# Claude Duet safety, privacy, and credentials (unofficial guide) > Unofficial summary of Anthropic’s Oct 23 Claude Duet safety article: approvals, sensitive-info checks, and credentials the model never sees. Not affiliated with Anthropic. Language: English Page: https://duetcases.com/research/claude-duet-safety Source: Claude Duet safety, privacy, and security (Anthropic, 2026-10-23) — https://claude.com/resources/articles/claude-duet-safety-privacy-and-security ## What this does Anthropic’s Oct 23 article says Claude Duet is built so you stay in control of important actions, a separate classifier checks outgoing messages for sensitive information, and the model never sees your passwords, browser cookies, or sign-in tokens. Help and launch say it is designed to ask before sending, paying, signing, or deleting. Some actions stay off-limits even with approval. Unofficial summary; not affiliated with Anthropic. ## What this page is This page maps the safety, privacy, and security design Anthropic published for Claude Duet. Claude Duet is still a research preview. The map is unofficial. It is not a security audit, not a certification, and not a promise that every attack fails. Last checked 2026-10-25. ## Three principles The [Oct 23 article](https://claude.com/resources/articles/claude-duet-safety-privacy-and-security) says Claude Duet is built on three principles: - Your information, and what other people share in connected apps, is handled with discretion. A classifier checks messages Claude Duet drafts before they go out. - You stay in control of what it does on your behalf. - Claude Duet never sees your passwords, browser cookies, sign-in tokens, or other credentials. The [launch article](https://claude.com/resources/articles/claude-duet) says credential handling follows the design used for Claude Managed Agents, so Claude Duet never directly sees your passwords or sign-in tokens. That engineering page is general agent infrastructure, not a Claude Duet-only document: [Managed Agents](https://www.anthropic.com/engineering/managed-agents). On 2026-10-23 the Claude account posted a link to the safety article: [@claudeai](https://x.com/claudeai/status/2113736176737845353). The launch announcement is context for the research preview, not the safety write-up: [@claudeai, 2026-10-21](https://x.com/claudeai/status/2112984664256241837). ## You approve important actions Before something like sending a potentially sensitive message, paying, or deleting, the Oct 23 article says Claude Duet shows you the action, the destination, and the content, including every recipient, then waits for your approval. A separate automated check runs alongside each action. The article says it is built on the auto mode classifier from Claude Code and extended for Claude Duet. It assesses whether the action matches your intent. The check runs outside the model doing the work, so instructions hidden in a page cannot affect that outcome. This page does not add a score for how often the check is right. The [help center](https://support.claude.com/en/articles/17631495-get-started-with-claude-duet) and the launch article say Claude Duet is designed to ask before it sends a message, makes a payment, signs a document, or deletes anything. The launch article says it shows you exactly what it is about to do and waits. Signing is stated on those two pages. The examples in the safety article’s approval section are a sensitive send, a payment, and a deletion. Routines that run while you are away have the same safeguards, the safety article says. It also says approval fatigue is a real problem, because too many requests teach people to tap through, and that Anthropic will keep adjusting how often Claude Duet asks. This page does not invent that frequency. ## What stays off-limits Some actions stay off-limits even if you approve them. The Oct 23 article names trading securities, banking actions such as moving money between accounts, and accessing someone else’s account. The help center lists the same three. The launch article’s examples are trading securities and moving money between accounts. Approval does not turn those on. Some steps never fall under a “don’t ask me again” rule, however often you have approved them. The Oct 23 article names paying or sending money, deleting an order, and creating an account. Microsoft 365 is not available yet, per the help center. This page does not treat it as a connected app. ## Purchases through Link For purchases, the Oct 23 article says Claude Duet pays with a one-time card from a wallet like Link by Stripe, limited to that merchant and that amount. You see the item and the total, and you approve the purchase in the Link app. Your real card number is not shared with Claude Duet or the merchant. The help center says Claude Duet is designed to ask before each purchase, and that each purchase uses a one-time card that only works for that purchase. You connect Link and Shop Pay inside Claude Duet, not from the general connectors directory. Shop Pay is the help center’s other wallet for a purchase you approve. The purchase case on this site is [Buy with Link or Shop Pay](/workflow/link-shop-pay). Invoice reminders are a different job: [Draft reminders for unpaid invoices](/workflow/invoice-reminders). ## Sensitive-information classifier The Oct 23 article describes a safety classifier that runs separately from the main model. It checks whether a message Claude Duet is about to send contains potentially sensitive information. Two tiers: - **Never share.** The strictest protection covers sign-in credentials, full card and bank account numbers, and government ID numbers. Claude Duet is instructed never to share these, even if you ask. - **Needs consent.