Claude in Chrome vs. the Cowork browser: two ways to let Claude use the web, shipped the same day
In brief
On August 26, 2026 Anthropic made Claude in Chrome generally available on every paid plan and gave Cowork its own built-in browser. They look like the same feature and are not. Chrome works on the pages you already have open, with your logins, and now auto-approves actions a classifier judges safe. The Cowork browser is a separate, isolated browser Claude drives alone. Here is which one to use for what, and where the prompt injection risk actually sits.
Contents
Two things shipped on August 26, 2026 that both amount to "Claude can use the web now," and telling them apart matters more than it sounds.
Claude in Chrome went generally available on every paid Claude plan.
Claude Cowork got its own built-in browser.
The difference is whose browser it is.
Claude in Chrome: your browser, your logins
The Chrome extension lets Claude see the page you are on and act on it — reading and typing text, clicking links, navigating between pages, filling out forms — using your existing logins. You are both looking at the same tab.
What changed at GA. Previously Claude asked for approval on every action. Now it can automatically approve actions a built-in safety classifier judges safe, with that classifier checking whether each proposed action actually matches what you asked for. Manual approval mode is still there as an opt-in, and if you are doing anything consequential you should turn it back on.
Limits worth knowing:
- Chrome only. Not other Chromium browsers, not mobile
- The desktop app is still required for anything touching local files
- Enterprise admins can restrict usage to approved domains
The Cowork browser: Claude's browser, borrowed logins
Cowork's built-in browser is a separate browser inside the desktop app that Claude drives on its own. It never accesses your tabs, bookmarks, or passwords. You choose specifically which logins to transfer across from your existing browser.
It can navigate pages, extract information, fill forms, gather research, and reach vendor dashboards and portals — while you do something else, which is the actual point.
Availability: Pro, Max, and Team, rolling out from that week. Enterprise had it immediately, managed through Organization settings. macOS, Windows, and Linux, with Windows and Linux in beta.
Restricted by default: banking, email, and single sign-on sites. You can enable them. Think hard first.
Which one for what
| Claude in Chrome | Cowork browser | |
|---|---|---|
| Whose browser | Yours | Claude's, isolated |
| Sees your tabs/bookmarks/passwords | Yes | Never |
| Logins | All of your existing sessions | Only ones you transfer |
| You are watching | Yes, same tab | No, it runs alongside |
| Best for | Working with Claude on a page you are looking at | Delegating a web task and walking away |
| Plans | Every paid plan | Pro, Max, Team, Enterprise |
The practical rule: Chrome for collaboration, Cowork for delegation.
"Read this vendor contract page and tell me what the termination clause actually means" is a Chrome task — you are there, you want to see what it saw.
"Log into these four supplier portals and pull down last month's invoices" is a Cowork task — you do not want to watch it, and you specifically do not want it running with access to every session in your personal browser.
If you have not used Cowork's background execution model, Cowork on web and mobile covers how sessions keep running with the laptop closed, and Cowork and Dispatch covers handing off work.
The prompt injection problem, stated honestly
A model that reads web pages and takes actions using your logins is a model that can be instructed by a web page. That is not a hypothetical; it is the defining risk of the whole category.
Anthropic's stated defence is three layers:
- Model training against an expanding library of prompt injection attacks from internal and external red-teamers
- Content screening — probes scan page content for injections before Claude acts, and warn the model to proceed cautiously when they fire
- Action verification — a classifier reviews each action against your original request and blocks mismatches
That third layer is the load-bearing one, and it is worth understanding what it can and cannot do. It catches "the user asked me to summarise a page, why am I sending an email" — a mismatch between request and action. It cannot catch a malicious instruction that produces an action consistent with what you asked for. If you say "fill in this form with my details" and the page has been crafted to route those details somewhere else, the action matches the request.
Anthropic's own guidance is to start with trusted websites. Take it literally. The defences reduce the risk; nothing on offer eliminates it.
What to delegate, and what not to
Reasonable to hand over:
- Research across pages you would otherwise open in fifteen tabs
- Pulling documents and invoices from vendor portals you already have accounts on
- Extracting a table from a page that will not let you copy it
- Filling in a long internal form from information you supply in the prompt
Do not hand over, regardless of what the classifier says:
- Anything on a banking or payment site. They are restricted by default in Cowork for a reason
- Anything that sends a message as you — email, DMs, comments on a public thread
- Anything that accepts terms, grants OAuth permissions, or changes account settings
- Anything that submits a form you have not read on a site you reached from a link on another page
The pattern in that second list: irreversible, outward-facing, or authorising. Those are the actions where a wrong call cannot be undone by closing the tab, so they stay with you.
If you are the admin deciding this for a team, the domain allowlist in Chrome and the Organization settings control in Cowork are the two levers. Set them before rollout rather than after the first incident — Claude admin: security and privacy has the wider settings map.
Try this today — the 20-minute trust calibration
Pick one recurring web task you actually do — the invoice pull, the weekly competitor page check, the form you fill from a spreadsheet.
Run it in Cowork's browser with only the login that task needs transferred. Not your whole browser profile. One login.
Then check three things when it finishes:
- Did it get the right data? Compare against doing it yourself once. Not "does the output look plausible" — actually verify two or three values.
- Where did it get stuck? The place it stalled or guessed is the place you need to give it more instruction, and it is usually a navigation step you do from muscle memory.
- What did it have access to that it did not need? Whatever that is, do not transfer it next time.
Do this three times on the same task before you delegate a second one. The goal is not to find out whether Claude can browse — it can. It is to find out what your version of this task actually requires, so the access you grant matches the job instead of the convenience.
Related: Computer use and browser use go GA · Cowork on web and mobile · Cowork and Dispatch · Claude admin: security and privacy · What to share with Claude