Claude for Chrome: Setup, Limits, and Safety (2026)

To set up Claude for Chrome, install "Claude in Chrome" from the Chrome Web Store, sign in with a paid Claude plan, and open the side panel. Anthropic made the extension generally available on every paid Claude plan on August 26, 2026, and it now approves actions it judges safe automatically, a setting you can switch off (Anthropic, 2026). Claude for Chrome is a browser agent: it clicks, types, and navigates pages for you, and it runs in Google Chrome only, not in other Chromium browsers or on mobile yet. It does not search, organize, or export your Claude chat history; for that, add AI Toolbox (formerly Claude Toolbox), used by 40,000+ people with a 4.7/5 Chrome Web Store rating.

By Adi Leviim, Co-Founder at Infi Developments. 7+ years building AI productivity tools. Last reviewed September 2026.

How to set up Claude for Chrome

Setup takes three steps and a paid Claude plan. Anthropic ships the extension as "Claude in Chrome." The extension itself and the newer Cowork side panel were announced separately and cover different plans, so they are described separately below.

1. Install the extension: open Google Chrome and add Claude in Chrome from the Chrome Web Store. Anthropic states it does not run on other Chromium browsers or on mobile yet.
2. Sign in: sign in to your Claude account. Claude in Chrome is generally available on every paid Claude plan, which Anthropic's Help Center lists as Pro, Max, Team, and Enterprise (Anthropic, August 26, 2026). On Enterprise plans it is off by default until an admin turns it on.
3. Open the side panel: click the Claude icon in the Chrome toolbar. The side panel reads the tab you are on with no extra setup and starts in "Automatically approve" mode. See Anthropic's Get started with Claude in Chrome guide.

If you drive Chrome from the Claude desktop app instead of the side panel, the Claude in Chrome connector there is disabled by default, and Anthropic's guide says to enable it manually for each conversation.

Which side panel you get

On August 12, 2026, Anthropic turned the side panel into a Claude Cowork session: conversations are saved to your history, your skills and connectors work in the browser, and a task started in a tab can be finished in the Claude desktop, web, or mobile app. That Cowork side panel launched on Max and Team plans and is still rolling out to Pro, according to Anthropic's Help Center as last updated August 26, 2026. On Enterprise plans it runs as a Cowork session once an admin enables Cowork in the cloud; until then you get the classic side panel, which is also the only place recorded workflows are available.

Automatic approval: what changed on August 26, 2026

Since August 26, 2026, Claude in Chrome automatically approves actions it determines to be safe, using the same mechanism as auto mode in Claude Code, and a safety classifier checks each action against your original request before it runs. If an action does not match what you asked for, it is blocked. You can switch this off in settings and approve every action manually (Anthropic, 2026).

The August 2025 pilot already offered an experimental "autonomous mode," but users had to opt into it. General availability made automatic approval the default. Anthropic's permissions guide lists three modes, chosen from a menu on the chat input:

• Manually approve (formerly "Ask before acting"): Claude asks for your approval before each action.
• Automatically approve: the default in the Cowork side panel. Claude reviews each action for safety, blocks what it judges unsafe, and pauses to ask when needed. Anthropic notes this mode uses more of your usage limit because of the extra checking.
• Skip all approvals (formerly "Act without asking"): no pauses and no automatic checks. Anthropic says to use it only when you completely trust everything involved in the task.

Some rules hold in every mode. Claude asks for explicit permission before entering potentially sensitive information into a site, granting authorizations, or changing permission settings, and it still asks before downloading a file on sites you have set to "Always allow." It is prohibited from making purchases or financial transactions, creating accounts, handling credit card or ID data, permanently deleting files or messages, and following instructions it finds in emails or web content (Anthropic permissions guide, updated August 12, 2026).

What Claude for Chrome can and can't do

Claude for Chrome is built to act in your browser, not to manage your past conversations. It reads the page you are on, then clicks, types, fills forms, and runs multi-step workflows, useful for pulling figures from an internal dashboard or collecting invoices from vendor portals, using your existing logins. What it does not do is index, search, folder, or export your Claude chat history.

Is Claude for Chrome safe?

