Why the Agent Doesn't Get Your Whole Browser
The built-in browser Anthropic shipped for Claude Cowork on August 26, 2026 opens inside a side panel in the desktop app. It went live immediately on Enterprise plans and is rolling out to Pro, Max, and Team plans across macOS, Windows, and Linux. The design pivots on separation: the browser Claude opens runs as its own profile, distinct from your personal browser, so without an explicit import step it can't see your tabs, bookmarks, or saved passwords at all. Even when a task calls for delegation, credential access still requires a separate consent step, which closes off the path where one tool call exposes an entire personal account.
Import Is the Exception, Not the Default
The first time the browser opens, an "Import cookies" button appears, and logins are pulled in one site at a time rather than in bulk. Banking, email, and single sign-on sites arrive unchecked by default, so the most sensitive account categories are excluded unless a user deliberately checks them. Coverage also varies by platform — Chrome, Edge, and Firefox import on macOS, only Firefox (beta) on Windows and Linux, and no import path at all on Safari — a gap that is itself a signal that "importable" does not mean "vetted safe."
From Design to Operations: A Credential-Import Gate Checklist for Browser Agents
Set the acceptance bar before rollout. Keep the import allowlist to business-critical domains only, capping it at under 10% of all domains the agent visits, and treat 0% import approval for financial and identity-provider categories as the default rule. The goal isn't maximizing convenience — it's pinning the exposure surface to a number you can measure.
Failure usually starts with convenience. Adding an SSO account to the import list to speed up a repetitive task hands one agent session a single authentication path into every service the organization runs. Anthropic's own safety guidance already tells users to keep browsing scoped to trusted sites, but a doc-level recommendation only becomes a control once it's written into team policy instead of left to individual judgment.
The second failure pattern is where prompt injection overlaps with import permissions. In a session with no imported credentials, a successful injection stays contained inside that browser session; once logins are imported, a single click a malicious page tricks the agent into making executes on a real account. That's the reason injection-response severity should differ depending on whether credentials were imported.
Recovery branches start by separating the moment of import from the moment of execution. Gate sensitive actions — payments, profile changes, sending mail — behind a human confirmation prompt instead of letting them auto-proceed, and wire in a circuit that immediately revokes a session's imported credentials the moment injection-style text (role overrides, requests for system-prompt contents) is detected on a page. Declaring the stop condition for irreversible actions in code means you're not relying on the agent's judgment call every time.
Before shipping, run a scenario test confirming that imported credentials auto-deactivate on any access to a domain outside the allowlist, and standardize log fields — session ID, import status, visited domain, whether a sensitive action fired, whether human confirmation was requested — so any session's behavior under imported access can be reconstructed during an audit. Because logging raw page content risks leaking an imported account's personal data into log storage, route everything through an email- and card-number-pattern masking filter before it's written.
Pull a weekly ranking of domains generating the most import requests: fold the ones with recurring, legitimate business use into the formal allowlist, and log the rest with a rejection reason you can reuse as evidence the next time the allowlist comes up for revision.
Takeaways at a Glance
Claude Cowork's built-in-browser safety design starts from treating import as an exception rather than a default, with banking, email, and SSO excluded automatically. Layer on your own acceptance bar — under 10% of domains importable, 0% for financial and identity categories — plus a recovery rule that revokes credentials the instant injection is detected, and the vendor's baseline safety mechanics turn into an actual organizational operating rule.
References
Claude Cowork gets a built-in browser: nothing to install — Claude by Anthropic