On 12 August 2026 Anthropic announced that the Claude in Chrome side panel now runs as a Claude Cowork session. In plain terms, the browser extension that lets the Claude assistant click, type and fill in forms on web pages now shares its history, skills and connectors with the Claude apps, and it is available on Max and Team plans from day one. For an Australian small or medium business, this is a good moment to decide, deliberately, whether staff should let an AI agent act inside their logged-in browser.
What Anthropic announced
According to Anthropic's announcement of the Claude Cowork side panel, Claude in Chrome is a browser extension that lets Claude see the page you are on and take actions in it, including clicking links, typing text, moving between pages and filling out forms, using your existing logins. The change announced this week is about how that work is organised.
- One session across devices. The side panel now runs the same Claude Cowork session used on desktop, web and mobile. Conversations are saved to your history, and a task started in a browser tab can be picked up later in another Claude app.
- Skills and connectors in the browser. The skills and connectors a user has set up in Claude now work in the side panel as well.
- Availability. Anthropic says the new side panel is available on Max and Team plans from the day of the announcement and is rolling out to Pro users over the coming weeks. On Enterprise plans Claude in Chrome is off by default, and administrators can turn it on and limit it to approved domains.
- Limits. Working with files on your computer or with other applications still needs the Claude desktop app, and Anthropic says Claude in Chrome does not yet run on other Chromium browsers or on mobile.
Anthropic's own example is a familiar office chore: building a budget spreadsheet from invoices that sit in several vendor portals. The agent opens the tabs, reads each invoice, collects the amounts and dates and builds the spreadsheet. The point of working through the browser is that it reaches systems that have no direct connection to Claude, which Anthropic lists as internal dashboards, legacy systems and vendor portals.
Why a browser agent is different from a chatbot
A chat assistant only sees what you paste into it. A browser agent sees whatever is on the screen and can act with your logins. That is where the value comes from, and also the risk. The announcement names prompt injection as the chief risk: instructions hidden in a web page, an email or a document, which you may not be able to see, but which can redirect the agent to take actions you never intended.
The announcement describes a safeguard added since the pilot. In the "automatically approve" mode, Claude works through a task without stopping for permission at every step. Before anything consequential, such as submitting a form, sending a message or downloading a file, a separate check reviews the action against the original request and blocks anything that does not match. Claude still asks before certain irreversible or costly actions, such as making a purchase or sharing personal data. Anthropic then adds a sentence every business owner should read twice:
"While these measures meaningfully reduce the risk, they cannot eliminate it."
Anthropic's safety guide for Claude in Chrome fills in the practical detail. To decide what to do next, Claude takes screenshots of the tabs it is working in, and whatever is visible becomes part of the conversation. The guide strongly advises against using the extension to manage financial accounts, handle legal documents or contracts, process medical or health information, access work accounts with sensitive company data, or interact with sites containing other people's personal information. It also states that the user remains responsible for the browser actions Claude takes on their behalf, including messages sent, purchases made and data changed.
What it means for an Australian SME
Cost
The feature arrives inside paid Claude plans rather than as a separate product, so the direct cost question is which plan each person is on. The less visible cost is supervision. A browser agent saves time on repetitive portal work only if someone has first worked out which tasks are safe to hand over, and has checked the results of the early runs. Budget time for that, not only for licences.
Privacy and data handling
Because the agent captures what is on screen, the privacy question is wider than "what did we type into the AI". If a staff member opens the side panel on a page showing customer records, those details are captured, and the safety guide notes that side panel sessions are saved to history and can be reopened on other devices. The Office of the Australian Information Commissioner's guidance on commercially available AI products says privacy obligations apply to any personal information put into an AI system, and that organisations should conduct due diligence before adopting a product. Questions worth answering before anyone installs the extension:
- Which of our web systems show personal information about customers, patients, students or staff, and should the agent be kept away from them entirely?
- Where are session histories kept, who in the business can see them, and how are they deleted?
- Does our privacy policy describe this kind of AI use? The OAIC guidance says businesses should update their privacy policies with clear information about how they use AI.
- Do the terms of the supplier portals and marketplaces we use allow automated access? Anthropic's guide makes the user responsible for respecting them.
Staff training
The habits that keep a browser agent safe are simple but not obvious. Staff need to know to start on trusted sites, to write specific instructions, to review proposed actions on unfamiliar sites, and to stop a task immediately if the agent starts visiting unexpected websites or asking for sensitive information. Anthropic's guide describes that behaviour as a possible sign of a prompt injection attempt.
Where it fits in everyday operations
The sensible first uses are low-risk, read-mostly chores on systems that have no integration: collecting invoice totals from supplier portals for a bookkeeper to check, or pulling delivery statuses for a wholesaler's weekly report. If a task matters every week, the fact that you want an agent for it is also a signal that a proper integration may be worth building. That is the kind of work covered by business systems and integrations.
What to do now
| Step | Why it matters | Who owns it |
|---|---|---|
| Decide whether the extension is allowed, and write the decision down | It is now available on Team plans, and an unwritten rule gets decided by whoever installs it first | Owner or manager |
| Set an allowlist of approved sites | Anthropic's guide says Team and Enterprise administrators can restrict which sites Claude can access, and recommends a restrictive allowlist where sensitive data is handled | Claude administrator |
| Use a separate browser profile for agent work | The guide recommends a profile without access to banking, healthcare or government accounts | Each user, with IT support |
| List the tasks that are off limits | Financial accounts, contracts, health information and other people's personal information are on Anthropic's own avoid list | Manager |
| Pilot with one person and one task | Keeps mistakes small and gives you a real measure of the time saved | Team lead |
| Review once the pilot ends, then on a regular schedule | The OAIC guidance says due diligence should not be a "set and forget" exercise | Owner or manager |
If you would like a second opinion on where AI agents fit and where they do not, Comingwave is a technology company that provides IT consulting, cyber security and integration services to small and medium businesses. You can ask for a free first consultation, and we reply within one business day.
Key takeaways
- From 12 August 2026 the Claude in Chrome side panel runs as a Claude Cowork session on Max and Team plans, with Pro to follow.
- The agent acts inside your logged-in browser, so it can reach portals and older systems that have no integration.
- Anthropic says its safeguards reduce the risk of prompt injection but cannot eliminate it.
- Keep the agent away from banking, health, legal and personal information, and restrict it to an allowlist of approved sites.
- Treat it as a supervised pilot with a written policy, not a default install.
Frequently asked questions
What is Claude in Chrome?
It is a browser extension from Anthropic that lets the Claude assistant see the web page you are on and take actions in it, such as clicking links, typing, navigating and filling out forms, using the logins already in your browser.
Which Claude plans include the Cowork side panel?
Anthropic's announcement says it is available on Max and Team plans from 12 August 2026 and is rolling out to Pro users over the coming weeks. On Enterprise plans Claude in Chrome is off by default until an administrator turns it on.
Is it safe to let an AI agent use my logged-in browser?
It carries real risk. Anthropic names prompt injection as the main one and says its safeguards cannot eliminate it. Its safety guide advises against using the extension for financial accounts, legal documents, health information or sites containing other people's personal information.
Can an administrator control which websites Claude can use?
Yes. Anthropic's safety guide says administrators on Team and Enterprise plans can set allowlists and blocklists for sites, and can enable or disable the extension across the organisation.
Does Claude in Chrome work in other browsers or on a phone?
Not at the time of the announcement. Anthropic says Claude in Chrome does not yet run on other Chromium browsers or on mobile, although a Cowork session started in Chrome can be continued in the Claude desktop, web and mobile apps.