Anthropic launches Claude for Chrome in limited beta, but prompt injection attacks remain a major concern

Anthropic has introduced a pioneering Chrome browser extension that enables its Claude AI assistant to assume control of users’ web browsers. This move marks the company’s foray into a competitive and potentially risky domain where artificial intelligence systems have the ability to directly manipulate computer interfaces.

The San Francisco-based AI firm announced on Tuesday the initiation of a trial phase for ” Claude for Chrome,” limited to 1,000 trusted users on its premium Max plan. This exclusive rollout is positioned as a research preview aimed at addressing significant security vulnerabilities before a broader deployment. This cautious strategy stands in contrast to the more assertive approaches taken by competitors such as OpenAI and Microsoft, who have already launched similar AI systems that control computers to a wider user base.

This announcement underscores the swift evolution of the AI industry from developing basic chatbots to creating “agentic” systems capable of autonomously executing complex, multi-step tasks across various software applications. This transition signifies the next frontier in artificial intelligence, with companies striving to automate tasks ranging from managing expenses to planning vacations.

How AI agents can control your browser but hidden malicious code poses serious security threats

Claude for Chrome empowers users to direct the AI to carry out actions within web browsers, such as scheduling meetings, checking calendars, cross-referencing restaurant availability, managing email inboxes, and handling routine administrative tasks. The system can view on-screen content, click buttons, fill out forms, and navigate between websites, essentially replicating human interactions with web-based software.

“We see AI usage in browsers as inevitable: as much work occurs within browsers, granting Claude the ability to view your screen, click buttons, and fill forms will significantly enhance its utility,” stated Anthropic in its announcement.

However, the company’s internal testing revealed alarming security vulnerabilities, underscoring the risks associated with providing AI systems direct control over user interfaces. Through adversarial testing, Anthropic discovered that malicious actors could embed hidden instructions in websites, emails, or documents to deceive AI systems into executing harmful actions without user consent—a tactic known as prompt injection.

These attacks succeeded 23.6% of the time when deliberately targeting the browser-using AI. In one instance, a malicious email posing as a security directive instructed Claude to delete the user’s emails “for mailbox hygiene,” a command the AI executed without confirmation.

“This is not speculative: we conducted ‘red-teaming’ experiments to assess Claude for Chrome, and without safeguards, we encountered troubling outcomes,” acknowledged the company.

OpenAI and Microsoft rush to market while Anthropic takes measured approach to computer-control technology

Anthropic’s cautious approach contrasts with the more aggressive strategies adopted by competitors in the computer-control sector. OpenAI launched its “Operator” agent in January, offering it to all users of its $200-per-month ChatGPT Pro service. Driven by a new “Computer-Using Agent” model, Operator can handle tasks like booking concert tickets, ordering groceries, and planning travel itineraries.

Microsoft followed suit in April by integrating computer use capabilities into its Copilot Studio platform, targeting enterprise clients with UI automation tools that can interact with web applications and desktop software. The company positioned its offering as a next-generation replacement for traditional robotic process automation (RPA) systems.

The competitive landscape mirrors broader tensions in the AI industry, where companies must navigate the pressure to introduce cutting-edge features against the risks of deploying inadequately tested technology. OpenAI’s rapid rollout has enabled it to capture early market share, while Anthropic’s cautious approach may restrict its competitive position but could prove beneficial if safety issues arise.

“Browser-using agents powered by advanced models are already emerging, making this endeavor particularly urgent,” noted Anthropic, indicating the company’s perceived urgency to enter the market despite unresolved safety concerns.

Why computer-controlling AI could revolutionize enterprise automation and replace expensive workflow software

The advent of computer-controlling AI systems has the potential to reshape how businesses approach automation and workflow management. Current enterprise automation often necessitates costly custom integrations or specialized robotic process automation software that becomes obsolete when applications change their interfaces.

Computer-use agents promise to democratize automation by seamlessly working with any software featuring a graphical user interface, potentially automating tasks across the extensive array of business applications lacking formal APIs or integration capabilities.

Salesforce researchers recently showcased this potential with their CoAct-1 system, combining traditional point-and-click automation with code generation capabilities. This hybrid approach achieved a 60.76% success rate on complex computer tasks while requiring significantly fewer steps than pure GUI-based agents, indicating substantial efficiency gains are feasible.

“For business leaders, the key lies in automating intricate, multi-tool processes where full API access is a luxury, not a guarantee,” elucidated Ran Xu, Director of Applied AI Research at Salesforce, highlighting customer support workflows spanning multiple proprietary systems as prime application scenarios.

University researchers release free alternative to Big Tech’s proprietary computer-use AI systems

The prevalence of proprietary systems from major tech firms has spurred academic researchers to develop open-source alternatives. The University of Hong Kong recently unveiled OpenCUA, an open-source framework for training computer-use agents that rivals the performance of proprietary models from OpenAI and Anthropic.

The OpenCUA system, trained on over 22,600 human task demonstrations across Windows, macOS, and Ubuntu, achieved state-of-the-art results among open-source models and performed competitively with leading commercial systems.