Anthropic details how Claude Duet keeps credentials away from the model and when it must ask first

Anthropic announced Claude Duet on October 21 as a research preview: a standalone agent, built around Claude Opus 5.5, that runs on its own cloud machine, checks the apps you connect every few hours, sends a morning brief and keeps working when you close the app. Access is by waitlist, starting with US Pro and Max subscribers. At launch, Anthropic said more detail on safety would follow "in the coming days," as Engadget reported.

That detail arrived today. In Claude Duet Safety, Privacy, and Security, Anthropic describes three principles: information in your connected apps is handled with discretion, you stay in control of what Duet does, and Duet never sees your passwords, browser cookies, sign-in tokens or other credentials. The protections stack three layers: the model's own safety training, safeguards already used in Claude Code and Claude Managed Agents, and new controls specific to an agent that acts across your accounts.

What Duet has to ask before doing

Before Duet sends a potentially sensitive message, pays for something or deletes anything, it shows the action, the destination and the full content, including every recipient, and waits for approval. Alongside each action, a separate automated check judges whether it matches what you actually asked for. Anthropic says that check is built on the auto mode classifier from Claude Code, extended for Duet, and runs outside the model, so instructions hidden in a web page cannot talk it out of its verdict.

• Off-limits even with approval: trading securities, banking actions such as moving money between accounts, and accessing someone else's account.
• No "don't ask me again": paying or sending money, deleting an order and creating an account always need a fresh approval.
• Routines get the same rules: work that runs while you are away goes through the same safeguards.

Anthropic also acknowledges the trade-off: too many prompts produce approval fatigue, so it says it is calibrating how often Duet asks and will keep adjusting it.

Payments and sensitive data

Purchases use a one-time card from a wallet such as Link from Stripe, locked to a single merchant and amount. You approve the item and total in the wallet app, and neither Duet nor the merchant sees your real card number.

A separate classifier screens every outgoing message in two tiers. Never share covers sign-in credentials, full card and bank account numbers, and government ID numbers; Duet is instructed not to share them even if asked. Needs consent covers other private data such as health or finances; your own request counts as consent, so a message to your dentist about a toothache does not trigger an extra prompt. When a message is blocked, Duet can rewrite it without the sensitive part and show you the new version. Anthropic says plainly that the classifier will sometimes miss things and sometimes flag harmless text, which is why it sits alongside the approval gates rather than replacing them.

How credentials stay out of the model's reach

This is the most technical part of the post, and the most useful for anyone weighing whether to connect real accounts:

• Passwords are typed into a form in the Claude app that encrypts them with a single-use key held only on the cloud browser machine. The model never sees the plaintext. Anthropic plans 1Password sign-in as an alternative.
• Phishing guard: the sign-in form only appears inside the app during a sign-in you started. Anthropic says it never arrives by link, text or email.
• Sign-in tokens never enter the agent's machine. It holds a placeholder, and a proxy outside the machine inserts the real value per request.
• The browser runs in its own virtual machine. The agent can only send fixed commands such as open, click and type, and no command can read cookies. Page text and downloads do come back to the agent, so prompt-injection defences still apply, and uploaded files pass the same sensitive-data check as messages.
• Identification: Duet's browser sends a distinct User-Agent and Anthropic publishes the IP addresses it browses from. Anthropic says it contacted several large websites before launch, and some chose to block Duet.

Testing, and what is not finished

Anthropic says its Safeguards team ran evaluations built from routine-style tasks in three variants (benign, with injected instructions, and tempting the agent to overreach), alongside shadow traffic from real use. Red teams probed for leaks, unapproved actions and malicious prompts. An external firm penetration-tested Duet with source-code access, and a follow-on engagement on the cloud browser and sign-in form is still running. Duet is in scope for Anthropic's public HackerOne bug bounty.

All of this is Anthropic describing its own system; the post does not include third-party audit results, and the ongoing penetration test has not reported. The company lists approval frequency, sign-in flows and the accuracy of sensitivity checks as areas still changing. Users can also delete Duet's history or reset its memory, and disconnecting an app stops new access, though what Duet already learned stays until memory is reset. Duet also draws on memory from your regular Claude account.

Why this matters for Promptea readers

Personal agents from Meta, OpenAI and now Anthropic all ask for the same thing: standing access to email, calendars and accounts. The useful question is no longer whether the agent is capable, but what it is structurally prevented from doing. Anthropic's answer leans on mechanisms outside the model (a separate intent classifier, a sealed browser, tokens injected by a proxy, single-use cards) rather than on the model simply behaving well. That design is worth comparing against any agent you plan to connect, and it is a pattern developers building their own agents can borrow.