Claude Gets Its Own Browser: Anthropic's Cowork Update Sidesteps the Chrome Extension—and the DMA

Somewhere between the Chrome extension and the standalone AI browser, Anthropic has picked a third path: put the browser inside Claude.

Late this week, Anthropic shipped a built-in browser inside Claude Cowork, its agentic desktop app. When a task needs the web — comparing products, filling forms, extracting data — Cowork now detects it and opens a custom browser in a side panel, rather than reaching out to drive the user’s Chrome through the Claude in Chrome extension. It arrives switched on by default. The feature is live on Enterprise plans and rolling out to Pro, Max, and Team subscribers, with administrators and individual users able to revert to the extension in settings.

Anthropic’s framing is unusually direct. “A lot of web tasks don’t need your browser, just a browser — and now Claude has one,” the company wrote in its announcement.

What the built-in browser actually does

According to Anthropic’s support documentation and early hands-on accounts, the design is deliberately narrow:

• Auto-opens when needed. No manual setup: when a prompt requires the web, the browser opens in Cowork’s side panel and Claude gets to work — reading pages, clicking buttons, filling out forms.
• Nothing touches your logins. The browser runs isolated from your everyday browsing, with no access to your email, banking, or other saved credentials unless you enter them manually. It’s a tool for fetching and acting on public information, not for acting as you.
• Optional cookie import. MacStories reports the browser can import cookies from logged-in sessions in Chrome, Edge, and Firefox on the Mac — Safari is excluded — for tasks that need authenticated access.
• Permission prompts and site blocking. Claude requests permission before acting on a site for the first time, blocks high-risk sites, checks actions against the user’s requests, and uses the same prompt-injection protections as the Chrome extension.
• Tied to your running app. Like OpenAI Codex’s in-app browser, it’s built into the desktop app itself: close the Claude app or shut your Mac, and the browser goes with it. Leave it running, and you can steer the session remotely from the Claude mobile app or web client.

The convergence: everyone is building the same browser

The timing is not coincidental. OpenAI shut down its standalone Atlas browser earlier this month and folded it into a ChatGPT Work mode with a built-in browser of its own. MacStories, comparing the two implementations, notes Claude Cowork’s browser is a hybrid: like Codex’s browser it’s local to the desktop app, but like ChatGPT Work’s cloud browser it targets general knowledge work rather than developer tasks, opening automatically as needed instead of being summoned for inspecting diffs and terminals.

The strategic logic is identical across labs. Agent browsing through a user’s real browser means an AI reading your email, your sessions, your passwords — a security and privacy nightmare that has already produced real-world incidents. An isolated, purpose-built browser inside the assistant bounds the blast radius. Isolation doesn’t solve every problem, as MacStories’ John Voorhees cautions, but it’s a good starting point — and both companies are clearly iterating toward it fast.

There’s also a defaults pattern forming. Anthropic recently merged Claude chat and Cowork memory with memory-sharing on by default, opt-out after the fact. The built-in browser follows the same playbook: shipped switched on, with reversion buried in settings. For products racing to demonstrate agentic utility, defaults are the product.

The regulatory angle nobody legislated for

Here’s the part worth watching. Chrome commands close to 70% of the world’s web traffic, per Statcounter. Europe spent years prising that dominance open: Article 6(3) of the Digital Markets Act forces designated gatekeepers to show a browser choice screen at first use, and it’s the mechanism behind the EU forcing Google to admit rival assistants on Android.

A browser embedded inside an AI app triggers none of it. Anthropic is not a designated gatekeeper, Claude is not a core platform service, and no choice screen fires for a browser the user never consciously opens. As TNW observed, Europe legislated a screen that asks which browser you want — and the industry’s answer is a browser you never see and were never asked about.

Security: candid, but unresolved

Anthropic is refreshingly honest about the limits. The company says prompt injection — malicious instructions hidden on a page that hijack an agent — remains a risk in the new browser, which relies on the same guardrails as the Claude extension. That risk is not theoretical for this product category: TNW previously reported that Cowork could escape its local virtual machine and read credentials on a Mac, a finding that predates this launch.

The architecture is nonetheless a meaningful improvement over driving Chrome directly: fewer credentials in scope, explicit permission checkpoints, high-risk site blocking, and session isolation from daily browsing. Whether those guardrails hold up against adversarial pages is exactly what the coming months of real-world use will test.

Why it matters

The browser was the first great platform war. The AI assistant is becoming the second — and this launch is the clearest signal yet that the two are merging. Every major lab now ships some form of embedded browsing: OpenAI with ChatGPT Work’s browser after Atlas’s shutdown, Google with AI Mode absorbing traditional search flows, and now Anthropic moving Cowork from browser-adjacent to browser-native.

For users, the pitch is simplicity: hand Claude a task, and the web just happens in a side panel. For the industry, the deeper shift is that the entry point to the web is migrating from the URL bar to the prompt box — and whoever owns that surface owns the next defaults war. The DMA’s choice screens were designed for a world of apps and browsers. Nobody has written the rules for a browser that lives inside an agent and opens itself.