Is Claude in Chrome Secure? An Update on Passwords (2026)

Last updated: August 13, 2026

Claude can now browse, click, and fill out forms directly in your Chrome browser. Before you allow it to do so on your company’s tools, here’s what Anthropic actually recommends, what a vulnerability patched in early 2026 revealed, and the one rule you should never break when it comes to your passwords.

Key Takeaways

Anthropic states it in black and white: Claude in Chrome is explicitly prohibited from “capturing sensitive data,” which includes your passwords (source: Claude Help Center, “Use Claude in Chrome safely”).
A real flaw did exist : Discovered in December 2025 by researcher Oren Yomtov (Koi Security, which has since been acquired by Palo Alto Networks), it involved a permission rule that was too broad for subdomains *.claude.ai and an XSS vulnerability in the CAPTCHA provider Arkose Labs. Anthropic fixed it on January 15, 2026 (version 1.0.41); Arkose Labs fixed its own component on February 19, 2026.
This best practice is already in place: Since July 16, 2026, integration with 1Password has allowed Claude to log in to an account without ever seeing the password in plain text, thanks to mandatory biometric authentication on the user’s end.
The real risk is no longer hypothetical: the agent-related incident that affected Hugging Face in July 2026 shows that a poorly supervised AI agent can act on a large scale, very quickly, before a human even notices.
Clarification added to the audit: The December 2025 vulnerability provided access to session tokens and data (Gmail, Drive, Claude conversations), not to the passwords themselves in plain text; this distinction is important for assessing the actual risk.

In practical terms: Claude should never receive a password typed directly into his chat window or action field. The only secure way to let him authenticate on your behalf is through a password manager that keeps the password confidential.

What can Claude actually do once it's set up in Chrome?

The extension allows Claude to read a page, click, fill in fields, and perform a series of actions without having to confirm each step. Anthropic offers two operating modes, which are documented in its Help Center:

Automatically approve: Claude evaluates his own actions and only stops if a step seems significant to him.
Manually approve: Each action requires human confirmation before it is executed.

The same document lists a category of uses that Anthropic strongly advises against: managing financial or investment accounts, processing legal or contractual documents, handling medical information, accessing work accounts containing sensitive data, and interacting with websites containing other people’s personal information. The recommendation is simple: do not open the extension when sensitive information is displayed on the screen, and consider using a separate Chrome profile for sensitive professional tasks.

Anthropic also explicitly states that Claude in Chrome is not available to organizations subject to HIPAA and recommends avoiding the extension on any page containing regulated data.

‍

Fashion	How it works	Recommended Use Case
Approve automatically	Claude reviews his own actions and only seeks confirmation on steps he considers risky.	Repetitive tasks on already known websites, without any sensitive data.
Approve manually	Each action (click, form entry, submission) requires explicit confirmation from the user.	Workstations that access business, accounting, or HR applications.

‍

For a company deploying the extension across multiple workstations, the choice of mode should not be left up to individual employees: it is an IT governance decision, just like configuring access rights for a business SaaS application.

Rule #1: Never enter your password directly into Claude

This is the point that the official documentation makes absolutely clear: Claude “is prohibited from entering sensitive data.” A password typed into a conversation, a login form filled out at the agent’s request, or a username pasted in to “save time” for the AI—all of these constitute the same mistake: giving a chatbot access to a secret it has no reason to know.

The problem does not stem from any malicious intent on Claude's part, but rather from the attack surface that this password creates once it passes through the extension: conversation history, execution logs, or—as demonstrated by the January 2026 vulnerability—a vulnerability in a third-party component embedded in the extension.

‍

Things You Should Never Do	Best practice instead
Type a password into Claude's chat so he can log in for you.	Use a built-in password manager (1Password) that fills in the field without revealing the password.
Keep the extension active while viewing an HR file, a contract, or a medical record.	Close the extension or switch to a Chrome profile dedicated to sensitive tasks.
Enable "Automatically Approve" mode on a workstation with access to financial tools.	Enforce "Manually approve" mode on workstations with sensitive access through an IT policy.
Install the extension without automatic updates.	Verify that the installed version is ≥ 1.0.41 (the December 2025 vulnerability is fixed only starting with this version).

How Claude Can Fill in a Password Without Ever Seeing It: The Case of 1Password

There is a way to let Claude log in to an account on your behalf without giving it the password. The integration between Anthropic and 1Password, announced on July 20, 2026, is based on a so-called “zero-knowledge” architecture: Claude asks 1Password to fill in the login fields, but never receives the password in plain text. Before each login, 1Password triggers a mandatory biometric authentication of the user. A specific agent mode also locks the 1Password interface during the action and restricts access to only the credentials necessary for the current task.

Step	Standard Manual Connection	Sign in with Claude + 1Password
Who can see the password?	The user, at the keyboard.	Person on screen: 1Password fills in the field automatically.
Validation Before Login	None, except for 2FA if applicable.	Biometric verification required
Does Claude have access to confidential information?	N/A	No, not at any time
Traceability	Limited.	Post-filling check to detect exposure.

