Claude Cowork Adds an Isolated Built-In Browser
Anthropic is giving its desktop work agent a separate browser that can navigate sites and complete forms without controlling personal tabs.
A browser dedicated to the agent
Anthropic has added a built-in browser to Claude Cowork, enabling its desktop agent to navigate websites, read pages, click controls, type and complete forms from a side panel. The feature is rolling out during the week to Pro, Max and Team subscribers on macOS, Windows and Linux beta. Enterprise administrators can enable it for their organizations immediately.
Unlike Claude in Chrome, the new browser is separated from the user’s everyday browser, tabs, bookmarks and saved passwords. Users may transfer selected logins from Chrome, Edge or Firefox on macOS, or from Firefox on Windows and Linux. Anthropic excludes banking, email and single-sign-on credentials from automatic transfer unless users explicitly choose otherwise. Logins established inside the dedicated browser can persist between Cowork sessions.
Claude in Chrome remains available and stays the default for existing extension users. Anthropic positions that extension for tasks involving an already-open page or active personal session, while the built-in browser is intended for delegated work such as gathering information, downloading invoices or operating a vendor portal. Tasks can also be directed from Claude’s web or mobile interfaces while the desktop application remains online.
A different security boundary
The separation reduces the amount of personal browser state exposed by default, but it does not remove the central security problem of browser agents. Malicious instructions embedded in webpages can attempt to redirect an agent or induce unauthorized actions. Anthropic says the new browser uses the same action checks and prompt-injection defenses as Claude in Chrome, while acknowledging that those controls cannot eliminate the risk.
Why it matters
A built-in browser turns Cowork into a more self-contained general-purpose agent: websites without connectors or APIs become actionable interfaces. The dedicated environment also gives Anthropic a clearer boundary for permissions and credentials than taking control of a user’s active browser. Adoption will depend on whether that isolation remains understandable when users begin importing logins and delegating consequential transactions.