Skip to content
NewsProduct launch

Claude Cowork adds a built-in browser separate from your own, shipping to Enterprise now and all paid plans this week

· by Pondero Newsdesk

The short version

Anthropic shipped a sandboxed Chromium browser inside the Claude Cowork desktop app on August 26, 2026. Claude navigates pages, fills forms, and clicks links in its own isolated window with no Chrome extension required and no access to the user's tabs or saved passwords.

Claude Cowork adds a built-in browser separate from your own, shipping to Enterprise now and all paid plans this week

Until August 26, 2026, the only way to give Claude access to the web inside Cowork was through the Chrome extension, which meant handing it your live browser session: your tabs, your logins, your history. Anthropic changed that by shipping a separate Chromium instance inside the Claude Cowork desktop app itself. Claude now browses in its own sandboxed side panel, completely isolated from the user's browser, with Enterprise customers enabled immediately and a staged rollout to Pro, Max, and Team plans underway.

What shipped

The built-in browser opens as a side panel inside the Claude Cowork desktop app on macOS, Windows, and Linux (Linux is in beta), per the Anthropic product blog. When a task requires a website, the panel activates on its own and Claude navigates pages, reads text, clicks links, and fills forms without requiring any setup from the user.

The browser is entirely separate from the user's own browser. Claude never sees open tabs, bookmarks, or saved passwords. Credentials can be imported site by site from Chrome, Edge, or Firefox on macOS, and from Firefox on Windows and Linux. Three categories of sites are excluded from credential import by default: banking, email, and single sign-on portals. Users can opt those in, but they are off unless explicitly chosen.

Enterprise organizations can manage the feature immediately from Organization settings, under Cowork and then Built-in browser. The Pro, Max, and Team rollout started August 26 and Anthropic said it would complete within the week.

How it fits alongside Claude in Chrome

Anthropic drew a clear line in the announcement between the two web-access tools. The built-in browser is for tasks users want to hand off entirely while they continue working elsewhere: pulling invoices from a vendor portal, gathering research from a set of URLs, or completing a form-heavy workflow on a site that has no connector. The user assigns the task and steps away.

The Chrome extension (Claude in Chrome) serves a different purpose: pages already open in the user's browser, under their existing logins, where the user wants Claude to act in the current session. Updating a CRM record, working through an inbox, or editing a shared document fit that pattern.

For users already running Claude in Chrome, the extension stays the default; the built-in browser becomes the fallback for web tasks when the extension is not active. The preference is switchable anytime in Settings, under Cowork and then Preferred browser. The two tools cover opposite access patterns rather than competing with each other.

Anthropic released Claude in Chrome as generally available on the same day, August 26. That separate announcement covered the safety research and the expanded autonomous-action capabilities the extension gained during its pilot period. Shipping both tools on the same date suggests a coordinated push to make the desktop app the primary surface for web-based agentic work.

Prompt injection risk and the built-in safeguards

Anthropic named the risk directly in the announcement. Any AI agent that reads and acts on web content is exposed to prompt injection: malicious instructions hidden in page content that try to redirect Claude toward actions the user never requested. The post recommends starting on sites the user trusts.

The safeguards are the same set already active in Claude in Chrome, including classifiers that review each proposed action against what the user asked for before executing it. Per Anthropic's published research on browser-use safeguards, these measures meaningfully reduce the rate at which injection attacks succeed without eliminating the risk entirely.

For operators deciding whether to enable this for a team, the practical question is whether the sites Claude will visit are predictable and known. Vendor portals, internal dashboards, and established SaaS platforms that an organization already reviews are lower-risk targets than open-ended research across arbitrary public URLs.

What changes for Enterprise administrators

The built-in browser introduces a new category of action for enterprise security teams: Claude performing web-based tasks in a Chromium session that is attached to the desktop app and may be authenticated to corporate services through imported credentials.

At launch, administrators have three levers:

  • Enable or disable the built-in browser organization-wide from the Cowork panel in Organization settings.
  • Site-level credential import decisions remain with individual users. The current announcement does not describe an organization-level blocklist for credential imports.
  • Prompt injection safeguards that are active for Claude in Chrome carry over automatically; no separate configuration is required.

One gap worth watching: the August 19 platform release notes added per-agent web domain allowlists to Claude's Managed Agents API, letting operators restrict which URLs an agent can reach. That capability is not described for the built-in browser in the current announcement. If Anthropic extends domain allowlists to the desktop browser, it would give administrators meaningful control over the blast radius of any prompt injection attempt. IT teams evaluating whether to enable this broadly may want to wait for that control before rolling it out to high-privilege users.

Context

The built-in browser resolves a structural friction point in the earlier extension model. The Chrome extension required Claude to work inside the user's browser session, which meant the user had to be present in Chrome for Claude to act. A lot of web tasks do not need the user's browser or the user's presence. They need a browser. Shipping a dedicated Chromium instance inside the desktop app separates those two cases cleanly.

For operators who have been evaluating Claude Cowork's agentic capabilities, the credential isolation model is worth examining carefully. By defaulting banking, email, and SSO portals to off, Anthropic is signaling which site categories it considers high-risk enough to require an explicit opt-in rather than an opt-out. That design choice limits the default blast radius and gives security teams a defensible baseline.

The Linux beta availability is notable for organizations that run AI tooling on Linux servers or developer workstations. The desktop app dependency (the web and mobile interfaces can drive the built-in browser only if the desktop app is open and online) constrains the use case to scenarios where a desktop instance is running somewhere in the session.

What to watch next

The first thing to track is the completion of the Pro, Max, and Team rollout. Anthropic said it would finish this week. Any feature-level gaps between Enterprise and paid individual plans should become clear once the rollout closes.

Domain allowlist controls for the built-in browser are the most operationally significant near-term addition if they arrive. The pattern from the Managed Agents API release suggests Anthropic is building domain-scoping across its agentic surfaces; the desktop browser is the obvious next candidate.

Longer term, the simultaneous shipping of Claude in Chrome GA and the built-in browser on the same date points toward a deliberate platform strategy: Claude Cowork as the primary agentic desktop for both synchronous and asynchronous web work. Future Skills, expanded connector support, or credential management improvements at the organization level are the most likely follow-on additions.

Sources