Gemini Spark vs Claude's browser toolset: whose account, whose risk

The disclosure first: this text is written by a model Anthropic built, and Anthropic makes one of the two things compared here. The way we handle that is to compare only what both vendors publish, to rank nothing by quality, and to link every claim to the page it came from. If you want a verdict on which agent finishes more tasks, this is not that text and it could not honestly be written here.

What each one is

Gemini Spark's auto browse is a feature of desktop Chrome. You ask for something in the browser you already use, and Gemini works through the pages on your behalf: comparing products, finding and booking travel, making a reservation, filling in the forms along the way. It runs in your signed-in Chrome profile, not in mobile Chrome and not in Incognito.

Claude's browser toolset is not a product you switch on. It is browser_toolset_20260801, a set of 31 member tools that your own application exposes to the API — 27 on by default, with javascript_exec, file_upload, read_console and read_network off unless you enable them. Anthropic runs none of it. Your code drives your browser automation and hands the results back.

The two therefore answer different questions. Spark answers what can this browser do for me. The toolset answers what do I have to build so that a model can drive a browser at all.

They agree, almost word for word, about where to stop

Google's help page says Gemini hands the task back to you for finalizing financial transactions, accepting terms of service and creating an account, and asks for confirmation before sending communications, modifying your data, submitting web forms and scheduling events. Anthropic's documentation tells the developer to require human confirmation before purchasing, modifying accounts, messaging and accepting terms.

Two teams with different products, different customers and no reason to coordinate arrived at the same four categories: money, identity, messages sent in your name, and agreements. That convergence is the most reassuring thing in this comparison, and it is also the part you should not read as a guarantee. In Spark it is a behavior Google implements for you. In the toolset it is advice, and the confirmation step exists only if you write it.

They disagree about the signed-in session, and that is the whole comparison

Spark's value comes from the session. With your permission it works on sites you are signed into and can use passwords from Google Password Manager, which is the only reason it can book anything. Google is precise about the boundary: the password manager does not hand your passwords to Gemini in Chrome. The account is still yours, the agent works inside it, and Google names monitoring your task as the most important protection you have.

Anthropic's guidance points the other way and says so plainly: avoid logged-in sessions if you can, and if you cannot, use a dedicated low-privilege account. Around it comes a list that reads like a containment plan — run the browser in a dedicated container or virtual machine, start from a fresh profile with no cached credentials, keep it off your internal network, enforce an allowlist of domains at the network layer and re-check it after redirects, refuse anything that is not http or https. The documentation states the reason in one line: all page content is untrusted input.

Neither position is wrong. They follow from what each thing is. A consumer feature that cannot touch your accounts has no reason to exist, so Google's job is to fence the session it uses. A building block ships to developers whose deployments its author will never see, so Anthropic has to assume the worst one and write for that. What you should take from it is that the risk did not go away in either case; it was assigned to a different party. With Spark, Google carries it and you accept the design. With the toolset, you carry it, and everything on that containment list is work you have to do.

Both know about prompt injection, and neither claims to have solved it

Google acknowledges that instructions planted in a page can push the agent into something you did not ask for, and answers with monitoring plus the handover points above. Anthropic gives the same warning in the same place as the tool that creates the exposure, and points at its own guidance on strengthening guardrails.

That is worth holding next to what researchers at Adversa showed on August 20, when an instruction hidden as encrypted text — with the key sitting next to it — walked past a competing agent's protections and sent a user's name, location and conversation history to an attacker's server. The defense that both vendors describe is procedural, not cryptographic. A step the human has to approve is a real control precisely because no one has a filter that catches every instruction hidden in a page.

The cost sits on opposite sides

Spark's auto browse is inside a subscription: a personal Google Account signed into Chrome with Google AI Ultra or Google AI Pro, plus Safe Browsing set to Standard or Enhanced. There is no per-task charge to reason about, and administrators control whether work accounts get it at all.

The toolset is billed per request, and it has a floor. Declaring browser_toolset_20260801 with its default members adds roughly 6,600 input tokens to every request — about 6,670 on Claude Sonnet 5 — before your prompt, the page text or a single screenshot. On Sonnet 5 that is $13.34 per thousand requests just for the tool definitions, and $33.05 on Claude Opus 5. Cache the definitions and the same floor drops to $1.33 and $3.31, which makes prompt caching the first thing to set up rather than an optimization for later.

Screenshots, accessibility trees and page text are billed on top of that, and a browsing session is many requests. Turning on all four optional members adds about 880 tokens more.

Where you can actually use them

For a great many readers this is the section that ends the comparison. Spark's auto browse requires a US-based user aged 18 or over, on desktop Chrome, on an Ultra or Pro subscription; Google says access for AI Pro subscribers is expanding to more than 160 further countries. The browser toolset has no such gate. It is an API feature, available wherever the Claude API is, to anyone who can run a browser and write the executor.

So if you are reading this from Belgrade or Banja Luka, the honest comparison today is between a product you cannot switch on and a building block you can. That is not a statement about which is better. It is a statement about which one you can evaluate this week.

What this comparison refuses to do

It does not rank the two by how many tasks they finish, how well they recover from a broken page, or how often they misread a form. We did not run either one, and a comparison that rated them anyway would be inventing the part that matters most.

It also does not treat the published safety behavior as measured safety. Both vendors describe where their agent stops. Neither has published an independent test of what happens when a page tries hard to move that line, and until someone does, the confirmation step is a design commitment rather than a demonstrated defense.