Claude no longer needs to borrow your browser to get work done on the web. Anthropic has added a built-in browser to Claude Cowork, its agentic workspace, allowing the AI to navigate websites, click links, enter information, and fill out forms in its own dedicated browsing environment. The feature is designed for users who want to delegate web-based tasks without granting the AI automatic entry into their personal tabs, saved passwords, bookmarks, or established browsing sessions.
What the built-in browser does
The built-in browser gives Claude a separate, disposable environment for web interaction. When a Cowork task requires the web, the browser opens in a side panel, so users can watch Claude work while continuing with other projects. This design allows jobs such as gathering research, extracting figures from dashboards, or collecting invoices from vendor portals to be handed off more easily, particularly when a website lacks a dedicated connector or API.
According to Anthropic, the feature rolled out last week to Pro, Max, and Team subscribers using Claude's desktop apps for macOS, Windows, and Linux. Linux support is currently in beta. Enterprise customers can use it when an administrator enables the feature, giving organizations control over deployment.
Your browser stays separate
The most significant shift is that Claude can now carry out many web tasks without operating inside someone else's browser. The built-in browser does not automatically have access to personal tabs, bookmarks, passwords, or existing browser sessions. Anthropic describes it as “Claude's browser, not yours.”
Users who want Claude to access a specific authenticated site can import login cookies on a site-by-site basis from Chrome, Edge, or Firefox on macOS, and from Firefox on Windows and Linux. Banking, email, and single sign-on sites are excluded by default. That exclusion matters because it reduces the chance of sensitive sessions being exposed to unintended actions.
This creates a clear split between Anthropic's two browser options. The built-in browser is aimed at work users can hand over to Claude, such as research and data collection. By contrast, Claude in Chrome remains better suited to an already-open CRM, inbox, or document where the user's existing login matters. The user can choose the preferred option in Cowork settings, giving them flexibility based on the task.
Why it matters for Claude users
This change matters because it removes a real bottleneck for office work. Countless internal dashboards, vendor portals, and approval systems have no API or connector. Until now, when an AI agent encountered one of these, it had to either take over a person's actual browser or stop entirely.
A dedicated, disposable browser lets Claude grind through repetitive, account-light busywork: collecting invoices, gathering research, scraping numbers off a dashboard, and similar tasks. It does so without exposing a user's personal accounts to an AI agent that is clicking around unsupervised. The trust boundary shifts from handing over an entire browsing session to selecting specific sites where the AI is allowed to operate.
The launch arrives just two weeks after OpenAI shut down its standalone Atlas browser. That product lasted less than a year before its agentic capabilities were folded back into ChatGPT itself. Anthropic appears to be drawing the opposite lesson from that failure. Rather than asking people to abandon their everyday browser altogether, it is making the browser a disposable tool that the AI can pick up and put down inside an application people already use.
That is a lower-friction bet than trying to win browser market share outright. It also sidesteps regulatory tripwires such as the European Union's Digital Markets Act, which forces “gatekeeper” browsers to show users a choice screen. A browser tucked inside an app's side panel does not trigger that rule in the same way, giving Anthropic a path to expand agentic browsing without competing directly in the crowded browser market.
What the change means for the trust boundary
The most important change may not be that Claude can browse on its own. Anthropic is giving users a more granular way to decide which parts of their online identity an AI agent can use. In a traditional browser-control setup, an agent can potentially operate inside an environment already connected to email, work accounts, saved passwords, and other authenticated services. Cowork's built-in browser starts separately and requires users to deliberately bring individual login sessions into that environment.
That does not eliminate risk. Once a user imports cookies or signs in to a site, Claude can retain access to that authenticated session for future Cowork tasks on the same computer. But the permission model changes from effectively handing an agent the keys to an already-open browser toward choosing, site by site, which doors Claude is allowed to unlock. This is meaningful for security-conscious organizations and individuals who want to experiment with AI agents but remain uneasy about granting full browser access.
For businesses evaluating browser-based AI agents, that distinction could become increasingly important. The question is shifting from whether an AI agent can use the web to how narrowly organizations can control the accounts, sessions, and data it is allowed to reach. The ability to set boundaries at the site level may become a key factor in deciding which agent tools to adopt and how to configure them.
