What changed
Anthropic opened a 1,000-user research preview of a Chrome extension that could navigate pages and take browser actions. Its red team found a 23.6 percent prompt-injection success rate without new mitigations and 11.2 percent after them.
Why it matters
Browser agents encounter hostile instructions inside ordinary pages, emails and hidden interface elements while holding authority over valuable user sessions.
What to do
Restrict sites, require confirmation for sensitive actions, isolate credentials and test hidden DOM, email, URL and cross-tab injection attacks.
Caveat
The evaluation was Anthropic-run on 123 test cases, residual risk remained material, and the preview was unsuitable for sensitive workflows.