Anthropic's Browser Use toolset does not, despite the name, run a browser. It gives Claude a way to describe what it wants done to a page. The developer supplies the browser, executes every action, and reports back. The toolset went live Thursday for the Claude API under the identifier browser_toolset_20260801. Computer Use, the Skills API and the Files API reached general availability in the same release. Claude Managed Agents does not have access to it.
Coordinates out, references in
Screenshot-based control asks a model to do vision work before it can do the task. Find the button. Estimate its centre. Emit a click at x: 640, y: 320. Browser Use replaces that with text: a read_page call returns the accessibility tree, and interactive elements arrive tagged with handles such as ref_3. Claude then names the handle instead of guessing a pixel.
The gain is precision. The new failure mode is staleness. A handle can go dead the moment the tab navigates or the DOM shifts underneath it. Anthropic's API will not flag that. Catching the mismatch, refusing the action and forcing a re-read is the executor's job.
Where the work lives
That executor absorbs most of the integration effort. It translates operations into real actions, keeps the session alive across turns, and returns enough detail for Claude to follow the consequences. It also runs entirely on the developer's infrastructure. Skills execute inside Anthropic's sandbox and Files API documents live behind Anthropic-issued IDs, but browser sessions, downloads and uploads stay put.
The toolset is not free to load, either. Twenty-seven operations ship by default, costing roughly 6,600 input tokens per request before any screenshot or tree is sent. Applications that will never call half of them can switch the rest off.
Familiar to anyone who uses Playwright
None of this will feel novel to teams already automating browsers. Playwright models pages as ARIA snapshots and finds elements by role. Microsoft's Playwright MCP server has been feeding models referenced accessibility snapshots for a while. Puppeteer reaches the same tree through Accessibility.snapshot().
The concepts line up; the protocols do not. Playwright MCP speaks MCP, Anthropic speaks its own client-toolset format, and an adapter has to translate in both directions. A wholly unrelated open-source project also called Browser Use drives Chromium over the Chrome DevTools Protocol, which is a naming collision and nothing more.
Batching buys speed, spends certainty
Claude can now request several actions in one turn as multiple tool_use blocks. The application runs them in order and answers once. Over a session with hundreds of interactions, that removes a great deal of round-tripping, and with it latency and cost.
Order is not optional, though. If the opening click fails, everything queued behind it targets a page that never existed, so the batch has to stop. Approval flows inherit the problem: a sequence can begin harmlessly and finish somewhere that needs a person to sign off.
Assume the page is hostile
Anthropic's security advice is blunt. Treat the page as hostile. Prompt injection travels in web content, redirects go where they like, and JavaScript that Claude writes inherits whatever privileges the page holds. Run the whole thing in an isolated container or virtual machine with minimal access. Leave JavaScript execution and file uploads disabled until a workflow demonstrably needs them.
