Anthropic just added a built-in browser to Claude Code, letting the assistant open external websites, read their content, click on elements and type inside forms directly. The window opens through a keyboard shortcut, runs on a clean profile with no saved credentials, and organizations can restrict it via an allowlist or shut it off entirely.
Key Takeaways
- Claude Code now ships a native browser that can read, click and type on external sites.
- A layer of classifiers blocks unauthorized purchases, account creation and CAPTCHA bypasses without user consent.
- The browser starts on a clean profile, and organizations can restrict it via allowlist or fully disable it.
Have an AI Sum Up This Article
ChatGPTA native browser, not a bolt-on plugin
Anthropic pushed a July 12 update to Claude Code that adds a browser as a native tool inside the IDE. The window opens through a keyboard shortcut, in its own tab within the application, and exposes to Claude a set of high-level actions: reading a page, clicking on an element, typing into a field, and jumping from one link to another.
The shift moves Claude Code beyond its historical ground. Until now the assistant stayed inside the local project sandbox, with access to the shell, the filesystem and the internal app preview. Adding a browser opens the assistant to the live web, with the ability to fetch information on its own from a documentation site, an issue tracker or an admin console accessible through a URL.
The technical block did not start from scratch. Anthropic noted that the tool reuses the same engine that already powers Claude Code’s “local app preview” feature, on top of an extra security layer. In practice, Claude can now run its own loop: read a doc, adjust its local code, retest in the built-in browser, iterate. The tool keeps stacking features, Claude Code also gaining artifact sharing.
The move fits a broader pattern at Anthropic. The lab recently admitted that Claude is already used heavily on office tasks, far more than on writing code. Building a browser into Claude Code pushes the dev assistant closer to that Cowork positioning, where reading and acting on web pages becomes an ordinary move.
Anthropic also ships a separate Chrome extension for cases where a developer wants Claude to act inside a personal logged-in session. The built-in browser does not fill that role: it is locked by design onto a clean profile, without any saved login, to preserve isolation between the agent and the user’s own credentials.
Organization allowlist, classifiers upstream
The safety layer ships with the feature. A set of classifiers filters each write action before it leaves for the target site. Anthropic’s documentation lists three categories blocked by default: unauthorized purchases, account creation, and CAPTCHA bypasses without explicit user consent.
Organizations that deploy Claude Code at scale get a second control. They can restrict the built-in browser through an allowlist of approved domains, or fully disable the component. The choice sits at the enterprise config level, independent of what each developer switches on inside their local environment.
The clean profile is the third guardrail. The built-in browser starts every session with no cookie, no stored password, no connected identity. A developer who wants Claude to act on a personal GitHub account has to route through the dedicated Chrome extension, not through the built-in browser. The isolation is strict, almost aggressive, to prevent any slip on sensitive resources.
The use cases Anthropic highlights stay deliberately mild: reading documentation sites, navigating an issue tracker, checking a public web resource. The lab avoids agentic e-commerce scenarios for now, where a browser action would translate into an actual purchase. The red line holds as long as the classifiers hold.
The enterprise context weighs on those choices. Anthropic sells Claude Code to tech teams that still have the precedent in mind where Alibaba banned Claude Code from employee laptops after China’s NVDB alert. A misconfigured built-in browser would be exactly the kind of incident that hands other security leaders a fresh case to replay that script.
More articles on Horizon
- Anthropic Extends Fable 5 Promo Through July 19
- Claude Runs More Office Work Than Code, Anthropic Admits
- Apple Sues OpenAI Over iPhone Secrets and 400 Hires
Against Sonnet and Sol, the browser becomes a real differentiator
The feature lands as competition on visual agentic work tightens. OpenAI has been pushing since May an agent that navigates through a dedicated browser component. Google folds the same logic into Gemini Enterprise. Anthropic answers here on the developer field, with a browser lodged inside the IDE rather than inside a consumer chat.
The difference is structural. A browser inside a consumer chat parks the web action next to the user prompt, in a context that is often blurry. A browser inside an IDE parks it next to the code, the repo and the tests, with a clear chain of responsibility on the developer side. For any serious pro use, the second frame reads far cleaner.
Rival LLM labs will have to answer on foundations. GPT-5.6 Sol and Gemini 3.5, which leaks point to at 2 million tokens of context, already carry the raw horsepower for agentic web work. Neither has yet shipped a brick as tightly anchored inside the development environment as the one Anthropic just plugged into Claude Code. That horsepower carries a physical price tag, with AI agent energy now hitting 150 Wh per request.
For CTO teams currently evaluating coding copilots, the gap changes the scoring grid. A hands-on test on the new built-in browser feels inevitable in the coming days, with concrete questions: loop execution time on a read-code-test cycle, classifier stability on complex sites, token cost of the full loop.
The bigger debate on the autonomous web agent remains open. Anthropic pushes here a framed version, with rails and a clean profile. Whether to widen the perimeter to automated purchases, admin console actions or operations on logged-in SaaS services stays on the table. Each notch of opening will add a notch of risk, and the lab will have to reopen the public conversation each time.
Follow the story on Horizon.