Anthropic calls prompt injection the biggest risk facing browser-using AI tools and states plainly that "the risk is not zero." A web page, email, or form field can hide instructions that redirect the agent. Anthropic's own example: if you ask Claude to draft replies to your email, a hidden instruction in one message could tell it to forward your other emails to an attacker.

Anthropic has published attack results twice. Both are its own internal evaluations, not an independent audit, and they use different test suites, so the numbers below are not one trend line and should not be read as a year of progress.

The 2025 pilot evaluation

• The pilot opened to 1,000 Max plan users on August 25, 2025, widened to a beta for every Max subscriber on November 24, 2025, and reached Pro, Team, and Enterprise plans on December 18, 2025.
• Anthropic ran "123 test cases representing 29 different attack scenarios." Without its safety mitigations, browser use showed "a 23.6% attack success rate when deliberately targeted by malicious actors," and adding mitigations reduced that to 11.2%.
• On a "challenge" set of four browser-specific attack types, such as hidden form fields a person cannot see, the new mitigations reduced attack success "from 35.7% to 0%."

The 2026 launch evaluation

• Anthropic retired its earlier evaluation after models reached a 0% success rate on it, and moved to a harder one "which uses stronger attacks sourced by professional red-teamers."
• On that evaluation, "attacks that reached the model succeeded against Opus 4.5 17.6% of the time and against Opus 5 3.8% of the time, before any additional safeguards."
• Running with probes and the safety classifier, "no attacks succeeded against Claude Sonnet 5, Claude Opus 5, or Claude Mythos 5," and Anthropic "saw a 0.3% attack success rate against Fable 5." It says it manually verified that all successful breaks were in low-severity scenarios.

Two caveats matter when reading those numbers. The percentages count only attacks that reached the model: Anthropic notes that some attacks never do, because the actions Claude takes mean it never encounters the malicious instructions. And Anthropic's own summary is that "prompt injection remains a moving target."

Admin controls depend on the plan. Team and Enterprise admins can enable or disable the extension org-wide and set site allowlists and blocklists. On Enterprise plans Claude in Chrome is off by default; admins turn it on and can limit it to approved domains in Organization Settings. Anthropic also states Claude in Chrome is not available to organizations covered by HIPAA.

Anthropic's practical advice is to start on sites you trust, avoid sensitive sites, and consider a separate browser profile without access to banking, healthcare, or government accounts, because Claude takes screenshots of the tabs it works in. Read Use Claude in Chrome safely and the permissions guide before enabling it on anything sensitive.

Want to find, organize, and export your Claude chats? AI Toolbox adds full-text search, folders, bookmarks, and export to claude.ai, trusted by 40,000+ users with a 4.7/5 rating and a free plan. Add AI Toolbox to Chrome →

The gap: managing your Claude conversations

Once you use Claude daily, the missing piece is not automation, it is finding and keeping what you have already discussed. On paid plans you can ask Claude to search your past chats, which it does with retrieval inside the conversation, and inside a project those searches stay within that project. Native export is account-wide: from Settings, Privacy, you request a data export and receive an emailed download link that expires after 24 hours, and on Team and Enterprise plans only the Primary Owner can export (Anthropic Help Center). Claude for Chrome adds neither a searchable index of your history nor per-conversation export.

The AI Toolbox Claude module fills exactly that gap on claude.ai:

• Full-text search across every message, not just titles, with 5 results per query on the free plan. Premium Advanced Search adds Exact Match, include and exclude terms, a date range, and titles only. Search Claude conversations.
• Folders and subfolders to group chats. Claude's own grouping is the Project, a workspace with its own knowledge base and instructions, and free accounts can create up to five. Organize Claude with folders.
• Message bookmarks with scroll-to and highlight. Bookmark Claude messages.
• Export a conversation, folder, or bulk selection to TXT, Markdown, JSON, or PDF; a single chat as TXT is free. Export Claude conversations.

For the full breakdown of how the two tools differ, see Claude for Chrome vs AI Toolbox. Because it is one install, the same search, folders, and export also work in ChatGPT, Gemini, and Grok.