** Other private information, such as health or finances, is shared only if you have explicitly approved it. Your own request counts as consent. The article’s example is a note to your dentist about tooth pain, which generally does not need a second approval. If a send is blocked, Claude Duet can rewrite the message without the sensitive parts and bring that draft back for approval. The launch article’s teaser matches that shape: a dedicated classifier and safety system prompt reject the strictest tier, including credit card numbers and government identification, and let other sensitive information such as health or personal finances through only when you explicitly instruct a send. Claude Duet is still a research preview. The Oct 23 article says these safeguards will occasionally miss something or flag a harmless message. That is why they sit next to the approval step. Anthropic says it expects to keep changing the classifier. ## Tasks, connectors, and memory The Oct 23 article says you can see what Claude Duet has done and is doing in its task list. Each task has its own page, and you can steer a task while it is running. Conversation history and memory carry context between tasks until you delete the history or reset memory. Deleting the account wipes everything Claude Duet has stored. Apps you connected in Claude carry over. Switching an app off in one place switches it off in both. Disconnecting an app stops new access from that moment. What Claude Duet already learned stays until you reset its memory. The article says you can reset memory anytime from the app’s settings. Claude Duet also uses memory from your Claude account, so details remembered from earlier Claude chats are visible. The help center says the same split: disconnecting stops access from that point on, and memory of past information from earlier conversations is kept. These pages do not say that disconnecting an app wipes memory. Slack is one connector the help center says works with limits. Missed Slack messages are a separate case: [Find missed Slack messages](/personal-ai/slack-missed). This page does not invent a list of those limits. The connectors hub on this site is [Connectors](/connectors). ## Credentials and the browser The Oct 23 article says Claude Duet never sees your passwords, browser cookies, or the sign-in tokens for connected apps, and it cannot save them to its memory. They pass through separate machines the model cannot access. The approvals and safety checks that govern what it does run on that side as well. When a site asks for a password, you type it into a form inside the Claude app. The article says the form encrypts it with a single-use key that exists only on the secure cloud browser machine, for that one use. The encrypted password is passed unopened to the browser, which types it into the site. The model does not see the password and cannot save or repeat it. Sign-in with 1Password is not available yet. The safety article says that soon Claude Duet would ask for a credential, you would approve that request in 1Password, and the credential would go to the browser without passing through the model. The launch article also lists 1Password sign-in as coming soon. This page does not treat it as live. The article describes phishing in two directions. Claude Duet does not hold credentials for you, so it cannot be phished for a password it does not have, and a hidden instruction cannot make it reveal a secret it does not hold. The sign-in form can itself be imitated, because anything that asks for a password is a target. The form only appears inside the app, during a sign-in you asked for. It does not arrive as a link, a text message, an email, or a website other than claude.ai. If something that looks like Claude Duet asks for your password anywhere else, the article says it is not legitimate. Sign-in tokens follow the Claude Managed Agents design. The article points at that engineering page as the pattern, and labels it as the infrastructure Anthropic uses for agents, not as a Duet-only spec. A credential the agent uses on your behalf, such as a sign-in token for a connected service, never enters the machine where the agent works. A placeholder sits there. A proxy outside that machine inserts the real value only as a request is made. The browser runs in its own dedicated virtual machine in the cloud, separate from the model and from the cloud computers the agent works on. The agent drives it only through a fixed set of commands: open this page, click here, type this. The article says whatever a site runs stays on the browser machine. The site’s code and cookies do not reach Claude Duet’s memory or your connected apps, and none of the agent’s commands can read cookies out of the browser. The paragraph says what comes back is the page’s text and downloads, because the agent has to read them. The figure caption on the same page says the site’s code, cookies, and downloads stay on the browser machine. This page quotes both and does not invent a resolution. Files uploaded through the browser get the same sensitive-information check as messages. The article says Claude Duet also uses the prompt-injection safeguards in Anthropic’s [browser-use research](https://www.anthropic.com/research/prompt-injection-defenses). That research is broader than Claude Duet. The help center says email and web pages can contain instructions meant to mislead Claude Duet, and that no defense is perfect. That is one reason consequential actions need your approval. Claude Duet is designed to identify itself as an agent. The article says browser requests include a distinct User-Agent header, and that Anthropic publishes the public