Browser-Agent Rollout Checklist for Claude in Chrome

Anthropic made Claude in Chrome generally available on August 26, 2026, for Anthropic's paid Claude plans. Beginning September 10, 2026, Claude in Chrome on Enterprise plans becomes enabled by default unless an administrator has already disabled it. That date turns a policy choice into a live change. If the setting is still open, employees can start using the agent before the plan is finished.

The organization setting is the gate. If it is on, the other controls decide what the agent can touch, how far it can move, and when a person must step in. Set the controls before the agent gets a task. The agent is a worker with a keyboard. It can read a page, fill a form, and move through a site. The risk is that a hidden instruction can move from the page into the next action. A browser action is a click, a field, a submission, and a next page. The operator has to treat each step as part of the task.

Domain limits set the boundary

For Enterprise, Claude in Chrome can be managed in Organization Settings, where administrators can restrict access to approved domains. The boundary decides which sites the agent can touch before a task starts. It does the most work when the allowlist is narrow. A narrow allowlist keeps the agent inside the sites the business already trusts. It does not stop every bad page, but it keeps the agent out of a customer portal, a vendor inbox, or a public form that looks useful.

Start with the domains the team already uses for the task. Add only what the task needs. Review the list when a new vendor, inbox, or internal tool enters the workflow. A broad allowlist gives the agent more access to a bad page.

Manual approval slows the agent

Claude in Chrome can run browser actions without per-action approval when it judges them safe, but users can disable that automatic approval and approve each action manually. Claude in Chrome checks each browser action with a safety classifier before execution to confirm the action is safe and aligned with the user's request. For teams that handle sensitive work, manual approval is the safer default. It slows the agent down. That slowdown is the control. A human click keeps the agent out of work that should not be automated.

If the agent can submit a form, change a setting, or send a message without a human click, the team needs a reason. For most enterprise work, the reason should be speed. For sensitive work, the reason should be a documented exception.

Banned tasks stop the worst actions

Hidden instructions are the main threat. Prompt injection attacks can place hidden instructions in web content such as web pages, emails, or form fields. A page can ask for a summary and also ask the agent to send data elsewhere. Anthropic's guidance tells users to avoid banking, health records, and credential-related tasks they would not share when using Claude in Chrome. The operator needs a rule that says some tasks are off limits no matter what the page says.

The banned list should cover the work an employee would not do in a shared session. If the task asks for something the employee would not share, the agent should stop. Put the stop rule in the prompt, the ticket, and the team channel.

The checklist below is the minimum. Run it before the change, and again after any major change to the agent's access. The order is the point: stop the agent, limit the sites, slow the actions, then name the work it must not do.

• Disable the browser agent for the organization now if it is not already off.
• Set an approved-domain allowlist in Organization Settings before any employee task runs.
• Turn off automatic action approval and require manual approval for teams that handle sensitive work.
• Add a banned-task rule for banking, health records, and credential-related work.
• Run one test task on a non-sensitive domain and confirm the agent stops at a form it should not submit.
• Review one completed action to confirm the classifier ran before execution.