Claude Now Has Its Own Browser: What That Means for Every System You Thought AI Couldn’t Touch

The Wall Every Team Hits

Every company we work with has a list of systems that AI “can't touch.” That list is mostly wrong now.

Here is the conversation we have with almost every team, usually about twenty minutes into a workshop. Someone gets genuinely excited about what Claude can do with their email, their documents, their spreadsheets. Then they say: “but the thing that actually eats my week is the supplier portal, and there's no integration for that.”

They are describing the real shape of business software. A modern team runs on maybe six tools that have proper connectors — the inbox, the calendar, the CRM, the file store — and a long tail of thirty others that do not. The freight forwarder's tracking site. The insurance broker's claims portal. The government or municipal system you file through. The wholesaler's ordering page. The old booking system nobody has replaced because replacing it would be a six-month project. Each one is a login, a form, and a human doing the same fifteen clicks every week.

Until now, the honest answer to “can AI help with that?” was mostly no. Connectors are how Claude reaches your tools, and a connector has to be built by somebody. Nobody is building one for a regional wholesaler's ordering portal. That long tail was structurally out of reach, and it is exactly where the tedious work lives.

A browser of its own changes the qualifying question. It is no longer “does this system have an integration?” It is “can a person do this in a browser?” That is a far larger set.

Your Browser Versus a Browser

Claude now has two ways to use the web, and picking the wrong one is the main way teams will get confused this month.

We already have a guide to Claude in Chrome, the extension that sits in a side panel next to whatever page you have open. That still exists, still works, and is still the right tool for a large class of jobs. What launched this week is a different thing that sounds almost identical when you say it out loud, so it is worth being precise.

The simplest rule: if you are looking at the page, use the extension. If you want to stop looking at the page, use the built-in browser. One is a colleague reading over your shoulder. The other is a colleague you hand a job to who goes away and does it.

You can set which one Claude prefers in Settings, so your team is not choosing afresh every time.

What It Actually Does

It opens on its own when a task needs the web, and works the site the way a person would.

You do not launch the browser. You give Claude a job in Cowork, and if that job needs a website, the browser opens in the side panel and starts working. You can watch it if you want to — and for the first few tasks you absolutely should — or you can leave it running and go back to what you were doing.

The examples Anthropic names are deliberately unglamorous, and that is a good sign. Gathering research for a report. Collecting the monthly invoices from vendor portals. Filling in forms. Pulling numbers out of a dashboard. Working through a portal that has no connector.

Translate those into what they look like in an actual week:

The monthly invoice hunt. Six vendor portals, each with a login, each with the PDF buried three clicks deep. Somebody on your finance side spends most of a morning on this every month, and it is pure retrieval — no judgment involved. This is the single most representative example of the category, which is why Anthropic leads with it.

The recurring form. The weekly submission to a client system, the compliance return, the order placed through a wholesaler's ordering page from a list you already have in a spreadsheet. The information exists; the labour is transcription.

The dashboard that will not export. Every business has at least one system that displays numbers beautifully and offers no sane way to get them out. Claude reading the screen and writing them down is a genuinely reasonable answer to that, and for years the alternative was a person with a notepad.

Research that needs twenty tabs. Checking forty prospects against their own websites, gathering how competitors describe a thing, pulling public filings. Work that is not hard, just long.

Notice what these have in common: high tedium, low judgment, and a clearly checkable result. That is the sweet spot, and it is also the honest limit — this is not the feature you use for work where being subtly wrong is expensive.

The Login Question, Answered Properly

It starts with no logins at all, and you add them one site at a time.

This is the part your team will ask about first, and Anthropic has been unusually careful here, so it is worth explaining accurately rather than vaguely reassuring people.

The built-in browser runs on a clean, sandboxed profile with no stored logins. Out of the box it is a browser that has never signed into anything. It cannot see your tabs, your bookmarks, or your saved passwords, because it is not your browser and has no access to it.

If you want Claude to reach a site that needs a login, you import that login deliberately — site by site, from Chrome, Edge, or Firefox on macOS, and from Firefox on Windows and Linux. Not all of them at once. One at a time, chosen by you.

And there is a floor underneath that choice: banking, email, and single sign-on sites are excluded unless you explicitly include them. The categories where a mistake is most expensive are opted out by default rather than in. That is the right default, and it is worth pointing out to a nervous colleague, because it tells you something about how the feature was designed.

