Claude Duet's safety post: how its checks and approvals fit

Anthropic has published the safety detail it said was coming for Claude Duet, and it settles a question we raised in our first article. We read the post in full. This article covers how Duet’s approvals and its separate check work together, what stays off-limits, how credentials and the browser are isolated, how Anthropic says it tested the agent and what is still open. All of it is Anthropic’s own account, and we did not test the agent or join the waitlist. Our first Duet article covers what the product does.

How do the check and the approval card fit together?

They run side by side, and the check sits outside the model. Anthropic says that before Duet sends a potentially sensitive message, pays or deletes anything, it shows the user the action, the destination and the content, including every recipient, and waits for approval. A separate automated check runs alongside each action, built on the auto mode classifier from Claude Code and extended for Duet. It assesses whether the action matches the user’s intent, and it runs outside the model doing the work, so instructions hidden in a page cannot affect the outcome. Anthropic’s diagram shows text the agent reads feeding the model, with the card and the check both outside it, and notes that text the agent reads cannot answer the card or talk the check out of its verdict.

What stays off-limits, and what never becomes automatic?

Some actions are blocked even with approval, and some cannot be pre-approved. According to the post:

• Off-limits even with approval: trading securities, banking actions such as moving money between accounts, and accessing someone else’s account.
• No “don’t ask me again”: paying or sending money, deleting an order and creating an account, however often the user approved them before. Routines that run while the user is away have the same safeguards.
• Purchases: Duet pays with a one-time card from a wallet such as Link from Stripe, limited to that merchant and amount. The user sees the item and total and approves the purchase in the Link app, and the real card number is not shared with Duet or the merchant.
• Approval fatigue: Anthropic calls it a serious issue, since too many requests teach people to tap through them, and says it spent time calibrating how often Duet asks and will keep adjusting.

How does Duet decide what information to share?

With a second classifier that checks each outgoing message. Anthropic says a new safety classifier runs separately from the main model and checks whether each message Duet is about to send contains potentially sensitive information, in two tiers:

• Never share: sign-in credentials, full card and bank account numbers and government ID numbers, even if the user asks.
• Needs consent: other private information such as health or finances, shared only if the user explicitly approved, and the user’s own request counts as consent. Anthropic’s example is that a note to a dentist about tooth pain generally needs no extra approval.

If a message is blocked, Duet can rewrite it without the sensitive information and show the user for approval. Anthropic says the safeguards will occasionally miss something or flag a harmless message, and that files uploaded through the browser get the same check.

How are credentials and the browser isolated?

By keeping them off the machine where the model works. Anthropic’s account:

• Passwords: the user types a password into a form inside the Claude app, which encrypts it with a single-use key that exists only on the cloud browser machine. The encrypted password is passed on unopened, the browser types it into the site, and the model cannot see, save or repeat it. Anthropic says 1Password sign-in is coming, with the credential going to the browser without passing through the model.
• Sign-in tokens: the credentials the agent uses for connected services never enter its machine. A placeholder sits there, and a proxy outside the machine inserts the real value only as a request is made. Anthropic says this follows its Claude Managed Agents design.
• The browser: it runs in its own virtual machine, separate from the model and the agent’s other computers. The agent drives it through a fixed set of commands, such as open this page, click here, type this. The site’s code and cookies stay on the browser machine, but page text and downloads come back to the agent, and Anthropic says that is why the other checks and its prompt-injection safeguards exist.
• Phishing: Anthropic notes that the sign-in form is itself a target and says it appears only inside the app during a sign-in the user asked for, never as a link, text, email or website other than claude.ai.

What does Anthropic say about visibility, memory and identification?

• Task list and control: users can see what Duet has done and is doing and steer it mid-task. It keeps conversation history and memory until the user deletes or resets them, and deleting an account wipes everything it stored.
• Connected apps: switching an app off in one place switches it off in both. Disconnecting stops new access, but what Duet already learned from the app stays until the memory is reset.
• Account memory: Duet uses the memory from the user’s Claude account, so details from earlier chats are visible.
• Identifying itself: requests from its browser carry a distinct User-Agent header and Anthropic publishes the IP addresses it browses from. Before launch it contacted several large websites and gave them the option to block Duet, and some chose to.

How was it tested?

Anthropic lists several layers. Its Safeguards team built evaluations from routine-shaped tasks in three variants: an innocent version, one with injected instructions and one that tempts the agent to do more than asked, run alongside shadow traffic from real use. Red teams tested for leaks, acting without approval and following malicious prompts, and an external penetration-testing firm tested Duet with access to the source code. A follow-on engagement covering the cloud browser and the sign-in form is running now, and each new credential feature is red-teamed on an isolated rig before release. Duet is in scope of Anthropic’s public bug bounty program.

What is still unknown?

• How well the classifiers work. The post gives no accuracy, miss-rate or false-flag figures.
• What the external penetration test found. No results are published, and the follow-on test is still running.
• Whether approval calibration works in practice. Anthropic says it is still adjusting how often Duet asks.
• How the model-side defenses hold when page text returns to the agent. Anthropic says page text and downloads do come back, and relies on the other checks for that.
• Availability. Our first article’s limits still apply: a US Pro and Max waitlist in a research preview.

What to keep in mind

These are our observations:

• This answers our first question. The check and the approval card are two separate mechanisms that both sit outside the model, and Anthropic’s diagram makes the relationship explicit.
• The design bets on moving trust out of the model. Putting credentials, approvals and the check in separate machines limits what a poisoned page can do, and the remaining exposure is what the agent reads and then drafts.
• No “don’t ask again” for money and deletion is deliberate friction. It sits against Anthropic’s own warning about approval fatigue, so it will be worth seeing how often users actually get asked.
• Self-reported safeguards still need outside testing. We have not seen independent results, and an agent that reads your inbox is a more attractive target than a chat window. See our Railway report for what a credential store failing looks like.

Editorial review: October 24, 2026 (AI). Prepared from Anthropic’s post “Claude Duet Safety, Privacy, and Security” (dated October 23, 2026 in the page metadata), read in full as page text with its four figure captions, and from its October 21 announcement, which we covered earlier. We did not join the waitlist, use the app, test any safeguard, or contact Anthropic. All claims about Duet’s design and testing are Anthropic’s. The page may change after our reading.