Claude Cowork Gets a Built-In Browser for Agentic Web Tasks

Claude Cowork now has its own browser

Anthropic announced on August 26, 2026 that Claude Cowork now includes a built-in browser inside the Claude desktop app. When a Cowork task needs a website, Claude can open its own browser in a side panel, navigate pages, read content, click controls, type and fill forms.

This is a product rollout rather than a new foundation model. The feature is available now for Enterprise organizations when enabled by an admin and is rolling out over the week to Pro, Max and Team plans on macOS, Windows and Linux in beta. Users should therefore not assume it has already reached every eligible account.

The browser is separate from the user's normal browser

Anthropic's design separates the Cowork browser from a user's personal browser. The company says Claude does not automatically see personal tabs, bookmarks or passwords. Users can choose to import logins site by site from supported browsers, while banking, email and single sign-on sites are excluded from that import unless the user explicitly chooses to include them.

That distinction matters for agentic browser use. Claude in Chrome operates on a browser session the user is already using. Cowork's built-in browser instead gives the agent a dedicated environment for tasks such as gathering research, collecting invoices from a portal, entering information into forms or working through a site that lacks a connector.

If Claude in Chrome is already configured, Anthropic says it remains the default. Users can change the preferred browser from Cowork settings.

What Cowork can do on the web

The built-in browser expands Cowork's ability to perform multi-step web work without an extension. Anthropic gives examples including pulling numbers from dashboards, filling forms and working through portals. The web and mobile Claude experiences can also direct the built-in browser when the desktop app is open and online.

This moves Cowork further toward a general computer-use agent: instead of being limited to APIs, connectors or pages already open in a user's browser, it can operate a separate browser session as one tool within a larger task.

However, this does not mean unrestricted or risk-free autonomous browsing. Sites can still require authentication, CAPTCHA completion, approvals or other controls. The feature does not remove those boundaries.

Prompt injection remains a core safety issue

Anthropic explicitly warns that the browser carries the same prompt-injection risks as other AI agents that act on webpages. A page can contain instructions designed to manipulate an agent into taking actions that differ from the user's request.

Anthropic says the built-in browser uses the same safeguards as Claude in Chrome, including checks that compare proposed actions against the user's instructions. The company also states that those safeguards reduce risk but cannot eliminate it, and recommends beginning with trusted sites.

That caveat is important for enterprise deployment. Browser agents can encounter untrusted content while holding authenticated sessions or interacting with business systems, so organizations still need access controls, human approval points and careful scoping for sensitive workflows.

Why this matters for AI agents

Browser access is becoming a key capability for AI agents because many real business processes still live behind web interfaces rather than clean APIs. A dedicated browser can let an agent bridge those systems while keeping the agent's session separate from a user's everyday browsing environment.

Anthropic's rollout also shows the convergence of connectors, browser automation and computer-use capabilities inside a single productivity agent. The practical value will depend on reliability across real websites, the strength of prompt-injection defenses and how well organizations control credentials and high-impact actions.

The correct status is: the built-in browser is a released Cowork capability for enabled Enterprise users and is rolling out to Pro, Max and Team desktop users during the week of August 26. It is not a new Claude model, and Anthropic does not claim that browser-agent security risks have been eliminated.