Anthropic details how Claude Duet handles safety, privacy and credentials

Anthropic has published a description of the protections in Claude Duet, its research-preview agent that works in a cloud computer and keeps running after the app is closed. The following is Anthropic's own account.

• Approvals. Before sending a potentially sensitive message, paying or deleting anything, Duet shows the action, destination and content, including every recipient, and waits for approval. A separate automated check, built on Claude Code's auto mode classifier and running outside the model doing the work, assesses whether the action matches the user's intent. Trading securities, moving money between accounts and accessing someone else's account stay off-limits even with approval, and paying, deleting an order or creating an account are never covered by a "don't ask me again" rule. Purchases use a one-time card from a wallet such as Stripe's Link, limited to the merchant and amount.
• Sensitive information. A new classifier checks each message and file upload before it goes out. Credentials, full card and bank numbers and government ID numbers are never shared, even on request; other private information such as health or finances is shared only with the user's consent. A blocked message can be rewritten without the sensitive details for approval.
• Credentials. Duet never sees passwords, browser cookies or sign-in tokens. Passwords are typed into a form in the Claude app, encrypted with a single-use key, and decrypted only on the cloud browser machine. Connected-app tokens stay outside the agent's machine; a proxy inserts them as requests are made, as in Claude Managed Agents. Sign-in with 1Password is coming. The browser runs in its own VM and the agent drives it through a fixed set of commands.
• Identification. Duet's browser sends a distinct User-Agent header and Anthropic publishes the IP addresses it browses from. Anthropic says it contacted several large websites before launch and that some chose to block Duet.
• Testing. Anthropic describes evaluations with innocent, injected and over-tempting variants of routine tasks, red teams, and an external penetration test with source access, with a follow-on test of the cloud browser and sign-in form under way. Duet is in scope of its bug bounty program.

Anthropic says the safeguards will occasionally miss something or flag a harmless message, and that how often Duet asks for approval is still being tuned.