Claude in Chrome keeps asking permission: the hidden site list

Anthropic's help pages do say some sites trigger a question before every action. According to the documentation for organisations, the extension checks addresses against a "site safety list". How a site lands on it isn't described, and the list isn't public. The security page only hints that adult and pirate sites are blocked and financial ones prompt questions.

How does the Claude in Chrome site check work?

The extension code (version 1.0.102) sends the page address to an Anthropic server before acting. The server returns a category. Category0 allows "always allow", category1 shows a blocked page, and category3 asks on every click. The answer is cached for five minutes, and the category applies to the whole domain, not a single page. The list itself isn't stored on your computer.

The only documented workaround is a trusted-sites list in organisation settings, available on Team and Enterprise plans. Personal accounts don't have it, and there is no described way to ask for a site's removal. Auto mode in Claude Code should skip the check according to the docs, but in the author's one test the click still hit the prompt.

How to see your site's category

Open chrome://extensions, turn on Developer mode, click "service worker" on the Claude card, go to the Network tab and filter for url_hash. Open the browser_extension row and read the category field in Response. Don't share screenshots of Headers, since they show your login token.

Anthropic names prompt injection as the main risk: hidden instructions on a page that the model mistakes for your commands. The caution makes sense. But with no published criteria and no notice, you only find out when you hit the wall. The author keeps a public GitHub registry of checked sites and says similar complaints appear in Claude Code issues.