Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude for Chrome

anthropic.com

Post reply on HN
Print view View original

281–290 of 433 posts

Re: Claude for Chrome

#281

Post by afarviral »

dfabulich wrote: post #272

Claude for Chrome seems to be walking right into the "lethal trifecta." https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ "The lethal trifecta of capabilities is:" • Access to your private data —one of the most common purposes of tools in the first place! • Exposure to untrusted content —any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM • The abilit…

How would you go about making it more secure but still getting to have your cake too? Off the top my head, could you: a) only ingest text that can be OCRd or somehow determine if it is human readable b) make it so text from the web session is isolated from the model with respect to triggering an action. Then it's simply a tradeoff at that point.

Re: Claude for Chrome

#282

Post by apitman »

felarof wrote: post #242
parsabg wrote: post #126

I built a very similar extension [1] a couple of months ago that supports a wide range of models, including Claude, and enables them to take control of a user's browser using tools for mouse and keyboard actions, observation, etc. It's a fun little project to look at to understand how this type of thing works. It's clear to me that the tech just isn't there yet. The information density of a web page with standard rep…

Just dumping the raw DOM into the LLM context is brutal on token usage. We've seen pages that eat up 60-70k tokens when you include the full DOM plus screenshots, which basically maxes out your context window before you even start doing anything useful. We've been working on this exact problem at https://github.com/browseros-ai/BrowserOS . Instead of throwing the entire DOM at the model, we hook into Chromium's rende…

Maybe people will start making simpler/smaller websites in order to work better with AI tools. That would be nice.

Re: Claude for Chrome

#283

Post by AdieuToLogic »

mkozlows wrote: post #266
biggestfan wrote: post #8

According to their own blog post, even after mitigations, the model still has an 11% attack success rate. There's still no way I would feel comfortable giving this access to my main browser. I'm glad they're sticking to a very limited rollout for now. (Sidenote, why is this page so broken? Almost everything is hidden.)

The strong sense I got from reading this is that they don't believe it's possible to safely do this sort of thing right now, and they want to warn people away from Perplexity etc. so they can avoid losing market share while also not launching a not-yet-ready product. (The more interesting question will be whether they have any means to eventually make it safe. I'm pretty skeptical about it in the near term.)

> The strong sense I got from reading this is that they don't believe it's possible to safely do this sort of thing right now, and they want to warn people away ...

This is directly contradicted by one of the first sentences in the article:

  We've spent recent months connecting Claude to your 
  calendar, documents, and many other pieces of software. The 
  next logical step is letting Claude work directly in your 
  browser.
Ascribing altruism to the quoted intent is dissembling at best.

Re: Claude for Chrome

#284

Post by kccqzy »

afarviral wrote: post #281
dfabulich wrote: post #272

Claude for Chrome seems to be walking right into the "lethal trifecta." https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ "The lethal trifecta of capabilities is:" • Access to your private data —one of the most common purposes of tools in the first place! • Exposure to untrusted content —any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM • The abilit…

How would you go about making it more secure but still getting to have your cake too? Off the top my head, could you: a) only ingest text that can be OCRd or somehow determine if it is human readable b) make it so text from the web session is isolated from the model with respect to triggering an action. Then it's simply a tradeoff at that point.

I think Simon has proposed breaking the lethal trifecta by having two LLMs, where the first has access to untrusted data but cannot do any actions, and the second LLM has privileges but only abstract variables from the first LLM not the content. See https://simonwillison.net/2023/Apr/25/dual-llm-pattern/

It is rather similar to your option (b).

Re: Claude for Chrome

#285

Post by afarviral »

kokanee wrote: post #189
epolanski wrote: post #164

Earlier quoted context omitted.

I am starting to see this age of internet-for-robots-by-robots as our second chance to detach from those devices and start living irl again.

Just the pesky matter of figuring out what humans will do for money, and then we'll be free to run in the meadows like we were meant to

I'm interested in computers. What's the point of meadows without computers.

