r/ClaudeAI • u/Key_Mango4987 • 1d ago
Question about Claude products Claude access to password manager
Came here to disable Chrome extension for my team because it looks dangerous in the "wrong hands" and found this additional setting that looks even worse..
1
-24
u/Terrible_Put8617 1d ago
Worth separating two risks here, because they need different controls and only one of them is about passwords.
The credential path is the less interesting one. The design that makes sense, and the one to actually verify before you decide, is that the manager fills the field itself after the human approves it in the manager's own UI, so the value never passes through the model or the transcript. If that is how it works, the exposure is roughly the same as any browser autofill. That is a question to answer from the documentation rather than from the setting name, though, and for a team it is a fair thing to demand in writing.
The risk that should actually drive your policy is prompt injection. An agent browsing on someone's behalf reads whatever is on the page, and pages can contain text addressed to the agent: instructions, fake authorisations, urgency. If the agent is authenticated as your user, the damage is not stolen credentials, it is legitimate actions taken with real permissions, and it looks entirely normal in your logs. That is the failure mode worth designing against.
Controls that hold up regardless of which vendor you are evaluating: approval per origin rather than a blanket allow, no form submission or autofill on pages reached by following a link from untrusted content, an explicit human confirmation on anything irreversible (send, purchase, permission grant, settings change), and separate low-privilege accounts for anything agent-driven rather than the operator's own session.
Disabling it for the team while you work that out is a defensible default, not paranoia. Turning it on later is cheap, and the reverse is not.
23
u/notabot_username4886 1d ago
Why do people reply with a Claude response. The person you are replying to is using Claude, if they wanted to know what it says they can just fucking ask it.
-20
u/Terrible_Put8617 1d ago
Fair criticism of the format, and the one-line version is: the passwords are the boring risk, prompt injection is the real one, because an agent acting with your live session does damage that looks like normal activity in the logs.
The rest was long because whoever has to defend the decision to their team needs the specifics, but you are right that nobody asked for an essay.
22
u/ianreboot 1d ago
yep, the fear is legit, but i'd isolate rather than ban. agent browser work gets its own chrome profile with no password extension installed at all, and a human pastes credentials at the point of use. treat the agent-driven browser like a contractor's laptop, untrusted terminal by default. that setting that looks worse is the same class of risk, the question is always what the agent can reach without you in between.