Anthropic is giving Claude Cowork its own web browser, and it’s a bigger deal than it sounds. Starting this week, the desktop app can open a side panel browser where Claude loads pages, reads content, clicks buttons, and types into forms. That means the agent can pull numbers from a dashboard or complete an online form even when a site has no API to plug into—the kind of tedious, logged-in web work that’s historically been a pain point for AI automation.
Privacy is clearly the design priority here. Claude’s browser stays walled off from your own, so it can’t see your tabs, bookmarks, or saved passwords. If you want to hand over a login, you can do it one page at a time from Chrome, Edge, or Firefox—but banking and email sites are explicitly off-limits. For pages you’re already signed into, Anthropic still points you to its Chrome extension rather than the built-in browser.
The company isn’t pretending this is risk-free. Anthropic’s own guidance warns users about prompt injection attacks, the class of exploits where malicious web content feeds instructions to an AI agent. The advice is blunt: stick to trusted websites. That warning matters more here than in a typical chatbot context, because a browser that can click and type is a browser that can be tricked into doing things you didn’t ask for.
This move puts Anthropic in direct competition with OpenAI’s Operator and Google’s Project Mariner, both of which have been racing to give agents real web navigation skills. The difference is distribution: Claude Cowork already lives on your desktop, and a side-panel browser sidesteps the clunkiness of remote virtual machines. The question is whether users will trust an agent enough to hand over credentials page by page, or whether the banking-and-email blocklist is just the first line of a much longer set of guardrails.