The Risk That Is Genuinely New

An AI that reads web pages can be given instructions by a web page. Anthropic says so plainly, and so should you.

This is called prompt injection, and it is the one genuinely new category of risk that comes with any AI that browses. The idea is simple: Claude reads a page in order to work with it, and a page could contain text designed to look like an instruction — hidden in the markup, buried in a comment field, sitting in a document someone uploaded. The AI is reading everything on the page, and a malicious page can try to talk to it.

Anthropic ships defences against this. There are checks that review Claude's actions against what you actually asked for, so an action that has nothing to do with your request gets caught. The company's own language about how well this works is the sentence to repeat to your team: these measures meaningfully reduce the risk but cannot eliminate it.

That is an honest statement, and it points at the right operating policy, which is not complicated:

Start with sites you trust. Your own vendor portals, your own systems, established sites you have a relationship with. Not the open web, not random search results, not a link someone sent you.

Match the login to the stakes. The reason banking and email are excluded by default is that they are the accounts where a wrong action is worst. Keep it that way. A wholesaler's ordering portal and your business bank are not the same risk, and should not get the same treatment.

Watch the first few runs. The browser is visible in the side panel for a reason. Watch a task end to end before you let it run while you are elsewhere — you will learn more about what it is good at in five minutes of watching than in an hour of reading about it.

Why This Matters More Than It Sounds

It removes the last structural excuse for why AI could not touch your real operational work.

Step back at what Anthropic has shipped this year and the direction is consistent: get Claude out of the chat window and into the places work actually happens. It went into Microsoft 365, into Slack, into the browser, into hundreds of tools through connectors, and onto Anthropic's own servers so Cowork keeps running when your laptop is shut.

Every one of those had the same limitation underneath it: they only reached systems somebody had built a path to. The long tail of ordinary business software — the portals, the logins, the ageing internal systems — stayed out of reach not because the AI was not clever enough but because there was no door. A browser is the universal door. It is how every one of those systems was designed to be used in the first place.

There is a strategic read here too, and it is worth naming for anyone deciding where to invest. For two years the standard advice for automating a system with no API was: wait for an integration, pay a developer to build one, or accept the manual work. All three were bad answers for a 50-person company. The browser route sidesteps the question entirely, which means the set of work a non-technical team can realistically automate just expanded a lot — and it expanded specifically in the direction of the boring, repetitive, someone-does-this-every-Tuesday work that is the best possible thing to automate first.

The constraint that remains is not technical. It is that somebody has to notice which of these tasks their team is still doing by hand, and hand one over. Nothing about the release does that part for you.

What to Try This Week

One task, watched end to end. Not a demo — a real thing somebody does every month.

• Check you have it. It is in the Claude desktop app on macOS, Windows, or Linux — Enterprise now, and Pro, Max, and Team rolling out over the week. It is desktop-only: if your team lives in the web or mobile app, the desktop app needs to be open and online for this to run.
• Write the list. Ten minutes in a team meeting: which systems do we log into and click through by hand, on a schedule? Portals, forms, dashboards that will not export. This list is the actual deliverable — most teams have never written it down, and it is usually longer than anyone expects.
• Pick the most boring item on it. Highest frequency, lowest judgment, easiest to check. The monthly invoice collection is the canonical starting point for a reason: it repeats, it is pure retrieval, and you can tell instantly whether it worked.
• Import exactly one login. The one that task needs, and nothing else. Leave banking, email, and SSO alone — they are excluded by default, and that default is correct.
• Watch the whole first run. Do not walk away yet. You are learning where it is reliable and where it hesitates, and that judgment is what lets you delegate the next one properly.
• Then, and only then, walk away. The value of this feature is entirely in the tasks you stop attending. If you watch every run forever, you have bought a slower way to do it yourself.

One note on expectations, because it decides whether your team keeps going after week one: this will not be flawless. Sites change, forms behave oddly, some portal will have a step that confuses it. Judge it the way you would judge a capable new colleague on their first week with your systems — on whether it saves time overall once it knows the route, not on whether the first attempt was perfect.

Want your team to find the work that is still being done by hand and actually hand it over — rather than reading about another feature and changing nothing? The Deployed Kickstart gets everyone hands-on in a single day, mapped to your real workflows. The Partner program keeps your team current as releases like this keep landing.

Frequently asked questions