Claude gets its own desktop browser

Giving an AI agent access to your web browser has always felt like handing your unlocked phone to a stranger. You either had to install an extension and let it roam around your active tabs, or babysit it while it clicked through your personal workspace.

Anthropic is tackling that friction head-on. The company just rolled out a dedicated, built-in browser inside Claude Cowork on the desktop app. Now, whenever a task requires web access, Claude opens its own browser in a side panel to read pages, click buttons, and fill out forms completely separate from your personal setup.

The feature is rolling out this week to Pro, Max, and Team subscribers across macOS, Windows, and Linux (in beta). Enterprise admins can turn it on starting today.

A sandbox Claude calls its own

The biggest difference here comes down to boundaries. Unlike the Claude in Chrome extension, this built-in browser cannot touch your tabs, bookmarks, or saved passwords.

If Claude needs to log into a specific dashboard to pull numbers or fetch vendor invoices, you can import credentials site by site. That import works from Chrome, Edge, or Firefox on macOS, and from Firefox on Windows and Linux. Crucially, banking, email, and single sign-on sites are excluded by default unless you manually opt in.

Anthropic is drawing a clear line between the two tools. The built-in browser is meant for asynchronous handoffs where you want Claude to go off, do research, and pull files while you focus elsewhere. The Chrome extension remains the tool for pages you already have open in front of you, like triaging a CRM or editing an active document.

Even better: because the browser runs inside the desktop app, you can trigger web workflows from your phone or web app as long as your desktop client is running and online.

Prompt injection is still out there

Having an isolated browser does not solve every headache. Anthropic noted that the built-in browser carries the exact same prompt injection risks as any web-navigating agent, where malicious text hidden inside a webpage can attempt to hijack Claude's instructions.

While the company includes runtime safeguards to verify Claude's actions against your original prompt, it admits these checks reduce risk rather than eliminate it. For now, Anthropic recommends keeping Claude on websites you already trust.

Why it matters

We think Anthropic made a remarkably smart UX and security compromise here.

For power users and workers bogged down by routine administrative tasks, this eliminates the biggest barrier to delegating web chores. You no longer need to configure custom API connectors or expose your everyday browser environment just to automate repetitive form filling and invoice downloads. It works right out of the box with zero installation.

For the broader AI ecosystem, it sets a much cleaner pattern for how agents should interact with the web. Handing an AI full access to an existing browser profile was always an IT nightmare waiting to happen. By isolating execution and blocking sensitive categories like SSO and banking by default, Anthropic gives enterprise teams a workable path toward adopting autonomous workflows.

The prompt injection vulnerability remains an open technical challenge, but keeping the blast radius contained to an isolated side-panel browser makes that risk significantly easier to live with.