Anthropic has introduced a native, built-in web browser directly inside the Claude Desktop application for Claude Cowork. The feature is rolling out across macOS, Windows, and Linux (beta) for users on Pro, Max, Team, and Enterprise plans.
The integrated browser operates in a side panel adjacent to the user's conversation and task transcript. When an agentic task requires web interaction, Claude opens pages, parses the DOM, clicks buttons, enters text into input fields, and extracts unstructured data without requiring specialized API endpoints or switching window focus.
Sandboxing and Credential Isolation
Unlike the existing Claude in Chrome browser extension, which attaches directly to a user's active Chrome profile, the built-in desktop browser operates in an isolated environment. It does not inherit open tabs, browsing history, or saved passwords from the host system by default.
To facilitate authenticated workflows, Anthropic provides an optional cookie import mechanism. During initial setup, users can selectively import stored session cookies on a per-site basis from Chrome, Edge, and Firefox on macOS, as well as Firefox on Windows and Linux. Highly sensitive domains including banking services, email providers, and single sign-on (SSO) portals remain unchecked by default. Users can also authenticate manually within the embedded browser, with sessions persisted across future Cowork tasks on that machine.
Execution Model and Safety Guardrails
Because the browser engine is embedded within the desktop client, the Claude Desktop app must remain running and online for tasks to execute. However, users can initiate or monitor Cowork sessions from Claude on the web or mobile devices, delegating web navigation back to the local desktop instance.
Anthropic has implemented several runtime constraints to mitigate security risks associated with autonomous browser operation:
- Explicit domain authorization: Claude requests user permission before executing actions on a domain for the first time.
- Restricted domains: Navigation to high-risk categories and sensitive endpoints is blocked by default.
- Action validation: Outgoing browser actions are validated against the initial user intent to detect prompt injection attempts from untrusted web pages.
Anthropic advises against directing the built-in browser toward workflows involving confidential personal data or financial transactions due to residual prompt injection vulnerabilities inherent in open-web agent execution.