Re: Claude for Chrome

#286

Post by whatevertrevor »

raincole wrote: post #263
whatevertrevor wrote: post #257

Earlier quoted context omitted.

I don't agree with this for two different reasons. First: I don't think the analogy holds. Recording a performance is not the same as generating a recording of a performance that never happened. To be abundantly clear, I'm not making an oversimplification generalization of the form "Tool-assisted Art is not Art actually", but pointing out that there's a lot of nuance in what we consume, how we consume it and what und…

> ultimately to me, Art that is worth spending my time consuming usually correlates with Art that has many many hours of dedicated labor poured into it It might be true for you. But I highly doubt average people have any idea about how many or few hours were poured into the content they consume. I've seen weebs who insists anime never utilizes rotoscope because "Japanese don't take shortcuts." My aunt questioned how…

Sure, but I did choose my words precisely for that reason. That's why I said it usually correlates with hours. Hours of labor put in is not the metric that makes art worth it to me, it's more a question of a skilled artist ensuring their message comes through, in the highest "resolution" possible, which requires a high amount of attention to detail, and usually requires a good amount of labor for the output to be interesting.

Re: Claude for Chrome

#287

Post by tempestn »

adam_arthur wrote: post #207
parsabg wrote: post #126

I built a very similar extension [1] a couple of months ago that supports a wide range of models, including Claude, and enables them to take control of a user's browser using tools for mouse and keyboard actions, observation, etc. It's a fun little project to look at to understand how this type of thing works. It's clear to me that the tech just isn't there yet. The information density of a web page with standard rep…

The LLM should not be seeing the raw DOM in its context window, but a highly simplified and compact version of it. In general LLMs perform worse both when the context is larger and also when the context is less information dense. To achieve good performance, all input to the prompt must be made as compact and information dense as possible. I built a similar tool as well, but for automating generation of E2E browser t…

Is it just me, or do both of my sibling comments pitching competing AI projects read like they're written by (the same underlying) AI?

Re: Claude for Chrome

#288

Post by hhhAndrew »

Uehreka wrote: post #251
throwaway13337 wrote: post #184

Earlier quoted context omitted.

It's true that AI makes the slop easier. That's actually a good thing. Slop has been out there and getting worse for the last decade but it's been at an, unfortunately, acceptable level for most of society. Gen AI shouts that the emperor has no clothes. The bullshit busywork can be generated. It's worthless. Finally. No more long winded grant proposals. Or filler emails. Or Filler presentations. Or filler videos. or…

Oh come on, are you 12? Real life doesn’t have narrative arcs like that. This is a real problem. We’re not gonna just sit around and then enjoy a cathartic resolution.

(Maybe skip the mini-insults & make the site nicer for all?)

Anyway I think GP has a point worth considering. I have had a related hope in the context of journalism / chain of trust that was mentioned above: if anyone can produce a Faux News Channel tailored to their own quirks on demand, and can see everyone else doing the same, will it become common knowledge that Stuff Can Be Fake, and motivate people to explicitly decide about trust beyond "Trust Screens"?

Re: Claude for Chrome

#289

Post by innagadadavida »

onesociety2022 wrote: post #217
medhir wrote: post #26

Personally, the only way I’m going to give an LLM access to a browser is if I’m running inference locally. I’m sure there’s exploits that could be embedded into a model that make running locally risky as well, but giving remote access to Anthropic, OpenAI, etc just seems foolish. Anyone having success with local LLMs and browser use?

The primary risk with these browser agents is prompt injection attacks. Running it locally doesn't help you in that regard.

If each LLM sessions is linked to the domain and restricted just like how we restrict cross domain communication, this problem can be solved? We can have a completely isolated LLM context per each domain.

Re: Claude for Chrome

#290

Post by andunie »

A browser extension that interfaces between a webpage and some LLM?

Am I stupid or this a very obvious thing that tons of other companies could have done already? It's crazy nobody thought of it before (I certainly didn't).

Post reply on HN