IP addresses it browses from, so sites can recognize it. This page does not copy a User-Agent string or an IP list the article does not print. Before launch, Anthropic contacted several large websites and offered them a way to prevent Claude Duet from visiting. Some chose to. The article does not name those sites, and this page does not either. The help center says that when a site asks for a password, you type it into a separate form on your device. The form sends it straight to the browser, which is designed to keep it out of your chat with Claude Duet. During the research preview you cannot watch that browser or take it over. ## Testing and the bug bounty The Oct 23 article describes testing and does not publish scores. This page does not add any. The Safeguards team built evaluations from routine-shaped tasks, each in three variants: an innocent version, one with injected instructions, and one that tempts the agent to do more than it was asked. Those run alongside shadow traffic from real use. Red teams tested whether Claude Duet would leak information, act without approval, or follow malicious prompts. Anthropic says it built a threat model of the whole system, across the repositories and trust boundaries it touches. An external penetration-testing firm tested Claude Duet with access to source code. A follow-on engagement covering the cloud browser and the sign-in form is running now. Each new credential feature is red-teamed on an isolated rig before it ships. The article does not name the firm and does not publish a finding count. Claude Duet is in scope of Anthropic’s public bug bounty. The program rewards valid reports and offers safe harbor for good-faith research, under Anthropic’s responsible disclosure policy. The article links reports to [HackerOne](https://hackerone.com/anthropic). ## Research preview, not a guarantee Claude Duet is a research preview. The Oct 23 article says some of what it describes is still changing: how often it asks for approval, how you sign in, and how well the sensitive-information checks separate what is private from what is harmless. The help center says Claude Duet can misread a thread or misjudge what is urgent. Review drafts and approval requests before you confirm them. This page does not say Claude Duet is certified against every threat. It does not say you can override the limits on trading, moving money, or someone else’s account. It does not say disconnecting an app deletes memory. ## Related - [Connectors](/connectors) - [Find missed Slack messages](/personal-ai/slack-missed). Slack works with limits. - [Buy with Link or Shop Pay](/workflow/link-shop-pay) - [Draft reminders for unpaid invoices](/workflow/invoice-reminders) - [About this site](/about) - [Claude Duet alternatives](/claude-duet-alternatives). A comparison with other agents, not a safety audit. ## Sources Last checked: 2026-10-25. - [Claude Duet safety, privacy, and security](https://claude.com/resources/articles/claude-duet-safety-privacy-and-security) - [Claude (@claudeai), 2026-10-23](https://x.com/claudeai/status/2113736176737845353) - [Get started with Claude Duet](https://support.claude.com/en/articles/17631495-get-started-with-claude-duet) - [Introducing Claude Duet](https://claude.com/resources/articles/claude-duet) - [Claude (@claudeai), 2026-10-21](https://x.com/claudeai/status/2112984664256241837) - [Claude Managed Agents](https://www.anthropic.com/engineering/managed-agents) — agent infra - [HackerOne program](https://hackerone.com/anthropic) — safety link duetcases.com is an unofficial community site. It is not affiliated with Anthropic. This page summarizes Anthropic’s public documentation; it is not a security audit or guarantee. Duet may be a trademark of Anthropic. ## Three principles 1. Discretion. A classifier checks drafts before they go out, including information other people shared in apps you connected. 2. You stay in control of what Claude Duet does on your behalf. 3. The model never sees your passwords, browser cookies, sign-in tokens, or other credentials. ## Prompt ``` Before I connect more apps: summarize what you will ask me to approve (send, pay, sign, delete), what stays off-limits even if I approve, and confirm you never see my passwords or sign-in tokens. Cite only Anthropic’s documented behavior; do not claim extra guarantees. ``` ## Before you connect an account - You are on the waitlist, or already on Pro or Max, and you are deciding whether to connect Gmail, Slack, Stripe, or another account. - You want the documented rules for approvals, credentials, and actions that stay off-limits. - You want a citation map of Anthropic’s public pages. This page is not a security audit. ## FAQ ### Does Claude Duet see my passwords? Anthropic’s Oct 23 article says Claude Duet never sees your passwords, browser cookies, or sign-in tokens. They pass through separate machines the model cannot access. ### What does Claude Duet ask before doing? Help and the launch article say it is designed to ask before sending a message, making a payment, signing a document, or deleting anything. The safety article adds that you see the action, the destination, and the content, including every recipient. ### Can Claude Duet move money between my accounts if I say yes? Help and the safety article say some actions stay off-limits even with your approval, including trading securities and banking actions such as moving money between accounts. ### How are Claude Duet purchases handled? The safety article says purchases use a one-time card from a wallet like Link by Stripe, limited to that merchant and amount. You approve in the Link app. Your real card number is not shared with Claude Duet or the merchant.