Anthropic has built a browser directly into the Claude Cowork desktop app. When a task needs a website, the browser opens in a side panel and Claude navigates it — reading pages, clicking buttons, typing text, filling out forms, and operating portals that have no connector, all without the user installing any extension. The rollout starts this week for Pro, Max, and Team plans across macOS, Windows, and Linux (Linux remains in beta); Enterprise admins can turn it on from organization settings. Once it lands, the built-in browser is on by default, though users can switch the preferred browser back in the Cowork section of settings.
Isolation happens at the credential layer
This browser is a separate instance from the one a user relies on day to day. Anthropic states it plainly:
"Claude never sees your tabs, bookmarks, or passwords."
For sites that require a login, users can import credentials from Chrome, Edge, or Firefox, choosing exactly which ones to bring over. Banking, email, and single sign-on sites are excluded by default unless a user adds them back manually.
That default rule is worth looking at on its own. It draws the boundary of what Claude can automate around an enterprise's second-tier systems — vendor portals, expense back-ends, order-lookup pages, the kind of aging site that never got an API and that nobody wanted to wire up to MCP. Those happen to be the systems that eat the most manual labor while touching the least money and identity. Keeping banking and email out of reach removes the two account types where a mistake would cost the most.
Dividing labor with the Chrome extension
Anthropic draws its own line between the two: the built-in browser suits work you hand off entirely to Claude, like gathering a batch of research material or pulling invoices together from several vendor portals into one table; Claude in Chrome suits work where the page is already open and the account is already logged in, like updating a CRM record or processing email. Both channels stay available, and the user decides which one Claude defaults to.
The reasoning behind that split isn't hard to see. The extension route inherits the user's existing login state, which is convenient but blurs the permission boundary — Claude sits inside a Chrome session you're already signed into, with visibility that reaches well beyond a single task. A standalone browser cuts off that inheritance, trading it for a login problem to solve at every site, in exchange for something more controllable.
Prompt injection remains unsolved
Anthropic doesn't oversell the security story here. The built-in browser carries over the same prompt-injection defenses used in Claude in Chrome, checking Claude's actions against the user's original request. In the company's own words, these measures "meaningfully reduce the risk but can't eliminate it," and it recommends users start with sites they trust.
Any agent capable of clicking and typing on its own can be told what to do by any text on a page it visits. Cutting off tabs and passwords solves the question of what Claude can see; it does not solve the question of whose instructions it follows. The first is a permission-design problem, the second a model-capability problem, and no vendor has a clean answer to the latter yet.
A desktop-only precondition
One more limit is easy to miss: the built-in browser only runs inside the desktop app. It's reachable from the web client too, but only if the desktop app is open and connected, since the process actually carrying out the actions runs on the user's own machine.
Set side by side, the pattern gets clearer. OpenAI shut down its Atlas browser earlier this year, Google folded Gemini into a Chrome sidebar, and Anthropic is now running both an extension and a browser it built itself, in parallel. All three want to avoid asking users to switch their main browser; where they differ is that Anthropic splits "the browser an agent uses" and "the browser a person uses" into two separate processes.
Sources: Anthropic's official blog, CocoLoop, Claude Help Center; official announcements verified for rollout scope, platform support, and default credential-exclusion rules.