Anthropic Prompt Injection Defenses for Browser Use

Anthropic has improved the robustness of Claude Opus 4.5 and the Claude for Chrome extension against prompt injections—adversarial instructions hidden in web content designed to hijack AI agents. While these updates significantly reduce attack success rates, Anthropic notes that prompt injection remains an active security challenge for any agent performing real-world browser actions.

The Nature of Prompt Injection in Browser Agents

Prompt injection occurs when an AI agent processes untrusted content—such as a webpage, document, or email—that contains hidden malicious instructions. These instructions can override the user's original intent and force the agent to perform unauthorized actions.

Browser-based agents face unique risks because the attack surface is vast, encompassing every webpage, advertisement, and dynamically loaded script. Furthermore, the potential for harm is increased because browser agents can execute high-impact actions, including:

• Navigating to specific URLs
• Filling out forms
• Clicking buttons
• Downloading files

For example, an attacker could embed invisible text in an email that instructs a browser agent to forward confidential communications to an external address while the agent is performing a routine task like drafting meeting replies.

Technical Improvements to Claude's Robustness

Anthropic has implemented a multi-layered defense strategy to reduce the Attack Success Rate (ASR) of prompt injections. These improvements have informed the transition of the Claude for Chrome extension from research preview to beta for Max plan users.

Reinforcement Learning for Resistance

Anthropic uses reinforcement learning to build robustness directly into the model's core capabilities. Claude is exposed to prompt injections embedded in simulated web content during training. The model is "rewarded" when it correctly identifies and refuses to comply with malicious instructions, even those designed to appear urgent or authoritative.

Enhanced Classifiers

All untrusted content entering the model's context window is scanned by classifiers. These systems are designed to detect adversarial commands hidden in various forms, such as:

• Hidden text
• Manipulated images
• Deceptive UI elements

When an attack is detected, the classifiers trigger interventions that guide the model's behavior to prevent the agent from following the malicious instructions.

Expert Human Red Teaming

To find creative attack vectors that automated systems might miss, Anthropic employs internal security researchers for continuous probing. Additionally, the company participates in external Arena-style challenges to benchmark its robustness against industry standards.

Current Performance and Limitations

According to internal testing using an adaptive "Best-of-N" attacker (given 100 attempts per environment), Claude Opus 4.5 and the updated safeguards show a significant reduction in attack success rates compared to previous configurations.

However, Anthropic emphasizes that no browser agent is entirely immune to prompt injection. Even a 1% attack success rate represents a meaningful risk, and the company maintains that the problem is not yet fully solved.