Anthropic announced on August 12 that Claude in Chrome’s side panel is no longer a disconnected, tab-scoped conversation — it’s now a full Claude Cowork session, carrying state across browser, desktop, web, and mobile. “Your Claude in Chrome sessions now carry over to desktop, web, and mobile,” the post reads. “Conversations are saved, and your skills and connectors work in the browser.” Close the tab, pick the same task back up from the desktop app an hour later. It’s a real usability fix for a product that previously lost your context the moment you navigated away.
What actually shipped#
The mechanics are straightforward, if thinly documented. Anthropic’s example: ask Claude in Chrome to pull invoice details from several vendor portals, have it open the tabs and build a spreadsheet, then switch to desktop to add local files or compare results — same session, different surface. Skills and connectors configured anywhere on the account now work automatically inside the browser panel, rather than needing separate setup per surface.
Guardrails carry over too, per the post: “Before anything consequential, like submitting a form, sending a message, or downloading a file, a separate check reviews the action against what you originally asked for and blocks anything that doesn’t match.” Certain actions — purchases, sharing personal data — still require an explicit ask. Reasonable defaults, though the post gives no detail on how session state actually syncs across devices; there’s no mention of a sync protocol, storage backend, or what happens on conflicting concurrent edits. That’s a real gap in the announcement, not just an unanswered question.
Rollout is Max and Team plans today, Pro “rolling out over the coming weeks,” and Free isn’t mentioned at all — read as excluded. Enterprise gets the safer default: Claude in Chrome is off by default, with admins able to enable it and restrict it to approved domains. It’s Chrome-only for now — the post explicitly rules out other Chromium browsers (Edge, Brave, Arc) and mobile, despite Cowork elsewhere being cross-platform.
The stated rationale is practical rather than strategic: browser access reaches “internal dashboards, legacy systems, and vendor portals” that have no API or connector integration. That’s a fair point, and distinct from what an IDE copilot like Cursor does — Cowork isn’t inline code completion, it’s delegated, multi-step task execution across whatever surface you happen to be on. The philosophical distinction this blog usually draws against IDE-anchored tools — assist-in-the-loop versus actually-autonomous — mostly holds here. Cowork in a browser tab is still doing the same “go do this multi-step thing and check back” work it does on desktop; the sidebar is just another entry point, not a different execution model.
The part the announcement doesn’t mention#
Here’s what makes the timing worth pausing on. In May, security researcher Ax Sharma of Manifold Security reported a flaw in Claude for Chrome via HackerOne: any browser extension could trigger nine predefined Claude workflows simply by firing a synthetic click, because the extension wasn’t checking Event.isTrusted. Anthropic acknowledged the report the next day. Rated CVSS 7.7 by default — 9.6, Critical, with “Act without asking” enabled, which is precisely the kind of setting a Cowork power user expanding their session across devices is likely to have on.
The flaw’s staying power is the actual story. Multiple independent outlets — TechRadar, The Hacker News, CSO Online, TechRepublic, Infosecurity Magazine — reported the underlying bypass was still reproducible in Claude for Chrome v1.0.80, released July 7, roughly six weeks after Anthropic acknowledged the report. A rogue extension exploiting the flaw could reach Gmail, Docs, Calendar, and Salesforce sessions through the compromised agent. This isn’t a single-blog rumor; it’s corroborated across five independent security outlets plus the original researcher’s own writeup.
None of that means the specific vulnerability is present in whatever build shipped the new cross-device session feature on August 12 — Anthropic may well have patched it since July 7, and this piece isn’t claiming otherwise. But Anthropic’s own announcement makes zero mention of the extension-hijacking history, and expanding the surface area of what a Chrome-resident agent session can reach — now spanning devices, with saved conversation state and always-on skills — is exactly the kind of change that deserves a line acknowledging the product’s own recent security record, not silence. This blog has been consistent on this point before, most recently with Ghostjacking: agents that trust more inputs by default need to say what they’re doing about the inputs that already burned them.
The OpenAI contrast nobody’s pointing out#
Three days before Anthropic’s announcement, OpenAI quietly retired its standalone Atlas browser (August 9), folding its agentic browsing features into a ChatGPT Chrome extension, an updated desktop app, and a remote cloud browser — reported consistently by TechRadar, MacRumors, and OpenAI’s own help center under the heading “Evolving Atlas into ChatGPT for browser-based agentic work.” No source ties the two moves together causally, and this piece won’t pretend otherwise. But the sequencing is genuinely interesting: OpenAI just walked back a standalone-browser bet toward an extension-based model, and Anthropic deepened its own extension-based bet in the same week. If nothing else, it’s a signal that “an agent living inside your existing browser” is winning out over “an agent that replaces your browser” as the industry’s working answer — which makes getting the extension security model right a shared, not Anthropic-specific, problem.
The verdict#
Making Cowork sessions portable across Chrome, desktop, web, and mobile is a legitimate improvement, and the guardrails described — pre-action intent checks, explicit confirmation for irreversible actions — are the right defaults for a browser-resident agent. What’s missing is any acknowledgment that the surface being expanded is the same one that had a reported, unpatched-for-weeks extension-hijacking bug earlier this year. Shipping more capability into a Chrome extension without a word about that history isn’t dishonest, but it is an omission a security-literate reader will notice, and a blog covering this space shouldn’t paper over it either.
Sources: Anthropic’s Cowork Chrome side panel announcement (Aug 12, primary), 9to5Mac and Engadget coverage, TechRadar on the Claude for Chrome extension bypass, Manifold Security’s original HackerOne disclosure writeup, OpenAI’s Atlas-to-extension transition notice.