Gal Weizman showed that one malicious extension can take over the AI agents in Chrome, Comet, Edge, Neon and Claude in Chrome, with bounties from all five vendors to show for it. Installation is the only precondition.
Perspective Coverage
3 publishers
- Builder
- Builder 54%
- Operator
- Operator 38%
- Investor
- Investor 8%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+30
- Incentives62
- Confidence64
Anthropic pins Cowork's local file reach to a single open desktop app
Cowork sessions now start from desktop, web, mobile and a Chrome side panel and run on Anthropic's servers with files tied to the user's account, so whether the desktop app is open decides what the agent can read on a machine.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives78
- Confidence55
Anthropic's Chrome permission drop-down leaves agent oversight to whoever is at the keyboard
Anthropic has renamed the three permission modes for Claude in Chrome to Manual, Auto and Skip all approvals. In Skip, by the company's own guide, nothing checks the agent's actions, and the extension remembers the choice.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives62
- Confidence60
Anthropic folds Cowork's agentic work into every Claude conversation
Anthropic's support note says the mode picker goes away in a staged rollout, and accounts that move over cannot return to separate Chat and Cowork options. Connected apps stay live while a task runs.
Reality
- Evidence60
- Adoption25
- Hype gap+10
- Incentives70
- Confidence65
One extension commanded the AI in five Chromium browsers by seizing the page each one trusts
Forever Security showed the same technique working against Gemini in Chrome, Comet, Edge, Opera Neon and the Claude extension. Google and Microsoft have shipped fixes; the other three findings rest on the researchers' own account.
Reality
- Evidence57
- Adoption30
- Hype gap+18
- Incentives68
- Confidence62
Claude in Chrome debugs the front end from inside a logged-in browser session
An XDA Developers writer says the browser agent clicks through the live app, reads the console and the DOM, fixes the code and checks itself again, all inside sessions he was already logged into, and it burns usage allowance fast.
Reality
- Evidence32
- Adoption12
- Hype gap+35
- Incentives45
- Confidence38