Claude in Chrome is now on every paid plan

Claude in Chrome now runs on all paid Claude subscriptions, with three ways in: the browser side panel, Claude Cowork and Claude Code. The extension reads the page a user is signed in to, then clicks, types and fills forms, according to Claude's product page.

At a glance

• The side panel now hosts a full Claude Cowork session, so skills, plugins and connectors built elsewhere are available in the browser with no separate setup step required.
• Before Claude acts on a page, a separate safety check scores the action for risk and scans for instructions hidden by the site, surfacing anything that looks wrong.
• Team and Enterprise administrators can switch the extension on or off across an organization and set site allowlists and blocklists, while Permissions Mode grants access one site at a time.

Why it matters The paid-plan expansion appears to move browser automation from a Max and Team experiment into a default surface for every subscriber, which shifts the exposure profile as much as the feature set. Anthropic's own framing puts weight on the user: the classifiers are described as a defence rather than a guarantee, and the recommended habits read as an acknowledgement that prompt injection is still unsolved.

Three entry points split the work between the side panel, Claude Cowork and Claude Code

The side panel is meant for work that sits on the page already open and needs nothing else. Claude Cowork covers jobs where the browser is one step in a longer chain, and Claude Code is aimed at testing a site under development.

Paired with Claude Cowork, Chrome becomes the research layer. Claude navigates and gathers information, and Cowork turns it into Excel workbooks, PowerPoint decks and formatted reports without copying between windows. Cowork users can also enable Claude in Chrome as a connector and start the task from Cowork.

The extension targets the web that has no API, using the logins already in the session

Anthropic lists internal tools, legacy portals, admin consoles and invoice systems as targets: the extension operates on the tab in front of the user, with the credentials that browser already holds. Dragging further tabs into Claude's tab group extends a task across all of them.

The published examples include pulling numbers from an analytics dashboard into a summary, restructuring folders in Google Drive and flagging duplicates, reading a calendar and booking missing rooms, matching meeting attendees to Salesforce contacts for draft activity logs, and collecting promotional email into a list for bulk deletion.

Tasks run in the background, and sessions are stored with the account rather than the machine, so a conversation started in Chrome continues on desktop or mobile without re-explaining the context. A skill saved in the panel runs from any surface as well.

A separate safety check reviews every action before Claude touches the page

Claude can work through a task without asking for approval at each step if the user allows it. Before it acts, a separate check reviews the action for risk and for instructions hidden by the site, and surfaces anything that seems off. Purchases, financial actions and other one-way doors wait for confirmation.

Anthropic recommends skipping banking, health records and anything with credentials the user would not share, and starting with familiar workflows on trusted sites. The company states that the protections are not foolproof, that attack vectors keep evolving, and that Claude may hallucinate into actions nobody intended.

The company has published its testing results, including possible attack scenarios, alongside guides on permissions, safe use and prompt-injection mitigation. Issues reported through the feedback options are how it catches attacks it has not seen before, per its own documentation.

What's next The move to all paid plans closes the gap left after the Max and Team rollout, when Pro access had been described as arriving in the coming weeks. The product page does not list usage limits for browser tasks by plan, and it does not address browsers other than Chrome. Distribution stays through the Chrome Web Store, where data received from Google APIs falls under the Limited Use requirements.