The security tradeoff
Giving an AI its own browser removes some risks associated with handing over a user's everyday browsing session, but it does not solve the bigger security problem facing browser agents. A malicious webpage can contain hidden instructions designed to manipulate an AI agent, a technique known as prompt injection. If a webpage tells Claude to ignore its original instructions and perform a different action, the agent could be tricked into doing something harmful.
Anthropic says the new browser uses the same safeguards as Claude in Chrome, including checks that compare Claude's intended actions with the user's original request. High-risk sites are also blocked. These protections are designed to detect and stop common attacks, but they are not foolproof.
Anthropic is clear that these protections cannot eliminate prompt injection. Its support documentation advises users to start with trusted websites and warns against using either browser system for sensitive financial, medical, or other people's personal information. There is also a persistence issue: once users sign in to a website inside the built-in browser, Claude can retain access to that login for future Cowork sessions on the same computer. That makes careful account selection important, especially when users are dealing with sites that contain confidential data or valuable credentials.
Comparison with other AI browsing tools
Anthropic's approach stands out among AI vendors. Some companies have attempted to build standalone AI browsers, while others have focused on browser extensions or native integrations. OpenAI's fleeting Atlas browser was one attempt to create an AI-centric destination for web activity, but it was quickly absorbed into ChatGPT after failing to gain traction. Anthropic appears to be taking a more pragmatic path by embedding the browser into an existing assistant workspace rather than asking users to switch to a new browsing product.
There are also technical benefits to this approach. Because the built-in browser is separate from the user's primary browser, it can start fresh for each task or session. This reduces the chance of accidental cross-account actions and gives users a clean slate. It also means that if a webpage contains hostile code or deceptive prompts, the blast radius is limited to the disposable browser environment rather than the user's main browsing profile with all its stored credentials and history.
For people who have used ChatGPT's agentic features or experimented with other AI-powered automation tools, the distinction may be subtle but important. Some AI agents rely on browser automation software like Playwright or puppeteer to control a real browser instance. Those tools often require careful configuration to avoid exposing sensitive data. Anthropic's built-in browser embeds the isolation into the product itself, which lowers the technical barrier for non-expert users.
Practical applications for business
The new feature can be valuable in many business contexts. A procurement specialist might ask Claude to collect invoices from multiple vendor portals, saving hours of manual clicking and downloading. A market researcher could direct Claude to pull pricing data from competitor websites. A finance analyst might rely on Claude to scrape numbers from a dashboard and compile them into a spreadsheet. Because the browser is tied to Cowork, users can combine these web interactions with Claude's other capabilities, such as document analysis, writing, and data processing.
This kind of automation is especially useful for small and medium-sized businesses that do not have the resources to build custom API integrations with every external service. Instead of writing code or hiring developers, a business user can simply describe the task in natural language and let Claude interact with the web on their behalf. The feature also supports a growing ecosystem of AI agents designed to handle repetitive knowledge-work processes.
However, businesses should consider their own policies and compliance requirements before allowing AI agents to browse the web. Even with built-in safeguards, there may be legal or regulatory restrictions on how automated systems access certain websites, what data they can collect, and where that data can be stored. Clear internal guidelines can help mitigate those risks.
What to expect next
Anthropic's rollout to Pro, Max, Team, and Enterprise customers suggests the company sees this as a core feature, not an experimental add-on. The inclusion of Linux in beta indicates cross-platform support will continue to mature. The company is also likely to refine the cookie import process and the security checks over time, based on feedback from users and emerging threat patterns.
It is still early days for browser-based AI agents. As these systems become more common, users will develop a better understanding of which tasks are safe to delegate and which should remain under direct human control. The boundaries around account access, session persistence, and prompt injection are likely to evolve as both attackers and defenders learn more.
Anthropic has drawn a clear line: the AI gets its own workspace on the web, while the user's personal browser remains private. That positioning could appeal strongly to people who have been hesitant to let AI agents touch their everyday accounts. It also offers a template for how other AI labs might design their own agentic browsing features in the future.
Source: eWeek News