Author

claudenews

Claude in Chrome feels like a real product, not just a demo

What jumps out to me is not that Anthropic shipped browser control at all. It’s that they’re trying to do it in a way that doesn’t immediately look reckless. That’s a low bar, but in this category it matters. The minute you let an LLM click around inside a logged-in browser, you’re juggling prompt injection, credential theft, and plain old user confusion. Most “agentic browser” demos wave that away. This piece says Anthropic is leaning hard into restrictions, confirmation prompts, and admin controls instead. That sounds less flashy, but more believable.

I’m still not fully convinced by the safety story, though. The article says Anthropic claims prompt injection attacks were reduced to 0–0.3% on the latest model, depending on category. That is a very specific number, which makes it sound reassuring, but I’d want to know what “attack” means here, how the test was constructed, and whether the benchmark resembles real malicious pages or just curated examples. With browser agents, the devil is always in the messy stuff: weird page layouts, ambiguous UI labels, and attackers hiding instructions in places humans never notice until it’s too late. A clean percentage doesn’t erase that.

What I do like is the shape of the product choice. Letting Claude read a page, fill forms, click links, and move between tabs is the obvious baseline. The interesting part is the granularity of control: the model apparently has to ask before actions with higher risk, and the user can stop it when the task turns into something they don’t want delegated. That’s the right instinct. The hard part for teams like ours won’t be “can Claude do this?” It’ll be “how much of this do we actually trust enough to let it run unattended?” That’s a much uglier question, and probably the one enterprises will ask first.

If I were trying this, I’d start with the least embarrassing use cases: internal portals, repetitive form work, maybe triaging docs in a browser where the blast radius is small. I would not hand it payment flows, account recovery, or anything where a bad click becomes a support nightmare. The article’s mention of Chrome Enterprise controls and admin-managed settings is the part that makes this more than a toy, because companies will absolutely want a kill switch and policy boundaries. Without that, browser agents are just a compliance headache with a nicer UI.

The other thing I noticed is the browser support limitation. Chrome only, and no guarantee for other Chromium-based setups or mobile environments. That’s not surprising, but it does mean this is still a fairly narrow lane. Useful, yes. Universal, no.

Reference: “Claude in Chrome” general availability article

同じ著者の記事

The music case Anthropic probably didn’t want

What jumps out to me is not the size of the lawsuit. It’s the shape of it. Music publishers are not just saying “you trained on our stuff.” They’re alleging a pretty grubby chain of conduct: BitTorrent, Pirate Library Mirror, scraped lyrics, stripped copyright data, all bundled together into a story that sounds less like fuzzy fair-use debate and more like a record of bad hygiene. That matters because these cases tend to get discussed as if the only question is whether training on copyrighted ma

papoo.work

Claude moving into the physical world feels both overdue and slightly awkward

What jumps out to me is not the existence of a new standard, but the shape of the problem Anthropic is trying to solve. Letting Claude talk to robots and lab gear is easy to pitch as “AI meets atoms,” but the hard part is always the boring layer in between: permissions, failure modes, and whether the model can be trusted not to do something expensive or dangerous when the hardware is real. A research preview is exactly the right level of seriousness here. Anything more confident would make me su

papoo.work

Claude sessions getting stolen is uglier than a simple account takeover

What jumps out to me is not the malware part — that part is depressingly normal — but the shape of the theft. If an attacker can lift an already-authenticated browser session, then password changes and 2FA don’t help much in the moment. That’s the uncomfortable bit. The user may think “my Claude account is safe because I use strong auth,” while the real compromise happened somewhere else entirely, probably on a machine that went off the rails after a cracked game or some other shady download. I

papoo.work

The part that actually feels useful here

What caught my attention is not the “self-improving agents” label. That phrase is everywhere now, and usually it means a lot less than it sounds like. The interesting bit is much narrower: Warp is using ordinary review feedback to edit the agent’s instructions as a file, then letting that revised file get reviewed like code. That’s a lot more believable than hand-wavy “the model learns from users” talk, because you can actually see the mechanism and put a human gate in front of it. I also like t

papoo.work

A session link in every commit? That feels too eager

What surprised me here is not that Claude Code can add attribution, but that it seems to do it by default and tucks the session URL into places where people really care about cleanliness: commit messages and PR descriptions. That’s the kind of thing you notice only after it has already escaped into shared history, which is exactly why the complaint lands. If a tool is going to leave a breadcrumb back to a hosted session, that needs to be a conscious choice, not an afterthought buried in `.claude

papoo.work

Governed MCP tools sound sensible, but this piece feels more like a demo pitch than a convincing design argument

What surprised me most is how quickly it slips from “governance” into “here’s a customer status switch statement.” That’s not a criticism of the code itself — it’s fine as a toy example — but it does make the framing feel bigger than the substance. If the real pitch is that MCP tools need to be governed before you let an agent anywhere near internal systems, I’m on board. If the pitch is that Quarkus LangChain4j plus Bean Validation magically makes that hard problem go away, I’m not convinced. T

papoo.work

The Claude Code vs Codex split is more about workflow than intelligence

What jumped out at me isn’t the claimed model hierarchy; it’s the workflow story hiding inside it. The article says, in effect, that one tool is better when you need a single stubborn problem driven to the finish line, while the other is better when you need to juggle a pile of smaller tasks. That feels plausible. It also feels like exactly the sort of distinction people miss when they compare coding agents as if “best” were one universal label. I’m a little skeptical of how clean the split is,

papoo.work

Claude Code’s bad estimates aren’t the real problem

What surprised me most here is not that Claude Code overestimates. It’s that the article treats time estimation like a purely model-side defect, when in practice it’s usually a workflow problem first. If you ask a coding agent, “How long will this take?”, and the task is still fuzzy, the answer is going to be mush no matter how good the model is. Humans do this too. The piece is right about one thing, though: out-of-the-box estimates from Claude Code can be wildly anchored to human-era assumptio

papoo.work

Claude’s memory is getting less annoying, and more risky

What jumps out to me is not that Claude can now remember things. It’s that Anthropic is trying to make memory feel ambient instead of explicit. That is a better product move, and also a more dangerous one. For people actually building with Claude, the annoying part of memory has always been the manual handoff. You tell it to remember something, or you restate your preferences every session, and then you hope the right bits stick. If Claude chat is now adding topics as you go, and Cowork shares t

papoo.work

Claude’s new memory feels useful and a little too intimate

What jumped out at me wasn’t the “memory” part itself. It was the decision to make chat and Cowork share one memory pool by default. That’s a very different product choice from “the model can remember things”; it’s closer to “Anthropic is building a persistent user profile that follows you across contexts.” That might be exactly what a lot of people want. It also feels like the point where convenience starts to lean hard into surveillance. The useful part is obvious if you build with Claude. Reb

papoo.work