Claude Code Adds a Built-In Browser, Shareable Artifacts, iOS Simulator and Linux

Anthropic pushed four things into Claude Code in July 2026: a built-in browser in the desktop app, artifacts that publish your session's output as a live page on claude.ai, iOS Simulator support in public beta, and a Linux desktop app, also in beta. Announced separately they look like a grab bag. Read together, they're all the same move — the agent is being given ways to see the result of its work and to hand it to someone else.

That's the interesting part. The part worth reading carefully is buried in the artifacts documentation, and we'll get to it.

What shipped

• A browser inside the desktop app. Cmd+Shift+B on macOS, Ctrl+Shift+B on Windows, or the Views menu. A tabbed pane that sits next to chat, diff, terminal and file panes. Claude can read pages, click, fill forms and take screenshots in it.
• Artifacts. Claude writes an HTML or Markdown file in your project and publishes it to a private URL on claude.ai — a PR walkthrough, a dashboard, an investigation timeline that fills in while a long task runs. It updates in place as the session continues.
• iOS Simulator, public beta. The simulator opens in a pane beside the conversation. Claude builds the app, runs it, watches it, interacts with it, and keeps iterating. macOS only, Xcode required.
• Linux desktop app, beta. Ubuntu and Debian, via apt or a .deb.

The browser is not your browser — and that's the point

The easiest mistake here is assuming this replaces the Chrome-extension workflow, or the Playwright-MCP setup you may already have wired up. It doesn't, because it deliberately runs on a clean browser profile — none of your saved logins, none of your history.

That makes the split simple:

• Browser pane — building and testing your app, reading docs, poking at sites that don't need to know who you are.
• Chrome extension — when you need Claude to act as you, inside sessions you're already logged into.

Two safety layers apply on external pages. Safety classifiers review Claude's write actions — clicks, typing — in every permission mode, and a flagged action produces a permission prompt no matter which mode you're in. Outside Auto and Bypass modes, a domain allowlist check runs before Claude navigates somewhere new. The first time Claude acts on a site you get Allow once / Always allow / Deny, and approvals are per-site, subdomains included. Local dev servers and project files need no approval, so auto-verification after each edit keeps running without pestering you.

Worth noting for anyone who read our piece on never handing a coding agent your whole machine on the first run: Anthropic says Claude won't purchase things, create accounts or bypass CAPTCHAs in the pane without your input, and administrators get two separate managed settings — one that strips Claude's tools on external pages while still letting you browse, and one that blocks external navigation entirely. That's a more granular control surface than most agent sandboxes ship with, and it's the right shape. It also pairs with the app-preview loop: Claude starts your dev server, screenshots, inspects the DOM, clicks through and fixes what it finds — which is the practical version of the argument in tests are the new prompt.

Artifacts: a capture of work, not an app

An artifact is one self-contained page. Anthropic is explicit that it isn't an application, and the constraints back that up:

Claude asks permission before publishing a new artifact; republishing one you've already approved doesn't prompt again. Every publish is a version, and the Share control lets you pick which version viewers see. Ctrl+] reopens the most recent one. Set CLAUDE_CODE_ARTIFACT_AUTO_OPEN=0 if you don't want your browser jumping every time.

One nice touch: Claude applies a built-in design skill when it builds the page, and that skill looks for your project's design system first — colors, typography, spacing recorded in CLAUDE.md or a theme file take precedence over its own taste. If you've already set up the kind of design handoff we covered in Claude Design's two-way sync, artifacts will inherit it rather than inventing a fresh palette per page.

The detail everyone will skim past

Artifacts can call MCP connectors each time someone opens the page, so a dashboard shows current data instead of a snapshot. Here's the part that matters:

The connector call runs through the account of the person viewing the page — not yours.

Follow that through:

• Two people open the same dashboard and can see different data, depending on what their accounts can reach. The page never sees anyone's credentials; claude.ai makes the calls on its behalf.
• Each viewer approves access first. Someone who declines, or who hasn't connected that connector, still sees the page — minus its live sections.
• Actions run as the clicker. A page can offer controls that invoke connector tools with side effects — posting a message, updating an issue. Whoever selects the control is the account that does it.

That last bullet is the one to internalise before you put a button on a page and drop the link in a team channel. It's not a vulnerability — it's arguably the correct design, since the alternative is a shared page acting with the publisher's permissions forever. But it inverts the mental model of "I built this dashboard, so it runs as me," and it deserves a moment's thought in the same way the permissions and audit-log discipline does.

