Claude vs ChatGPT vs Kitesurf: Agent Browsers 2026
The Short Answer
| Claude Cowork browser | ChatGPT Work browser | Cloudflare Kitesurf | |
|---|---|---|---|
| Form | Side panel in desktop app | Headless Chrome in Work environment | Agent-first browser runtime |
| Where it runs | Locally, via desktop app | Server-side (Work Cloud) or local (Work Local) | Cloudflare edge |
| Needs your machine on | ✅ Yes | ❌ No (Cloud tier) | ❌ No |
| Credential import | Chrome/Edge/Firefox; banking + email excluded by default | Within Work environment | Programmatic |
| Best for | Attended research, multi-site gathering | Unattended long tasks + code execution | Programmatic agent traffic at scale |
| Injection exposure | High | Highest (code exec + filesystem + deploy) | Contained by design |
Last verified: August 31, 2026.
The Architectural Split That Actually Matters
Ignore the feature lists for a moment. There is exactly one question that separates these three products: where does the browser process live?
Claude Cowork: on your machine. Anthropic ships the browser inside the desktop app, launched in late August 2026. Pages are fetched from your network and your IP. Geo-restricted content and IP-allowlisted internal tools remain reachable. The cost is that the desktop app must be running — even for cloud Cowork sessions — so nothing runs while your laptop is shut.
ChatGPT Work: on OpenAI’s servers (Cloud tier) or your desktop (Local tier). Work Cloud runs through chatgpt.com with a genuinely headless Chrome; Work Local is a desktop app. The Cloud tier is the only one of the three that can browse for hours while you sleep.
Kitesurf: on Cloudflare’s edge. It is not a browser a human uses at all — it is a browser runtime designed for agent traffic, addressed programmatically.
Every other difference downstream of this is a consequence of that choice.
Capability, Honestly Ranked
ChatGPT Work is the most capable — and the most alarming
Simon Willison’s hands-on breakdown, published in late August 2026, catalogued what ships in the Work environment: internet-connected code execution, a headless Chrome, a persistent /workspace/scratch filesystem, ChatGPT Sites deployment onto Cloudflare Workers, sub-agents, and scheduled automations.
His verdict was that the combination hits the full lethal trifecta — private data, exposure to untrusted content, and an exfiltration path — and he criticised OpenAI’s documentation for emphasising use cases over technical specification.
He is right, and the deployment primitive is the part people underrate. An agent that can read a hostile web page and publish a Cloudflare Worker has a first-class exfiltration channel that does not look like exfiltration. It looks like the product working.
Claude Cowork is the most usable
Zero setup, included in Pro/Max/Team/Enterprise, visible in a side panel you can watch. Anthropic’s positioning — “a lot of web tasks don’t need your browser, just a browser” — is aimed at cutting the Chrome-extension dependency, and by extension Google.
The visibility is a real safety property, not a consolation prize. An attended agent whose actions render in front of you fails loudly. A headless agent fails silently at 3am.
Kitesurf is the only one designed for the problem
Kitesurf starts from the premise that agents are not humans and should not pretend to be. That reframing is what lets it contain injection risk structurally rather than by policy — there is no imported credential vault, no user filesystem, no daily-driver profile to compromise.
The trade is obvious: it is infrastructure. You write code. It solves nothing for a knowledge worker who wants a research task done this afternoon.
The Credential Question
This is where the products genuinely diverge on judgement, not just architecture.
Anthropic lets you import saved logins from Chrome, Edge and Firefox but excludes banking and email by default. Keep that exclusion. Email is the master key to almost every account through password reset — an agent with mailbox access and an injection vulnerability is an account-takeover engine, not a productivity tool.
The general rule across all three: assume anything the agent can see, it can exfiltrate. Scope credentials to that assumption. Use a dedicated browser profile for agent work. Never point an agent at your identity provider.
Which To Pick
Pick Claude Cowork’s browser if you have a Claude subscription, want research and multi-site data gathering done while you watch, and value setup cost near zero.
Pick ChatGPT Work if the task genuinely needs code execution plus browsing plus persistence over hours — and you are willing to run it against non-sensitive accounts in a blast-radius-limited environment.
Pick Kitesurf if you are building a product where agents browse at volume and you want the runtime to be honest about that.
Pick none of them for anything touching payments, email, or production credentials. That boundary has not moved in 2026.