Anthropic Adds Built-In Browser to Claude Cowork Desktop App

Anthropic is adding a built-in browser to Claude Cowork's desktop app, giving the AI agent a way to navigate websites directly without relying on a separate browser extension.

According to Anthropic, when a task requires web access, a browser window opens automatically in a side panel within the desktop app. Claude can then load pages, read content, click elements, and type into fields — enabling it to fill out forms or extract data from dashboards, including on portals that lack an API.

Isolated from the user's browser

The embedded browser runs separately from the user's existing browser. Anthropic says Claude cannot see the user's open tabs, bookmarks, or saved passwords in this mode. Users can transfer login credentials into the Cowork browser one page at a time from Chrome, Edge, or Firefox — but Anthropic has excluded banking and email sites from this credential transfer, presumably due to the sensitivity of financial and account-recovery data.

For situations where a user is already signed into a site in their own browser, Anthropic says the existing Chrome extension remains the recommended path, rather than the new isolated browser.

Prompt injection warning

Anthropic flagged prompt injection as a risk with the new capability and is telling users to limit browsing to trusted websites. Prompt injection attacks — where malicious instructions embedded in a webpage attempt to hijack an AI agent's behavior — have become a recurring concern as AI agents gain the ability to autonomously browse and interact with live web content. Anthropic did not disclose specific technical safeguards beyond the isolation of the browser environment and the guidance to avoid untrusted sites.

Rollout details

The feature begins rolling out this week to Claude Cowork users on Pro, Max, and Team plans, as well as Enterprise customers, according to Anthropic. Pricing for Cowork itself was not addressed in this update, and Anthropic did not specify whether the browser feature carries any additional cost beyond existing subscription tiers.

What this means

This is a product feature update to Claude Cowork, not a new model release — the underlying Claude models are unchanged. The move reflects a broader push among AI agent products to handle real-world web tasks (form-filling, data extraction from non-API portals) without requiring users to expose their personal browsing session. The isolation approach — a sandboxed browser rather than direct access to a user's existing session — addresses a legitimate security concern: giving an autonomous agent unrestricted access to logged-in email or banking sessions would be a significant liability if prompt injection or misbehavior occurred. Excluding banking and email from credential transfer is a conservative but sensible limit given how immature prompt-injection defenses still are across the industry. Expect other agent products with browser-use capabilities to face similar tradeoffs between functionality and exposure to untrusted web content.