‍

This isn’t just a trivial technical detail: it’s the difference between an AI that “knows” your passwords and one that triggers an authentication process without ever possessing the secret. For an SME that’s beginning to rely on AI agents in its day-to-day operations, this is the type of architecture it must insist on before rolling out the technology more widely.

The January 2026 Vulnerability Fix: What It Really Reveals

In December 2025, researcher Oren Yomtov (Koi Security) identified a chain of two vulnerabilities in the Claude extension for Chrome. The first: an overly permissive permission rule granting access to subdomains *.claude.ai the same rights as on the main domain. The second: an XSS vulnerability in an older version of the CAPTCHA component provided by Arkose Labs, which accepted HTML content without properly verifying its origin. By combining these, a malicious site could load this component into an invisible iframe and trigger actions without any user interaction.

‍

Specifically, the vulnerability exposed authentication tokens and session data—including Gmail tokens, Google Drive history, and Claude conversations—but not plaintext passwords. Koi’s public demonstration showed the theft of Google authentication tokens as part of a proof-of-concept.

‍

Date	Event
December 2025	The vulnerability was discovered by Oren Yomtov (Koi Security).
December 26, 2025	Responsible disclosure through Anthropic's HackerOne program.
Less than 24 hours later	Confirmation of the vulnerability by Anthropic.
January 15, 2026	Patch released (version 1.0.41): The permission rule has been replaced with a strict domain check `https://claude.ai`.
February 19, 2026	Arkose Labs has released a fix for the CAPTCHA component.

‍

What this vulnerability shows is that the risk did not stem from a deliberate decision by Claude, but from a combination of technical permissions and a vulnerable third-party component. This is exactly the type of attack chain that a traditional security audit might overlook if it does not also examine the third-party extensions and dependencies installed on user devices. No actual exploitation has been confirmed to date. This serves as a useful reminder: an AI extension that is properly configured today could become an entry point again tomorrow, depending on updates and the third-party components it incorporates.

How to Manage Claude in Chrome in Your Company: The CIO Checklist

Simply allowing or prohibiting the extension is not enough as a policy. What makes the difference is an explicit, documented, and periodically reviewed framework.

Checkpoint	What to Check
Installed version	Automatic updates enabled, version ≥ 1.0.41.
Approval Process	"Manually approve" is required for positions with sensitive access.
Password management	Integration with 1Password (or an equivalent "zero exposure" solution) rather than AI-assisted manual entry.
Separation of Profiles	A dedicated Chrome profile for administrative, financial, or HR tasks, without the extension enabled.
Register of Uses	List of equipped devices and authorized use cases, as updated in your NIS2 and AI Act documentation.

‍

This last point ties into a broader obligation. Under NIS2, affected companies must document the digital tools and risk management measures they have implemented, which—depending on the interpretation adopted—may include browser extensions that provide access to internal systems. Similarly, an AI agent such as Claude in Chrome could fall within the scope of certain transparency obligations under the European AI Act, depending on how that specific use is classified. No specific regulatory text or legal opinion was identified during this review to confirm these two points as stated in the original version; they are therefore presented here as food for thought, not as established fact.

FAQ

Can Claude see my passwords if I use the Chrome extension?

No, unless you type them yourself in a conversation or in a field that Claude fills in at your request—which Anthropic explicitly advises against in its official documentation. With the 1Password integration, the password is filled in directly by the password manager, without ever passing through Claude or appearing in its conversation history.

What should I do if my company has already installed Claude in Chrome on several computers?

First, check the installed version: it must be at least 1.0.41. Next, set the "Manually approve" mode on workstations with sensitive access, and document authorized uses in your security log, especially if your company is subject to NIS2.

Did the vulnerability discovered in December 2025 expose my customers' data?

No actual exploitation has been confirmed to date. The vulnerability potentially allowed an attacker to gain access to Gmail tokens, Google Drive history, or Claude conversations on vulnerable systems prior to its patch on January 15, 2026.

Is the use of "Claude in Chrome" prohibited in financial or legal documents?

Anthropic strongly advises against using the extension while viewing financial accounts, legal contracts, or medical information. The official recommendation is to disable the extension on these pages or to use a separate Chrome profile reserved for sensitive tasks.

Is a password manager required to use Claude securely?

This is not a technical requirement in the strict sense, but it is the only method documented to date that allows Claude to initiate a connection without ever having access to the password in plain text, thanks to user-side biometric authentication.

How can you quickly disable Claude in Chrome on a sensitive computer?

Simply disable the extension from the Chrome Extensions Manager (chrome://extensions), or switch to a dedicated Chrome profile that has never had it installed. This is the measure recommended by Anthropic before viewing financial, legal, or medical data.

Should Claude be completely blocked in Chrome at work?

Not necessarily. The main risk does not stem from the tool itself, but rather from its default settings and the lack of oversight. A clear policy covering approval procedures, profile segregation, and systematic updates significantly reduces exposure without depriving teams of the tool.

‍

IT Systems — Cybersecurity & Compliance

We support small and medium-sized businesses and mid-sized companies that are deploying generative AI tools on their workstations: auditing installed extensions, defining an approval policy by job profile, and integrating these into your NIS2 registry.

Contact an IT Systems Expert

‍