Claude Cowork Got Its Own Browser. The Isolation Model Is the Real Story

Every time I demo Cowork live to a team, I hit the same wall: someone hands Claude a task that needs the web (check a competitor's pricing page, fill out a form, pull a listing) and I have to explain the Claude in Chrome extension, why it needs to be pinned, why the tab it opens is your tab with your logins sitting right there. It works, but it's a hand-wave. Half the room is quietly wondering what Claude can now see in their inbox.

That friction is gone. On August 26, Anthropic shipped a built-in browser inside Claude Cowork: no extension, nothing to install. Give a Cowork task something that needs the web, and a browser opens in a side panel next to it. Claude reads the page, clicks, types, fills the form, while you watch it happen instead of taking it on faith.

The browsing itself isn't the interesting part. Screen-reading agents have existed for a while. What's actually new, and what I've changed how I demo because of, is the access model underneath it.

It's not your browser. That's the whole point

The panel runs on a separate, clean browser profile. Not a new tab in Chrome, a genuinely different browser instance with none of your tabs, bookmarks, saved passwords, or history in it. Claude never sees any of that unless you deliberately bring a login over, one site at a time.

That last line matters more than it looks. Banking, email, and single sign-on sites are excluded from login import by default, full stop, unless you go out of your way to include them. Anthropic didn't leave that up to you remembering to be careful. They picked the sites where a mistake is expensive and made the safe choice the default one.

Where import is available, it's a one-click pull from your real browser (Chrome, Edge, or Firefox on Mac, Firefox on Windows and Linux in beta), and it's scoped per site. Importing your project-management login doesn't hand over your email login too. That granularity is what makes the demo I used to hand-wave through actually defensible now: I can show a room exactly what Claude can and can't see before it clicks anything.

The permission card, not the browsing, is the feature

The first time Claude tries to act on a site in a given task, a permission card interrupts it and waits for you.

Allow once approves that action without remembering anything. Always allow saves the approval for that site on your device, so the next task that touches it doesn't stop to ask again. Deny is a real refusal, not a soft nudge. Even on a site you've already approved, Claude still won't buy something, create an account, or push past a CAPTCHA without checking with you first. Anthropic carried the same guardrails over from Claude in Chrome, including the checks that compare what Claude is about to do against what you actually asked for.

Worth saying plainly, because I'd rather say it than have you find out the hard way: this doesn't eliminate prompt injection risk. A page with hidden instructions in it can still try to redirect an agent that's reading it, and no permission model fully closes that door. What the isolation and the per-site approvals do is shrink the blast radius when it happens. Start on sites you trust, and don't blanket-approve something you haven't watched Claude use once.

Where it's showing up

It's rolling out to Pro, Max, and Team plans in the Cowork desktop app on macOS, Windows, and Linux (Linux in beta), on by default once it reaches your account. Enterprise admins can turn it on for their org today, with the same per-site controls available at the org level.

For anyone building the habit of handing Cowork real, unattended work, this closes a gap that mattered. A scheduled task that needs to check a vendor page every morning used to mean trusting Claude with your everyday browser or building around it with an API integration you didn't need. Now the honest default is a clean session that only ever sees what you explicitly gave it, one site at a time. That's a smaller feature than "Claude can browse the web," but it's the one that decides whether you actually turn a task like that loose.

Sources: Claude Cowork gets a built-in browser · Use the built-in browser in Claude Cowork · Set up browser use in Claude Cowork for Team and Enterprise plans · Use Claude Cowork safely