On August 26, Anthropic published two Claude Blog posts the same day: Claude in Chrome is generally available and Claude gets its own browser in Cowork. One moves the Chrome extension from pilot to GA on every paid plan and lets Claude take browser actions autonomously after a safety classifier clears them. The other opens a side-panel browser inside the Cowork desktop app so a task no longer has to borrow the Chrome profile you are already living in.
Neither post launches a new model or a new public benchmark score. They answer a harder product question: once an agent can click, type, and navigate, what evidence lets a company say “we can let go,” and which sites should a user actually hand over.
What the official posts say
Claude in Chrome (GA) is available on every paid Claude plan. Anthropic says Claude can view the current page and take actions such as reading and typing text, clicking links, navigating between pages, and filling forms—using your existing logins to reach internal dashboards, legacy systems, and vendor portals that lack connectors. Versus the pilot, the pivotal change is that Claude need not seek approval for every step: actions judged safe can run automatically, and you can turn that off in settings if you prefer manual approval.
Prompt injection is the through-line. Defenses are described in three layers: train the model and probes against a growing attack library; scan tool results with probes before the model acts, warning Claude and checking with you when needed; and, before an action runs, use a classifier to check it against your original request—blocking mismatches. The post states that automatic approval uses the same mechanism as auto mode in Claude Code.
The evaluation section publishes checkable figures. An earlier Cowork prompt-injection eval was retired after saturation: in the Cowork harness, attack success was 0% against Claude Fable 5, Opus 5, and Sonnet 5 even without probes and classifiers. On a harder red-team eval, once attacks reached the model, success was 17.6% against Opus 4.5 and 3.8% against Opus 5 without extra safeguards. With probes plus the safety classifier, Anthropic reports 0% success against Sonnet 5, Opus 5, and Mythos 5, and 0.3% against Fable 5, with successful breaks manually verified as low-severity and under mitigation. Enterprises can manage the extension in Organization Settings and limit it to approved domains. Limits are explicit: other Chromium browsers and mobile are not supported yet; local files and other apps still need the Claude desktop app.
Cowork’s built-in browser shipped the same day. The side panel is Claude’s browser, not yours: it does not see your tabs, bookmarks, or passwords unless you import logins site by site from Chrome, Edge, or Firefox on macOS, or Firefox on Windows and Linux. Banking, email, and single sign-on sites are excluded unless you opt them in. Anthropic’s split is clear: use Claude in Chrome for pages you already have open with sessions you already hold; use the built-in browser when the task only needs a browser—research, invoices, portals without connectors. Rollout covers Pro, Max, and Team over the coming week; Enterprise admins can enable it immediately. From web or phone, Claude can still drive it while the desktop app is open and online. Safety points to the same Chrome-post safeguards and states they meaningfully reduce risk but cannot eliminate it; start on sites you trust.
Technical and product value
The value of a browser agent is not “it can move a mouse.” It is reaching the slice of work that has no API, no MCP, and no enterprise connector. Internal reports, vendor portals, and legacy admin UIs still carry real workflows. Claude in Chrome bets on reusing your logged-in sessions; Cowork’s built-in browser bets on not contaminating your everyday browsing profile. Running both paths is closer to how offices actually split work than shipping a single extension.
More useful for evaluation notes is how Anthropic handled eval saturation. When the old suite hit 0%, they retired it, switched to stronger professional red-team attacks, and separated “did the attack reach the model” from “did it succeed after reaching.” That is more honest than a single pretty chart: it admits safeguards are a moving target, and that Fable 5 still shows a 0.3% residual under the strongest stack. Auto-approval plus a classifier aligned to the user’s original request swaps “human at every step” for “intent-consistency checks”—throughput rises, and failure modes shift from slow to fast-wrong.
Competition and strategic impact
OpenAI, Google, and many startups are shipping computer-use or browser-control demos. Differentiation is less about the video and more about default permissions, enterprise governance, and the safety narrative. By splitting “extension into your browser” from “agent-owned browser,” Anthropic covers collaboration and delegation at once, while leaving admins domain allowlists and org toggles. Set against its recent safety-first release cadence, the message is that the competitive bar is moving from “can it click” to “can you explain an incident and limit blast radius.”
The strategic split is also in the product copy. One path reuses user sessions (Chrome); the other isolates them (Cowork). The first lowers friction and widens the data surface; the second lowers cross-session risk and raises login-import cost. Whoever satisfies both “it works” and “it is auditable” on an enterprise checklist gets closer to making browser agents a default productivity layer rather than a weekend toy.
Risks, limits, and disputes
Anthropic puts the core risk near the top: instructions hidden in pages, emails, or form fields can redirect an agent. Classifiers and probes shrink the known attack surface; they do not close the unknown one. A 0.3% Fable 5 residual labeled low-severity still becomes absolute volume under scaled auto-execution. Enterprises that enable auto-approve without domain limits treat intent alignment as the only gate.
Product limits are equally explicit: non-Chrome Chromium and mobile are out for now; login import excludes banking and SSO by default—protection that also pushes high-value portals back to humans. The commercial read is straightforward: paid-plan GA plus enterprise controls convert pilot users into billable, governable seats. The live dispute is legal as much as technical: when an agent submits a form or sends content as you, does “I approved the task” equal “I approved every side effect”? Compliance teams will not stop at a blog percentage.
Critic’s take
I read this release as Anthropic productizing permission. Model quality matters, but what changes daily work is the default shifting from “ask first” to “execute inside a guardrail.” Two browsers are not redundant features; they admit two workflows: one on a page you already opened, one on a page you would rather not open yourself. The first requires trusting session sharing; the second requires trusting an isolated sandbox.
Repeating “it’s GA” misses the point. The point is publishing residual rates on a harder eval and tying auto-approve to the same mechanism as Claude Code—evidence that browser agents are being folded into one agent runtime philosophy, not left as a stray plugin. Developers need human-in-the-loop fallbacks; enterprises need domain policy, audit logs, and prompt-injection drills on the buying checklist, not only “can it reach our portal.”
Outlook
Over the next six to twelve months, browser agents will move from demo features to default entry points: anything connectors cannot reach will be patched with “whatever the page shows.” Competition will lean less on one-click smoothness and more on how fast safeguards iterate, how fine-grained enterprise governance is, and how quickly permissions can be revoked after an incident. Anthropic’s dual-browser layout occupies both collaboration and delegation; the next watch items are whether residuals like 0.3% hold under real traffic, and whether contracts and regulators rewrite auto-approve so humans still confirm high-impact actions.
Sources are listed below. Factual claims follow the two official Claude posts; evaluation numbers have not been independently reproduced here and are cited as Anthropic reports them.