Claude Cowork browser: what Anthropic's built-in agentic browser does

What is the Claude Cowork browser?

Let me untangle the names first, because Anthropic shipped three overlapping things this year.

Cowork is Anthropic's agentic knowledge-work product. It "uses the same agentic architecture that powers Claude Code, with no terminal required," and instead of answering one prompt at a time it takes on multi-step tasks and runs them for you, producing real deliverables like Excel workbooks and formatted reports (get-started doc). Think of it as Claude Code pointed at spreadsheets and slide decks rather than repositories.

The built-in browser is the new piece. When a Cowork task needs the web, "a browser opens in the side panel next to your task," and Claude "opens sites, reads pages, clicks, types, and fills forms while you watch, with no need to switch windows" (built-in browser doc). The pitch, in Anthropic's own words from the launch post: a lot of web tasks "don't need your browser, just a browser, and now Claude has one."

That side panel is the whole idea. You ask Claude to gather pricing from a vendor site, collect invoices from a portal that has no API, or pull numbers off a dashboard, and it drives a real browser session to do it while you keep working in the main pane. Links in the task transcript open in the same panel, so you can follow along and see exactly what it clicked.

How the Claude Cowork browser actually works

Here is the part that surprised me: the browser is not really running on your laptop. Cowork sessions "run remotely in the cloud (in beta)," so your work follows you across desktop, web, and mobile, and keeps going even if you close the lid (get-started doc). The desktop app is the window you watch it through, not the machine doing the work.

There is one wrinkle worth flagging: because the browser lives in the desktop app, Claude Desktop has to be open and online for the browser to run, even though the session itself is in the cloud (built-in browser doc). You can steer from your phone, but the desktop app on some computer has to stay awake.

Staying signed in works through an opt-in cookie import. The first time the browser opens, you can import cookies site by site from Chrome, Edge, and Firefox on macOS (Firefox only on Windows and Linux), so Claude stays logged in where you let it. Safari is not supported, and banking, email, and SSO sites stay unchecked by default. Logins are then remembered across Cowork sessions on that computer, so you are not re-authenticating every run.

This is the same shape as any autonomous AI agent: perceive the page, decide the next action, act, repeat. It is a world away from a rule-based chatbot following a script. What is new is that Anthropic is running that loop in a first-party browser that ordinary, non-developer users can turn on with a click.

Built-in browser vs Claude in Chrome: which does what

Cowork can reach the web two ways, and Anthropic is refreshingly clear about when to use each (built-in browser doc).

If you already run Claude in Chrome, it stays your default; if you do not, Cowork uses the built-in browser. You switch anytime in Settings > Cowork > Preferred browser. Anthropic even suggests pairing them: Chrome becomes the research layer, and Cowork turns what it gathers into finished files.

The finished-file part is what makes this more than a novelty. Point it at a pile of open invoices and it will drop them into the right tab of your spreadsheet, flag what is due, and hand back a clean summary. One Hacker News user testing Cowork on a real document put it simply:

"Its project proposal revision was just about perfect. It took me only about 10 more minutes to polish it further and send it off."

tkgally, Hacker News

What the Claude Cowork browser costs

There is no separate charge for the browser. It comes with Cowork, and Cowork comes with any paid Claude plan. Here is the full picture, straight from the pricing page.

A couple of things the grid hides. Cowork is gated to paid plans, so the free tier gets none of this. And the real cost lever is usage, not the base fee: Max exists specifically to buy "5x or 20x more usage than Pro," and a browsing agent that runs multi-step loops in the cloud will burn through usage faster than chat does. If you are pricing this against a dedicated support tool, our writeup on measuring AI support ROI is a more honest comparison than tier-to-tier.

The safety question you cannot skip

Every lab that has shipped an agentic browser has run into the same wall, and Anthropic is unusually candid about it. Their own red-team testing shows that letting Claude use a browser raises the odds a prompt-injection attack succeeds, and even with new mitigations the number does not hit zero.

Prompt injection is when a web page (or a file, or an email) hides instructions that hijack the agent into doing something you never asked. To Anthropic's credit, the built-in browser ships a real stack of guardrails: it asks permission before acting on a site for the first time, blocks high-risk sites, screens every action against what you actually requested, and demands an explicit "Allow" before permanently deleting anything (safety doc).

Those layers matter, but they are not a solved problem, and Anthropic says so: it "strongly advises against" using the browser to handle financial accounts, medical information, or other people's personal data, and it is not available for HIPAA organizations. There is also an "Automatically approve" mode and a "Skip all approvals" mode, and the moment you flip approvals off, the guardrails you are relying on come off with them.

The sharpest community critique zeroes in on Cowork's "skills" system, where instructions can quietly teach Claude new abilities. As one commenter on the 870-point security thread argued, the fancy hidden-font trick in the demo is overkill:

"You could upload a plain Markdown file somewhere and tell people it has a skill that will teach Claude how to negotiate their mortgage rate and plenty of people would download and use it without ever opening and reading the file."

burkaman, Hacker News

Another put the trade-off plainly, and it is roughly where I land too:

"I think for many the value of using general purpose agents will outweigh the security concerns for now, until those catch up."

jameslk, Hacker News

This is exactly the lesson we learned the hard way running AI on live support queues for the last three-plus years. A confident-sounding agent that occasionally does the wrong thing is not a hypothetical, it is Tuesday. It is why every rollout we ship gets simulated against thousands of real historical tickets before it ever touches a customer, rather than flipping a switch and hoping. A general browsing agent is a fantastic personal assistant. It is not, by itself, a customer-facing system of record.

Where an agentic browser actually fits

Not everyone is convinced the browser needed to exist at all. The most-upvoted skeptical take on the launch:

"I still don't buy the we needed it to be a whole Browser and not a Chrome Extension argument... none of the agentic browsers from the bigger players like Atlas and Comet really took off either."

arjunchint, Hacker News

It is a fair jab. OpenAI folded its standalone browsing into ChatGPT agents, and the pattern across labs is the same: an agent that can drive the web is now table stakes, not a product on its own.

I think that undersells it a little. For an individual doing research, filling forms, or wrangling a portal with no API, the Cowork browser is a real time-saver, and it is the first version of this that a non-technical person can actually use. Where the framing breaks down is when people assume a general agent is the same thing as a worker for a specific job. It is not.

A general browsing agent is infrastructure: raw capability you point at a task and supervise. A teammate hired for one job is a different product entirely. It shows up already knowing your tools, already trained on your context, and works the queue on its own within limits you set. Both are useful. They are just not substitutes, and conflating them is how people end up disappointed with either one.

Try eesel

Anthropic is building the horizontal layer: a powerful general agent you point at whatever you need. eesel sits in the same space, but takes the opposite bet. Instead of one generalist you have to direct and babysit, you hire a ready-to-work teammate for a defined job. The current roster is an AI helpdesk teammate and an AI blog writer, and each one arrives with the skills, integrations, and company context for its role.

For support, that difference is the whole game. The eesel AI helpdesk teammate plugs into Zendesk, Freshdesk, Gorgias, and the rest of your stack, learns from your past tickets and help center, and joins the queue like a new hire, not a browser you have to watch. And before it ever replies to a real customer, you simulate it against your own ticket history so you know exactly how it will behave. That is the part a general agentic browser, by design, leaves up to you.

If you want an AI that browses the web for you, the Claude Cowork browser is a genuinely good place to start. If you want an AI that actually resolves support tickets, that is a teammate, not a browser. You can try eesel free and simulate it on your own tickets before committing to anything.