A second pair of hands in the browser
On August 26, 2026, Anthropic shipped two closely related—but architecturally distinct—browser products. Claude in Chrome became generally available on every paid plan, letting Claude read pages, click, navigate, and fill forms inside the user’s own Chrome session, with safer actions auto-approved by default. The same day, Cowork gained a built-in browser: a separate browsing environment in the desktop side panel that does not see the user’s tabs, bookmarks, or passwords unless logins are explicitly imported.
The official pitch is straightforward. Claude in Chrome targets systems that already hold your login—internal dashboards, legacy portals, vendor sites without connectors. The built-in browser targets tasks that need a browser, not your browser—research, invoice pulls, connector-less workflows. One inherits session state; the other isolates it. For security teams, that is two trust models, not two skins.
The more interesting claim is why Anthropic felt ready to make auto-approval the default: prompt-injection defense was treated as a ship gate, not a post-launch patch.
What the posts actually say
According to the Claude blog, Claude in Chrome is GA across Pro, Max, Team, and Enterprise. Work can span tabs and continue on desktop, web, and mobile. Actions no longer require a click on every step: a classifier—similar in spirit to Claude Code’s auto mode—checks whether the next action matches the user’s original request and blocks mismatches. Irreversible or costly steps such as purchases or sharing personal data still ask first. Enterprise keeps the extension off by default; admins can enable it and restrict domains. Limits are explicit: no other Chromium browsers yet, no mobile extension, and local files still need the desktop app.
The safety section publishes checkable numbers. Since the November 2025 pilot, Anthropic says it grew its prompt-injection library from internal attackers, external red teams, and production monitoring; probes scan tool results before the model acts; a safety classifier re-checks actions before execution. On a harder red-team eval, model-only attack success was about 17.6% for Opus 4.5 and 3.8% for Opus 5; with probes plus the auto-approval classifier, Sonnet 5, Opus 5, and Mythos 5 hit 0%, and Fable 5 hit 0.3%, with successful breaks described as low-severity after manual review. An older eval was retired after saturation—evidence that benchmarks age as defenses improve.
The Cowork built-in browser post draws a clean line: it is Claude’s browser, not yours. Personal tabs, bookmarks, and passwords stay out by default; optional per-site login import from Chrome/Edge/Firefox on macOS (Firefox on Windows/Linux) excludes banking, email, and SSO unless the user opts in. Existing Claude in Chrome users keep the extension as default; newcomers get the built-in browser, switchable under Settings → Cowork → Preferred browser. With the desktop app online, web and mobile sessions can drive the built-in browser; without desktop, Chrome remains the path.
No unverified third-party metrics are used here; competitor comparisons stay at the level of public product narratives.
Where the product value actually sits
Browser agents matter when APIs are missing. Much of enterprise work still lives behind cookie sessions and vendor UIs. Connectors cover vendors willing to integrate; Claude in Chrome covers everyone else. Auto-approval moves the UX from turn-taking to goal-setting, while the classifier tries to keep “what you asked” attached to “what is about to run.” Official evals suggest the stacked defenses are already hard to beat on Anthropic’s current attack set—yet Fable 5’s 0.3% is not zero, and the company itself calls prompt injection a moving target.
The built-in browser buys isolation: users who want web agency without exposing every logged-in session get a safer default, and admins get a second control surface besides domain allowlists on the extension.
Competitive reading
Browser control is table stakes across frontier labs. Anthropic’s tell is the dual design—enter the user’s Chrome when login state is the point; spin up an isolated browser when it is not—plus publishing per-model attack success rates in the launch post. That fits a broader Anthropic pattern: Fable/Mythos capability tiers, EFS-style customer-held logs, and layered runtime classifiers. Versus a pure “stronger general computer-use agent” narrative, this is infrastructure thinking: connectors first, browser as fallback, trust boundaries made explicit.
Developers get browser actions inside the same Cowork session graph as skills and connectors. Enterprises must redraw permission maps. Consumers get fewer copy-paste loops and a larger blast radius if something goes wrong.
Risks and unfinished edges
Prompt injection is compressed, not solved. Attackers will shift to multi-turn social engineering, cross-site content, and action types classifiers do not yet model. Auto-approval hinges on semantic match to a possibly vague original request. Enterprise-off-by-default is the honest posture. Platform gaps remain: non-Chrome browsers, mobile, and built-in browser dependence on the desktop app. Importing logins carefully excludes high-value automation targets by design. Commercially, nailing Agents into daily browsing also deepens paid-plan lock-in; the safety write-up doubles as enterprise and regulatory language.
Commentary
Read this launch as product honesty. Anthropic did not pretend one browser mode fits every trust preference, and it treated prompt-injection defense as a prerequisite for auto-approve. That is a stronger industry signal than another OSWorld brag. The critique still stands: 0% / 0.3% figures live inside Anthropic’s harness and guardrail stack; independent reproduction and cross-lab comparisons remain thin. Over the next 6–12 months, expect ship-coupled browser defenses, enterprise packages that combine domain policy with audit and data-residency controls, and architectures that keep connectors primary with browsers as the long-tail fallback.
Bottom line
Claude in Chrome’s GA, paired with Cowork’s built-in browser, moves Anthropic’s web-using agents from pilot to purchasable default. The company published a layered architecture, auto-approval mechanics, and concrete prompt-injection eval numbers—and also the limits: no mobile/other browsers yet, residual risk, and admin-controlled rollout. The next phase of Agent competition will reward whoever can grant autonomy without making security teams lose sleep. Anthropic’s homework here is graded less on flash than on clear boundaries.