Short answer: not on Anthropic’s own agent, and not by accident. Claude Code’s new in-app browser can read a storefront, click through it, and fill a cart — but Anthropic has written a hard stop in front of the purchase itself, and that line is worth understanding if you sell online.

What shipped

Claude Code’s desktop app got a built-in, tabbed browser during the week of July 6–10, 2026 (Cmd+Shift+B / Ctrl+Shift+B), extending a pane previously limited to the user’s own local dev-server previews so it can now open any external site. Claude interacts with the page using the same tools it uses to verify a developer’s own app: it reads the DOM, clicks elements, and fills forms (Anthropic, “Week 28” release notes; Claude Code desktop docs, “Browse external sites”).

The line Anthropic drew

Two safety checks sit in front of any action on an external page, and they’re worth separating because they answer different questions.

  • Every write action gets classifier review. “Safety classifiers review Claude’s write actions on external pages, such as clicking and typing, in every permission mode” — including Bypass permissions mode, which otherwise skips most prompts. A flagged action triggers a permission prompt regardless of mode.
  • Each site needs its own one-time approval. The first time Claude acts on a site, a card asks the user to Allow once, Always allow, or Deny — subdomains count separately, so approving shop.example.com doesn’t cover cart.example.com.

Neither of those is the purchase gate. That’s a separate, explicit line, stated verbatim in Anthropic’s own docs: “Even on an approved site, Claude won’t purchase items, create accounts, or bypass CAPTCHAs without your input” (Claude Code desktop docs). Site approval buys Claude permission to browse and fill forms on that domain going forward — it does not buy permission to complete a transaction. Anthropic says the Browser pane uses the same safety model as the separate Claude in Chrome extension, which shares the same “no unattended purchases” behavior (Anthropic support, “Using Claude in Chrome safely”).

This adds a second confirmed data point to the growing pattern that agentic checkout is landing as a human-gated last step, not a fully autonomous one — the same posture the Ninth Circuit is currently weighing from a legal angle in Amazon v. Perplexity, and the default OpenAI’s and Google’s own in-chat checkout rails also build around (ACP and UCP).

What kind of visitor this traffic looks like

The Browser pane runs on a clean profile, separate from the user’s personal browser, with none of their saved logins or history by default; cookie and session persistence across restarts is opt-in. To a storefront’s analytics, that reads as a first-time, cookieless visitor arriving in a real, JS-rendering Chromium browser — not a headless fetcher, and not a returning customer with saved preferences, even if the same human uses it every day.

The tool-preference order behind it

Anthropic’s docs also lay out the order Claude tries when it needs to act on a service: a connector (MCP) first, then a shell command, then a browser-based tool such as Claude in Chrome, and full computer-use screen control only “for things nothing else can reach” (Claude Code desktop docs). Browsing — clicking through an ordinary web page — sits below structured integrations in Claude’s own preference order, not above them.

What this means for a merchant

  • Design for the handoff, not just the click. If the purchase step stays human-gated across major agent products, the part an agent does autonomously — reaching a correct, fully loaded cart with the right variant, price, and shipping option visible — is where a store’s agent-readiness is actually won or lost.
  • A CAPTCHA or aggressive bot-wall doesn’t just block bots, it stalls paying-intent agent sessions dead, since Claude is designed to refuse to solve them rather than route around them.
  • Expect first-visit-looking, cookieless sessions from real, logged-out browsers in your traffic, and don’t mistake that pattern for bot noise to filter out.

AgentReady’s scan checks the part of this flow that actually determines whether a sale happens: whether an agent can reach a loaded, correct cart on your store at all — not just whether it can find your homepage.

Sources