Claude in Chrome vs the Cowork built-in browser

Claude in Chrome and the Cowork browser shipped the same day

Claude Cowork is the part of the desktop app where you hand work to Claude instead of chatting with it. Before August 26, 2026, the only way for Cowork to reach the web was to give Claude your own Chrome through the extension. On that day Anthropic built a browser into Cowork, and in a separate post it moved Claude in Chrome from a limited pilot to general availability.

What Is Claude AI? Free Plan, Models, vs ChatGPT explains the plans and models if you are still working out what the Claude lineup includes. Cowork runs on those plans and is where Claude does the work instead of describing it.

The built-in browser opens in a Cowork side panel

The built-in browser opens by itself when a task needs a website. It appears in the side panel, where Claude goes from page to page, reads, clicks and types while you get on with other work.

It needs no extension and no setup, and none of your own browsing is shared with it unless you choose to share it. Plenty of web tasks never needed your browser in particular, just a browser, and those are the tasks it takes over.

The Claude browser extension reached general availability

Claude in Chrome does the opposite and controls the Chrome window you already have open. The extension came out of its pilot and is now on every paid Claude plan, and Claude can act without stopping for approval at each step.

This helps most with systems that were never connected to Claude. Internal dashboards, legacy tools and vendor portals have no integration to turn on, but they do have a web page, and a page is all the extension needs.

Which one fits the task in front of you?

Pick Claude in Chrome when the work is on a page you already have open, in an account you are logged in to. Pick the Cowork built-in browser when you want Claude to take over the web part of a job while you do something else. That is how Anthropic itself divides the two in its announcement.

Only one of the two uses your own logins

The built-in browser is its own browser, not a window into yours. Claude cannot see your tabs, bookmarks or passwords, and when a site asks for a sign-in, you bring that login over one site at a time.

The browsers you can import a login from depend on your system: Chrome, Edge and Firefox on macOS, and only Firefox on Windows and Linux. Banking, email and single sign-on sites stay excluded unless you choose to add them.

A task-by-task split between the two

Read the table above as a question about the job, not the tool. If the work only makes sense inside an account you are logged in to, use the extension; if it means gathering pages or invoices from sites where you are not logged in, let the built-in browser handle it.

There is one more practical difference. The built-in browser lives in the desktop app, so Claude can still drive it from the web or your phone as long as that app is open and online. When the desktop app is not running, the extension is the only way to give Claude a browser.

Claude in Chrome now acts without asking for every click

Removing approval for each action is the main change in this release, and also the risky one. A prompt injection hides instructions in a page, an email or a form field so that an agent reading them obeys the attacker instead of you. Anthropic responded with two automated checks and a switch back to manual control, and it published measured results instead of simply claiming safety.

A probe and a classifier sit between page and action

Web content arrives at Claude as a tool-call result, and the first check sits there. Probes scan those results for likely injections, and when one triggers, Claude is told to treat the content with suspicion and to check back with you before acting if needed.

The second check runs just before an action. A classifier compares what Claude is about to do with what you originally asked for and blocks anything that does not fit.

Claude now approves actions it considers safe on its own. It uses the same mechanism as auto mode in Claude Code, which Claude Code Auto Mode Is Now the Default Setting covers. The third safeguard is yours: switch autonomous actions off in settings and Claude goes back to asking before every step.

Attack success rates fell to 0.3% or lower

The results only make sense against a baseline. With no extra safeguards, attacks that reached the model worked 17.6% of the time against Opus 4.5 and 3.8% against Opus 5, and even the strongest setup available in November 2025, Opus 4.5 with probes, let 16.7% through.

The current setup comes in far lower. From Opus 4.8 onward, with probes and the safety classifier both running, no attacks succeeded against Sonnet 5, Opus 5 or Mythos 5, and Fable 5 was the only model with a nonzero rate, at 0.3%. Anthropic says it reviewed those successful attacks by hand and rated every one low severity, and that it is working on them.

Two caveats go with these figures. The rate counts only attacks that reached the model, because Claude's own behavior sometimes keeps it from ever seeing the hidden instructions. Anthropic also says plainly that the problem is not solved, and that is a better reason than any number to start on sites you trust.

Your plan and your admin decide what you can use

Whether you can use either one right now depends on your plan, your operating system and, inside an organization, an admin setting. They also arrive on different schedules.

The built-in browser needs the desktop app

The built-in browser was due to reach Pro, Max and Team plans in the week after the announcement, as a beta on macOS, Windows and Linux. It is switched on by default once it arrives. Enterprise had it from day one under admin control, and any job that involves a website opens the browser automatically.

The extension is installed from the Chrome Web Store and works on every paid plan, with some limits. It does not run in other Chromium browsers or on mobile, and you still need the desktop app to work with files on your own computer or with other applications.

Admins turn each one on in a different place

Each one has its own admin screen. On Enterprise plans, admins manage the extension in Organization Settings, where they can also limit it to approved domains, while the built-in browser is under Organization Settings → Cowork → Built-in browser.

For a Team or Enterprise rollout, check both places before anything else. Turning on one and assuming the other came with it is the easiest way to end up half deployed.

Claude keeps your existing choice until you change it

Until you change the setting, Claude picks for you. If Claude in Chrome is already in your setup it stays the default; if not, Claude uses the built-in browser. You can change this under Settings → Cowork → Preferred browser and switch back the same way.

The choice itself is simpler than the announcement made it seem. Work that needs your signed-in accounts goes to Claude in Chrome, and work that just needs a browser goes to the Cowork one.

When Claude gathers pages for something you will write, sakutto's URL to Markdown converter turns them into clean text you can edit. Paste a link and the page structure stays, while the navigation and ads that would otherwise come along are left out.

Watch how Claude handles a few tasks before giving it more. The safeguards are measured, not absolute, and you are the one who decides how much to hand over.