragraph on each, with its link.
3. Fill a test form. Use a form you made, with made-up
   details. Stop before Submit and show me what you entered.

AFTER EACH TASK, WRITE DOWN
- Sites it asked to open:
- Requests I didn't expect:
- Did it stop where I told it to?
- Plan usage left afterwards:

STOP THE TASK AT ONCE IF CLAUDE
- Starts talking about something unrelated
- Opens a site I didn't name
- Asks for sensitive information
Then report it with the in-chat feedback.

END OF WEEK
- One public-site task to try in Automatically approve:
- Task that belongs in a connector instead:
- Next check date:

Client records go through a connector

Anthropic's safety page puts work accounts with sensitive company data on its list of things to avoid. For an advisor, that covers the inbox, the calendar and the CRM. In my workshops I connect Claude to the tools a client already uses, on their own account, and a connector is the route I'd use for those three. That guide shows how to add one and set what each of its tools may do.

Keep the browser for the public web and for your own pages that hold no client names. If you want Claude drafting replies in your inbox, the email assistant guide does that through a connector too.

What this plan won't do

It won't make Claude in Chrome safe for client data. Anthropic still advises against it on sensitive company accounts, and a week of clean test runs doesn't change that.

The screenshots keep happening too. Whatever is on screen in a tab Claude is working in goes into the chat, and side panel sessions are saved to your history. Anthropic's tip is to avoid opening the side panel on pages showing information you don't want stored with the session.

Regulated data is a separate question this plan doesn't answer. Zero data retention is not supported for Claude in Chrome. In organizations with HIPAA turned on, Anthropic says Claude in Chrome is not covered under the Business Associate Agreement, even after an Owner turns it on.

Anthropic's own pages already disagree on the three points above. Re-read the pages linked above before you widen anything.

Questions