Anthropic's Claude Cowork browser isolates sessions, blocks risky sites

Understanding the security model for Anthropic's Claude Cowork browser is critical for enterprise adoption. This guide examines its cloud-based session isolation, default blocklists for risky sites, and the persistent threat of indirect prompt attacks that all teams must consider.

Claude's browser is designed for safety, running inside a secure cloud workspace where each session is ephemeral and wiped clean upon completion. The agent cannot access local browser data like bookmarks or passwords. Anthropic combines this isolation with per-action safety checks and a blocklist for sensitive domains, including corporate email and online banking.

How Claude Cowork's Browser Isolation Works

Anthropic's Claude Cowork browser operates in a secure cloud sandbox, separate from the user's local machine and network. Each session is temporary and deleted upon completion, preventing access to local browser tabs, history, or passwords. This isolation is paired with default blocklists for sensitive sites.

The isolation boundary is implemented cloud-side, meaning Cowork's code cannot access the user's local network. According to Anthropic's documentation on isolated cloud execution, the agent can only view information a user voluntarily shares. To prevent accidental data exposure, several categories are blocked by default:

• Authenticated banking portals
• Webmail and single sign-on dashboards
• Sites on Anthropic's internal high-risk blocklist

This core promise - that Claude never sees your tabs, bookmarks, or passwords - is central to its security posture. However, if a user enables the "skip all approvals" feature, the risk of an attack succeeding via prompt injection increases, even though Anthropic's classifiers still screen each automated step.

The Risk of Indirect Prompt Injection

The primary threat to AI browsing agents is indirect prompt injection. This attack occurs when malicious actors hide instructions for the AI inside web page content, using invisible text or HTML elements. The agent processes these hidden commands without the user's knowledge.

A 2026 Cloud Security Alliance field study documented agents being tricked into exfiltrating data. This scenario is known as the "lethal trifecta," combining access to private data, consumption of untrusted content, and the ability to send data externally. For example, a hidden command could instruct an agent to email a private passcode to an attacker.

How to Mitigate Prompt Injection Risks

Effective countermeasures focus on limiting the agent's autonomy and access. While Claude Cowork's browser isolation provides a strong baseline, security teams can further strengthen their posture with these steps:

• Maintain Human Oversight: Always keep the per-action approval flow active for file uploads, form submissions, and downloads. Avoid "skip all approvals" mode.
• Implement Enterprise DLP: Use Data Loss Prevention (DLP) tools to monitor and block any outbound messages that contain regulated or sensitive data.
• Use an Allowlist: For tasks with a narrow scope, such as searching an internal knowledge base, restrict the browser to a pre-approved list of safe domains.
• Process Content Safely: Treat all fetched web pages as untrusted and consider using tools to strip invisible text or scripts before the agent processes the content.

What Browser Isolation Does and Does Not Guarantee

Browser isolation effectively protects the user's machine from malware or arbitrary code execution by the agent. However, it cannot prevent the agent from misusing data that is already visible on the screen or in files the user has shared.

Security in this model is layered, relying on cloud sandboxing, permission gates, safety classifiers, and final human approval. Bypassing these gates for faster workflows directly increases the risk of data leakage if a hidden prompt bypasses the automated screening. Anthropic's guidance confirms this trade-off, emphasizing that human oversight remains the most critical defense.

---

How does Claude Cowork's built-in browser protect my personal data?

Claude Cowork's built-in browser runs in an isolated, temporary environment on Anthropic's servers that is completely separate from your computer and network. This means Claude never sees your tabs, bookmarks, or passwords from your regular browser. Each browsing session gets its own clean environment that is removed entirely when the session ends.

However, it's important to understand what isolation does and doesn't mean: the sandbox protects your computer from code Claude runs, but Claude can still read and act on anything you explicitly grant it access to - including files you share, screen content you allow it to view, or authenticated sessions you bring into the agent context.

Which websites does Anthropic block by default?

Anthropic intentionally excludes sensitive categories from built-in agent access unless users explicitly choose to share credentials. Specifically, Claude Cowork blocks or excludes:

• Banking and financial services
• Email platforms
• Single sign-on (SSO) services

These restrictions apply unless you actively bring credentials into the agent context. This design reflects Anthropic's assessment that these categories carry disproportionate risk for accidental data exposure or unauthorized actions.

Additionally, Claude Cowork maintains site blocklists for high-risk websites and uses safety classifiers to screen for potential threats before actions execute.

What is "indirect prompt injection" and why should I care?

Indirect prompt injection is an attack where malicious instructions are hidden in web content that AI agents read - embedded in HTML comments, invisible text, zero-font elements, or metadata that humans won't notice but agents process as instructions.

This is not a theoretical concern. According to 2026 research from the Cloud Security Alliance, adversaries have been seeding the open web with hidden instructions specifically targeting browsing AI agents, coding assistants, and enterprise copilots. Security Affairs reported cases where hidden prompts on malicious websites tricked AI agents into making payments or trusting fake sites.

The core risk combines three elements security researchers call the "lethal trifecta": when an agent has access to private data, consumes untrusted content, and can communicate externally, a single injected instruction can turn it into an exfiltration tool.

Why does the author warn against "skip all approvals" mode?

The "skip all approvals" setting removes critical safety checkpoints that would otherwise catch risky or unexpected agent behavior. When enabled:

• Claude proceeds with actions without requesting explicit confirmation
• Hidden instructions on web pages can direct the agent without human intervention
• The agent might inadvertently access or expose sensitive data based on misleading page content

Anthropic's documentation emphasizes that even in "Automatically approve" mode (a more limited setting), Claude still checks each action for safety and blocks or pauses unsafe actions. Completely bypassing approvals eliminates this safeguard.

For organizations, maintaining approval workflows represents a essential control to reduce data leakage when deploying agent assistants.

How does Claude Cowork compare to other enterprise AI agents on security?

For enterprise deployments, the key differentiator across vendors is data retention and training policies:

Vendor	Enterprise Default	Retention	Special Controls
Anthropic	No training on customer data	7-30 days for usage records	Zero data retention available by negotiation
OpenAI	No training on Enterprise/Team tiers	~30 days for safety logs	Zero Data Retention for eligible API/enterprise use
Google (Vertex AI)	No training by default	Configurable	Data residency and regional controls

All three vendors offer stronger privacy defaults for enterprise tiers than consumer products. Anthropic's specific security architecture for Cowork emphasizes session isolation and category-based exclusions rather than relying solely on post-hoc monitoring.

Organizations evaluating AI agents should verify exact retention terms for their specific model tier and negotiate zero-data-retention agreements where available, as these protections are not always automatic.