Pricing: free vs Premium

AI Toolbox has a free plan with no credit card required. The free tier includes up to 5 search results per query, 2 folders, bookmarks in 2 conversations, and TXT export of a single chat. Premium unlocks unlimited search results and folders, up to 1,000 bookmarked messages (200 per conversation), Advanced Search, and every export format including bulk export.

• Free: 5 search results per query, 2 folders, bookmarks in 2 conversations, TXT export of a single chat.
• Premium: $9.99/month or $99 one-time lifetime, with a 14-day money-back guarantee on the initial purchase.
• All Access Lifetime ($199): the Claude, ChatGPT, Gemini, and Grok modules in one purchase, plus future modules, saving $197 versus buying each Lifetime separately. These are extension modules that add features to each AI, not subscriptions to the AIs, you keep your own accounts. Compare plans.

Frequently asked questions

How do I enable Claude for Chrome?

Install Claude in Chrome from the Chrome Web Store in Google Chrome, sign in with a paid Claude account, and click the Claude icon in the toolbar to open the side panel. The side panel reads the tab you are on with no extra setup. If you use it from the Claude desktop app instead, turn on the Claude in Chrome connector for each conversation, since it is disabled by default there.

What plan do I need for Claude for Chrome?

Any paid Claude plan. Anthropic made Claude in Chrome generally available on Pro, Max, Team, and Enterprise on August 26, 2026; on Enterprise an admin has to turn it on. The side panel running as a Claude Cowork session is a separate rollout that reached Max and Team first and is still rolling out to Pro. AI Toolbox, by contrast, has a free plan and works on any Claude account.

Does Claude in Chrome ask before taking actions?

Not by default since August 26, 2026. It automatically approves actions it determines to be safe, using the same mechanism as auto mode in Claude Code, with a safety classifier checking each action against your request. You can switch this off in settings to approve every action manually.

Is Claude for Chrome safe to use?

Anthropic calls prompt injection the biggest risk for browser-using AI and says the risk is not zero. A safety classifier checks each action, Claude still asks before entering sensitive information or granting authorizations, and it is not allowed to make purchases. Team and Enterprise admins can set site allowlists and blocklists. Anthropic advises avoiding sensitive sites and using a separate browser profile.

Does Claude for Chrome work in other browsers or on mobile?

No. Anthropic states Claude in Chrome does not run on other Chromium browsers or on mobile yet, so you need Google Chrome on a computer. AI Toolbox, a separate extension, runs on Chromium browsers including Chrome, Edge, Brave, Opera, and Arc.

Does Claude for Chrome organize or search my chat history?

No. Claude for Chrome is a browser agent that acts on web pages; it does not search, folder, or export your Claude conversations. For that, use AI Toolbox's Claude module, which adds full-text search, folders, bookmarks, and export to claude.ai.

Can I use Claude for Chrome and AI Toolbox together?

Yes. They do different jobs and do not conflict. Claude for Chrome automates tasks in the browser; AI Toolbox organizes, searches, and exports your Claude chats. Many users run both.

How do I export a single Claude conversation?

Native Claude exports your whole account: Settings, Privacy, Export data, then an emailed link that expires after 24 hours. AI Toolbox lets you export one conversation to TXT on the free plan, or to Markdown, JSON, or PDF on Premium, directly from claude.ai.

The bottom line

Claude for Chrome is a capable browser agent, generally available on every paid Claude plan: install it in Chrome, sign in, and decide whether to keep automatic approval on, knowing Anthropic says the prompt-injection risk is reduced, not eliminated. But it is not a chat manager. To find, organize, and export your Claude conversations, add AI Toolbox's Claude module, full-text search, folders, bookmarks, and export, with 40,000+ users, a 4.7/5 rating, and a free plan. See our best Claude Chrome extensions guide, or add AI Toolbox free.

Sources

• Anthropic, Claude in Chrome is generally available (August 26, 2026)
• Anthropic, Claude Cowork comes to the Chrome side panel (August 12, 2026)
• Anthropic, Piloting Claude in Chrome (August 25, 2025, with later updates)
• Anthropic Help Center, Get started with Claude in Chrome
• Anthropic Help Center, Use Claude in Chrome safely
• Anthropic Help Center, Claude in Chrome permissions guide

Last updated: September 13, 2026