Hmm is it just me or is this webpage loading with all the text invisible? Firefox+Android.
Update: appears fixed now
Claude for Chrome
271–280 of 433 posts
Re: Claude for Chrome
#272Claude for Chrome seems to be walking right into the "lethal trifecta." https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
"The lethal trifecta of capabilities is:"
• Access to your private data—one of the most common purposes of tools in the first place!
• Exposure to untrusted content—any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM
• The ability to externally communicate in a way that could be used to steal your data (I often call this “exfiltration” but I’m not confident that term is widely understood.)
If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker.
Re: Claude for Chrome
#273Earlier quoted context omitted.
It is kind of funny how the systems are set up where there often is dense and queryable information out there already for a lot of these tasks, but these are ignored in favor of the difficult challenge of brute forcing the human consumer facing ui instead of some existing api that is designed to be machine readable already. E.g. booking flights. Travel agents use software that queries all the airlines ticket inventor…
Dude you do not understand how bad those "APIs" are for booking flights. Customers of Travelport often have screen reading software that reads/writes to a green screen. There's also tele-type, but like most of the GDS providers use old IBM TPF mainframes. I spent the first two years of my career in the space, we joked anything invented post Michael Jackson's song Thriller wasn't present.
Somewhere in the world there is someone crying while using QIK…
Re: Claude for Chrome
#274I built a very similar extension [1] a couple of months ago that supports a wide range of models, including Claude, and enables them to take control of a user's browser using tools for mouse and keyboard actions, observation, etc. It's a fun little project to look at to understand how this type of thing works. It's clear to me that the tech just isn't there yet. The information density of a web page with standard rep…
It is kind of funny how the systems are set up where there often is dense and queryable information out there already for a lot of these tasks, but these are ignored in favor of the difficult challenge of brute forcing the human consumer facing ui instead of some existing api that is designed to be machine readable already. E.g. booking flights. Travel agents use software that queries all the airlines ticket inventor…
To add to this, it is even funnier how travel agents undergo training in order to be able to interface with and operate the “machine readable“ APIs for booking flight tickets.
What a paradoxical situation now emerges, where human travel agents still need to train for the machine interface, while AI agents are now being trained to take over the human jobs by getting them to use the consumer interfaces (aka booking websites) available to us.
Re: Claude for Chrome
#275Claude for Chrome seems to be walking right into the "lethal trifecta." https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ "The lethal trifecta of capabilities is:" • Access to your private data —one of the most common purposes of tools in the first place! • Exposure to untrusted content —any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM • The abilit…
Big & true. But even worse, this seems more like a lethal "quadfecta", since you also have the ability to not just exfiltrate, but take action – sending emails, make financial transfers and everything else you do with a browser.
Re: Claude for Chrome
#276I built a very similar extension [1] a couple of months ago that supports a wide range of models, including Claude, and enables them to take control of a user's browser using tools for mouse and keyboard actions, observation, etc. It's a fun little project to look at to understand how this type of thing works. It's clear to me that the tech just isn't there yet. The information density of a web page with standard rep…
Just dumping the raw DOM into the LLM context is brutal on token usage. We've seen pages that eat up 60-70k tokens when you include the full DOM plus screenshots, which basically maxes out your context window before you even start doing anything useful. We've been working on this exact problem at https://github.com/browseros-ai/BrowserOS . Instead of throwing the entire DOM at the model, we hook into Chromium's rende…
Playwrights MCP went had a strong idea to default to the accessibility tree instead of DOM. Unfortunately, even that is pretty chonky.
Re: Claude for Chrome
#277Most posts are rightly focusing on the dangers of the lethal trifecta. Nevertheless, Anthropic have got a reasonable set of safeguards in place e.g. https://support.anthropic.com/en/articles/12012173-getting-s... (obviously they're still in a learning phase; Thanks users^H^H^H^Hbeta-testers!)
However, I think the "Skip All Permissions" (high-risk) mode shouldn't even exist.
Re: Claude for Chrome
#278According to their own blog post, even after mitigations, the model still has an 11% attack success rate. There's still no way I would feel comfortable giving this access to my main browser. I'm glad they're sticking to a very limited rollout for now. (Sidenote, why is this page so broken? Almost everything is hidden.)
well, at least they are honest about it and don't try to hide it in any way. They probably want to gather more real world data for training and validation, that's why this limited release. openai have browser agent for some time already but I didn't hear about any security considerations. I bet they have the same issues
Honesty would be Anthropic paying the 1000 alpha testers a fair wage for their very dangerous QA work.
Re: Claude for Chrome
#279I feel like we need to be able to authenticated user prompts during a chat/work session. One of the things that I've worked on in the past involved CheriBSD, which have the mechanisms of deriving access for users from a single root pointer called capability. I wonder if a similar logic can be applied to user prompts during an AI agent work session: the agent only accept prompt with a certain key that is given in the first ever prompt during the start of the session, or keys after that which can proofed to be "derived"(I don't know how that would work) from the original key. This way, the risk of prompt inject should be reduced significantly.
Re: Claude for Chrome
#280Having played a LOT with browser use, playwright, and puppeteer (all via MCP integrations and pythonic test cases), it's incredibly clear how quickly Claude (in particular) loses the thread as it starts to interact with the browser. There's a TON of visual and contextual information that just vanishes as you begin to do anything particularly complex. In my experience, repeatedly forcing new context windows between sc…
Have you ever given Skyvern (https://github.com/Skyvern-AI/skyvern) a try? I'd love to hear your opinion