Anthropic is rolling out a sandboxed browser embedded directly within its Claude Cowork desktop client, handing the agent native UI-level execution across web targets that lack programmatic APIs. When tasked with a workflow, Claude launches an isolated side-panel instance to autonomously parse DOM trees, click interface components, submit forms, and pull operational metrics across legacy enterprise portals.
From an architectural standpoint, the browser session is compartmentalized away from the host OS environment. Claude cannot read your active browser tabs, local bookmarks, or cached vault credentials, though users must manually migrate individual site logins across Chrome, Edge, or Firefox. Anthropic explicitly hardcodes exclusions for banking portals and webmail providers, keeping the legacy Chrome extension as the designated bridge for accessing pre-authenticated sessions.
Yet delegating autonomous UI navigation directly to an LLM sharply expands the corporate attack surface. By letting an agent parse unvetted external web markup, security teams face severe indirect prompt injection vectors where malicious payload text on third-party sites can hijack agentic instruction flow. While Anthropic advises restricting runs to vetted domains, the real operational burden now falls on enterprise security leads to enforce egress filtering before letting the agent roam unrestricted.