Three more practical constraints:

• Connector-backed artifacts can't be shared to a public link on any plan. On Team and Enterprise you can keep them private or share inside the org. On Pro and Max, where a public link is the only sharing mechanism, a connector-backed artifact stays private to you. If your plan is Pro or Max, "build a live dashboard and send it to a friend" is not a thing you can do.
• Only claude.ai account connectors qualify. Local MCP servers from your .mcp.json can feed data in while Claude builds the page, but the published page can't call them.
• Ask for fallback text. Tell Claude to have each live section name the connector it needs, so a viewer missing that connection sees an instruction instead of a blank box.

Availability, briefly: Pro, Max, Team or Enterprise; a session signed in with /login; CLI 2.1.183+ or desktop 1.13576.0+ (connector calls need 2.1.209+). Sessions authenticated with an API key, a gateway token or a cloud-provider credential can't publish, and neither can Bedrock, Google Cloud's Agent Platform or Microsoft Foundry. If Claude writes a local HTML file and no link, that's the reason.

iOS Simulator: the loop finally closes

For iOS work this is the most concretely useful of the four. Claude builds and runs the app, the simulator opens in a pane beside the conversation, and Claude can watch it live, interact with it and keep going until the thing works — with you able to take the controls at any point.

The limits are worth knowing up front: macOS only, Xcode and the iOS platform installed, public beta, and local sessions only — cloud and SSH sessions can't reach simulators sitting on your Mac. The CLI can still drive a simulator through computer use; the desktop app just gives it a pane and opens it automatically.

Linux, and what's missing from it

The desktop app is now on Ubuntu and Debian in beta, installed with apt or a .deb. It brings the same desktop-specific machinery: parallel sessions isolated with Git worktrees (stored under .claude/worktrees/ by default, with a configurable location and branch prefix), visual diff review with inline comments, and PR monitoring — a CI status bar that polls checks through the GitHub CLI, with optional auto-fix for failing checks and auto-merge (squash) once they pass. Auto-merge has to be enabled in the repo settings too, and gh must be installed and authenticated.

Config carries over from the CLI rather than being rebuilt: CLAUDE.md and CLAUDE.local.md, MCP servers from ~/.claude.json and .mcp.json, hooks, skills, and permission rules in settings.json all apply to both. You can run CLI and desktop on the same project simultaneously — separate session history, shared configuration.

One gap to know about: Computer Use isn't available in the Linux app yet.

Honest caveats

• Artifacts cost output tokens. A styled interactive page is more token-intensive than the same content as terminal text, and images embedded as data URIs are the main contributor. Prefer SVG or plain HTML/CSS for diagrams, skip interactivity you don't need, and have the page summarise big datasets rather than inline them. It's the same arithmetic we laid out in the hidden costs of AI coding.
• A browser pane doesn't make an agent a tester. It watches its own work, which is a real improvement over describing changes in prose — but self-verification is still self-assessment. The audit habits before shipping to production don't get retired.
• Auto-merge deserves a policy, not a toggle. "Claude fixes CI and merges when green" is exactly as safe as your CI is thorough. On a repo with weak checks it's an automatic path from agent output to main.
• Beta means beta. Linux and the iOS Simulator are both explicitly public beta, and the Linux app is already missing one shipped capability.

Turning it off

Both features have real off switches, which is more than can be said for a lot of AI tooling:

• Artifacts, per-session: "disableArtifact": true in your settings file, CLAUDE_CODE_DISABLE_ARTIFACT=1, or adding Artifact to permissions.deny.
• Artifacts, per-organization: an Owner toggle in claude.ai admin settings, a separate toggle for connector calls, retention policies for private and shared artifacts, claude_artifact_* events in the audit log, and Compliance API endpoints to list and delete. Public sharing is off by default on Team and Enterprise. If your org restricts outbound traffic, allowlist *.claudeusercontent.com — that's the sandboxed origin the viewer loads from.
• Browser: toggles in Settings → Claude Code to clear saved session data or switch it off, plus the two managed settings for organizations.

Bottom line

The through-line is verification and handoff. Until now an agent could write code and tell you it worked; now it can open the app, click through it, screenshot the result, and publish a page you can hand to a reviewer. That's a meaningful shift in what the human is actually doing — closer to the job description we sketched in less writing code, more running the system, and a reason to revisit where Claude Code sits in the AI coding tool comparison.

Two things to do this week if you use Claude Code daily. First, try an artifact on your next non-trivial PR — a walkthrough with annotated diffs is a better review artefact than a description, and it costs one prompt. Second, before you share any artifact that touches a connector, read the sharing model once more: the page acts as whoever opens it.