Claude Browser Use

Homonym warning. This is anthropic's Browser Use toolset in the Claude API (browser_toolset_20260801). It is not browser-use, the GitHub org whose agent framework drives Chromium over the Chrome DevTools Protocol. Same two words, no connection — the source reporting it (anthropic-browser-use-tool) flags the collision itself.

A tool definition Claude can call to work a web page through its accessibility tree instead of a screenshot. Announced 2026-08-20 alongside general availability for Computer Use, the Skills API and the Files API.

The name oversells it in one specific way, which is the headline the reporting chose: Anthropic does not run a browser. Adding the toolset to a Messages API request exposes 27 browser operations by default, and all of them are requests. The developer's own code — the executor — has to open a browser, carry out each operation, keep the session alive across turns, and hand back enough of the result for Claude to know what happened.

References instead of coordinates

The mechanism is one substitution. Computer Use drives a whole desktop by looking at screenshots and sending mouse coordinates: click at x: 640, y: 320. Browser Use stays inside the page, where structure is available that pixels would only let you guess at.

Claude calls read_page; the executor returns a text rendering of the accessibility tree with links, buttons and text boxes tagged — ref_3 and so on. To click that button, Claude sends ref_3 with the operation. It never computes a screen position.

This is text-first-agent-design arriving as a vendor API rather than an open-source tool, and on the surface the pattern started on: a browser. mobilerun made the same trade on a phone's OS accessibility tree and claimed a 500× smaller payload for it. Nobody has published the equivalent number here. Re-checked 2026-09-16: still no figure for this API. The numbers that exist are for other tools on the same idea — Playwright MCP snapshots at ~200–400 tokens against thousands for a DOM dump, Silbercue's public-browser claiming −30% tokens over Claude-in-Chrome, ytyng.com's 2026 three-tool token benchmark — none of which measures Anthropic's Browser Use tool.

The refs go stale and the API will not tell you. If the tab navigates, or the page changes enough, ref_3 may no longer point at the same element. Catching that is the executor's job: notice the mismatch, refuse the action, make Claude read the page again. A correctness burden that lives entirely in code Anthropic does not ship — and the reason the tool is less finished than the announcement reads.

Batching, and what it costs

Claude can ask for several actions in one turn, arriving together as multiple tool_use blocks. The executor runs them in order and returns the results as a set, so there is no model call between every click and keystroke. Anthropic's pitch is latency and cost, and it gets better the longer the task: dozens or hundreds of interactions rather than a handful.

The ordering is the catch. Each action assumes the page state the previous one produced, so a failed first click poisons everything after it: the executor cannot skip ahead, because Claude planned the rest against a page it never reached.

It also breaks the approval model. See agent-permission-model — a batch can start with a click nobody would gate and end somewhere that needs a human, so the gate has to sit inside the execution loop, checking action by action, rather than at the boundary where a single-action protocol let you put it.

What it costs before it does anything

Loading the default toolset adds roughly 6,600 input tokens to a request, per Anthropic's pricing docs — before any screenshot, accessibility tree or action result. Developers can switch off operations they don't need.

That is the token-budget tension in miniature (context-rot, headroom): a tool built to spend fewer tokens on page representation charges thousands of tokens to be available at all. The saving has to clear the floor.

Who hosts what

Browser Use is Claude API only and is not available inside claude-managed-agents. The same release ran the other way on everything else: skills uploaded through the Skills API run in Anthropic's code-execution sandbox, and the Files API keeps documents Anthropic stores and hands back by ID. Browser sessions, their downloads and their uploaded files stay on the developer's machine.

So one release moved skills and files onto Anthropic's infrastructure and left the browser off it. Whether that is a staging decision or a durable line is unstated.

Containment is the developer's problem too

Because the browser is yours, so is the blast radius. Anthropic's own advice: run it in an isolated container or VM with minimal access, and leave JavaScript and file uploads disabled unless the task needs them, since code Claude generates executes with the page's privileges and can reach whatever that page can reach. Web content remains an untrusted input — prompt injection and unexpected redirects are live, not theoretical.

Prior art it does not connect to

The concepts are not new and the reporting says so plainly. Playwright already represents a page as an ARIA snapshot and locates elements by role; Microsoft's Playwright MCP server already hands a model structured accessibility snapshots with references. Puppeteer exposes the tree through Accessibility.snapshot() and drives Chrome and Firefox.

What differs is the wire. Playwright MCP speaks MCP; Browser Use speaks Anthropic's own client-toolset protocol. A developer wanting Claude on top of Playwright still writes the adapter both ways — translating Claude's requests into Playwright calls and the results back into the shape Claude expects. Convergent design, divergent protocols, integration work in the gap.

anthropic-browser-use-tool · text-first-agent-design · agent-permission-model · claude-managed-agents · model-context-protocol · webmcp · mobile-device-agent · browser-use · anthropic · agent-workspace-linux (one executor environment: a workspace-owned Chrome over loopback DevTools, isolated from the user's browser)

Sourced from anthropic-browser-use-tool (The New Stack, 2026-08-21). No first-party Anthropic document has been ingested here yet — the toolset id, the operation count and the 6,600-token figure are all reported at second hand.