Claude in Chrome requires approval for every click on category 3 sites

You ask Claude to update your ad headlines. It opens the dashboard, reads the description—and asks for permission before clicking “Edit.” You approve. The prompt appears again on the next action. The assistant you planned to delegate routine work to requires your constant presence.

The author of a Habr article encountered this behavior in Claude in Chrome and dug into the extension's code. According to his analysis, the option to grant persistent permission depends on the site category returned by Anthropic's server. The practical takeaway for teams: before deploying a browser agent, test the specific workflow, including button clicks. Successfully opening a page guarantees nothing else.

Why one approval may not be enough

Claude in Chrome operates in your browser while you are signed in: it reads pages, clicks buttons, and enters data. But user consent is only one layer of control. Anthropic's permissions guide describes restrictions for certain sites and actions that require additional confirmation.

The author examined version 1.0.102 of the extension. In the code excerpt he published, it sends the page address to Anthropic's API and receives a category. In the logic he found, category0 allows persistent permission, category1 blocks access with a dedicated page, and category3 requires confirmation for actions. There are other categories too, but the author could not determine the purpose of one of them.

On the site he tested, the server returned category3. The prompt had no “Always allow” button. The author withheld the domain, so readers cannot reproduce that exact test using a published address. The article does not include a complete list of sites either: it covers the classification mechanism he discovered and a handful of observations.

Imagine processing ten ads. The agent can write new headlines, but every time it moves to edit an ad, you have to intervene. Text quality is no longer the main issue. The product's value depends on how many steps a person can actually hand over to the assistant.

What is confirmed and what still needs testing

The author's observations apply to a particular version of the extension and several tests conducted in October. According to his findings, the server response is cached for five minutes. Keep that in mind when diagnosing the behavior: the absence of a new request does not, by itself, mean the check has disappeared.

His experience with auto mode in Claude Code needs particularly careful interpretation. The author tested this mode once: reading worked, but clicking a button again required confirmation. Meanwhile, the Claude Code documentation describes a conditional exception: the extension skips its own site check when the auto mode classifier approves a specific browser call. One attempt is not enough to conclude that this mechanism fails in every case.

Enterprise settings should not be treated as a guaranteed solution either. Anthropic gives administrators controls for website access, but the author did not test the organization's list of trusted sites. The article therefore does not establish that switching to another plan would remove the restriction he observed.

The reason for caution is clear: page content can include instructions intended to redirect the agent's actions. Anthropic separately describes this risk. The question for users is how reliably they can anticipate restrictions on the site they need for work.

How to test a workflow before deployment

Start with a safe action: ask Claude to open the page you need and follow a regular menu link, without entering or submitting anything. Check whether persistent permission is available. Then test several consecutive actions: repeated interruptions reveal how much attention the task will require.

For technical troubleshooting, the author suggests opening the developer tools for the extension's service worker and finding the request in Network using the url_hash filter. Look at the category field in the response. Request headers may contain an authorization token, so do not attach them to a public report.

Developers should record the extension version, address, sequence of actions, and result. Product managers should measure the number of manual approvals per task. If the agent stops at every step, you can have it prepare the edits in a file and leave the transfer into the dashboard to a person. This lets you assess the value of automation in a real workflow before purchasing and deploying it.