Claude in Chrome Goes GA: How Auto-Approval Works, and What the Official Attack Success Rates Actually Say

What's the biggest difference between the GA version of Claude in Chrome and the earlier pilot?

The biggest difference is who does the confirming. During the pilot, Claude in Chrome required your manual approval for every single action, regardless of size — safe, but it meant you had to watch the whole time. The GA version adds a safety classifier that automatically reviews whether an action matches your original request before it runs, auto-approving it when the judgment is reasonable, without needing you to confirm each step — meaning you can hand off a multi-step task without coming back to click approve every few seconds.

If you'd rather keep the old behavior of approving every single step yourself, this auto-approval feature can be turned off in settings — it's not a forced behavior change.

Why did Anthropic choose this moment to open up auto-approval in the GA version, rather than keeping the pilot's every-step-confirmed approach?

The most direct reason is that the safeguards themselves had already been validated to a sufficiently reliable degree. The numbers in the announcement show that an earlier evaluation had already been saturated — 0% attack success against Fable 5, Opus 5, and Sonnet 5 — so Anthropic switched to a tougher new evaluation designed by professional red-teamers to keep testing. And even under that tougher evaluation, starting with Opus 4.8, running with both probes and the safety classifier, the attack success rate remained 0% against Sonnet 5, Opus 5, and Mythos 5, and only 0.3% against Fable 5.

In other words, auto-approval isn't a tradeoff made in pursuit of speed at the expense of safety — it's a relaxation of the "every step needs manual confirmation" constraint that only happened once the safeguards had already been validated to this degree of confidence. That also explains why the announcement spends so much space on testing methodology and numbers — those numbers are themselves the direct argument for why the relaxation is warranted now.

How do the three defense layers (attack library, probes, action review) actually work together?

These three layers correspond to three distinct stages on a timeline: before training, at the moment of reading, and right before execution. The attack library is the earliest, foundational layer — it doesn't operate at the moment you're using Claude; instead, it continuously accumulates known attack techniques and uses them to train future models, so the model has some built-in resistance to these techniques from the start.

Probes operate the moment Claude reads web content. When Claude reads a web page or an email through a tool call, the probe scans that content first — if it detects signs of a likely injection attempt, Claude is warned to treat that content with suspicion and, if needed, proactively checks with you rather than simply following whatever instruction is hidden inside it.

Action review is the final line of defense, happening after Claude has already decided to take a specific action but before it's actually executed — a classifier checks whether the action about to run matches what you originally asked for, and blocks it if it doesn't. The three layers each lock down a different question: does the model itself have the ability to recognize the attack, is incoming content screened once before it's used, and is the action double-checked right before it actually happens. If one layer gets bypassed, the next one is still there to catch it.

Seeing numbers like "0.3% attack success rate" or "17.6%" — how should an everyday user actually interpret this, and what does it mean for daily use?

First, understand what these numbers are actually measuring: this is a success rate calculated under the premise that a red-teamer has deliberately designed an attack, and that attack actually reaches the model — it's not "there's a 17.6% chance you'll be attacked just by browsing the web casually." In everyday use, you're unlikely to stumble into an attack that's been carefully engineered by professional red-teamers; these numbers reflect where the system's floor is in the worst case, not the probability you'll actually run into in practice.

The more practically relevant takeaway for daily use is this: the 0% to 0.3% range means that with the current latest models (Sonnet 5, Opus 5, Mythos 5, Fable 5) running with full safeguards, the vast majority of even professional-grade attacks get caught. But "vast majority" isn't "guaranteed" — Anthropic itself acknowledges the safeguards can't eliminate risk entirely. The more useful practical habit, per official recommendation, is to start on sites you trust and are familiar with, and to stay reasonably alert around actions like transferring money, signing contracts, or sharing personal data — rather than seeing a sub-1% number and concluding you can stop paying attention entirely.