Claude can now drive your browser. Is it safe to let it?
Is it safe to let AI use your browser? It stopped being a hypothetical on 26 August, when Anthropic moved Claude in Chrome out of preview and onto every paid Claude plan. Install the extension and Claude can read the page you're on, click links, fill in forms and type — using the accounts you're already logged into. That last clause is the whole story.
The pitch is aimed squarely at the systems a small business can't automate any other way: the supplier portal with no API, the ancient accounting screen, the government form that has to be typed. Claude doesn't need an integration if it can just drive the page like a person would.
Is it safe to let Claude use your browser?
Safe enough for low-stakes work on sites you'd be comfortable showing a new casual employee — and not safe for anything else, which is roughly what Anthropic itself says. Its safety guidance explicitly discourages using it for financial accounts and investments, legal documents and contracts, medical information, work accounts holding sensitive company data, and any site full of other people's personal details.
There are hard stops built in. Claude won't make purchases or move money, create accounts, handle credit card or ID data, or perform permanent deletions. Downloads, entering sensitive information and granting authorisations always need your explicit tick, whatever mode you're in. Adult and known pirated sites are blocked outright, though the list is admitted to be incomplete.
The real threat is prompt injection: instructions hidden in a web page or an email, written to hijack the agent while it's logged in as you. Anthropic's numbers are genuinely good — with the full safeguards enabled its red-team suite got nothing through against Sonnet 5 or Opus 5, and 0.3% against the smaller Fable 5, with residual attack success under 0.08% in internal testing. It also prints the sentence that should govern your decision: "the risk is not zero."
How should a small business set up a browser agent?
Our read is that the model isn't the interesting variable — the browser session is. The extension inherits whatever your Chrome profile can already reach. If that profile is signed into Xero, the payroll system, the shared inbox and the CRM, then a single successful injection on some unrelated tab has all of that within arm's reach. The blast radius is a decision you make when you choose which profile to install it in, not one Claude makes later.
So, four things we'd set up before letting it run on a real workflow:
- Give it its own Chrome profile. Signed into exactly the systems the task needs and nothing else. This is the single highest-value control and it takes two minutes.
- Start in Manual Approve. Claude pauses before each action. Tedious, and it's how you find out what it actually tries to do on your particular portal. Auto mode — where a safety check runs on each action instead of you — is a promotion the workflow earns after you've watched it.
- Treat "Skip All Approvals" as read-only. Nothing checks its actions in that mode. Fine for research on pages you can't break; wrong for anything that submits a form.
- Review approved sites monthly. "Always allow actions on this site" is permanent until you revoke it, and the tab that made sense in September will still be approved in March.
On Team and Enterprise plans, admins can allowlist or blocklist domains centrally — worth doing on day one rather than after someone's installed it on the finance machine.
The underlying rule here isn't new, and it isn't specific to Chrome: content the agent reads is data, never instructions. That's the same principle we apply to every client automation that touches an inbox, a scraped page or a customer-submitted form, and it's the first session of our AI training for teams. If you're weighing up where a browser agent fits in your business, or which of your systems should be nowhere near one, see how we approach data and AI projects.