Claude Duet Safety, Privacy, and Security

Anthropic launched Claude Duet into research preview, introducing an autonomous cloud-based agent that runs across connected applications after users close the app. According to claude.com's report, the agent reads inboxes, drafts replies, and runs routines unattended. Anthropic built the system on three principles: screening drafts with a safety classifier, requiring user approvals for sensitive actions, and isolating credentials so passwords and tokens never reach the model.

This report details the architectural safeguards, credential isolation layers, approval policies, and memory retention controls governing Claude Duet. It is written for engineering leaders and administrators evaluating how autonomous cloud agents manage confidential communications, resist prompt injections, and control service permissions during unattended execution.

Claude Duet Safety, Privacy, and Security: what actually changed

Anthropic separated the reasoning engine from execution environments and credential storage. Unlike traditional assistants where session state mingles within context windows, Claude Duet delegates browsing to isolated virtual machines and routes service requests through external proxy layers. Consequential operations like deleting orders, sending payments, or creating accounts are barred from auto-approval rules, requiring human confirmation regardless of past frequency. Furthermore, banking transfers, account takeovers, and securities trading remain completely restricted, blocking the agent from attempting them even when explicitly commanded by the user.

The system deploys a specialized safety classifier derived from the auto mode classifier in Claude Code, running parallel to the primary model. This classifier reviews drafted messages before dispatch, sorting data into two strict tiers. Critical identifiers including government ID numbers, bank details, and account passwords face an absolute ban and will never be shared under any circumstances. Secondary private data such as personal medical notes or financial details require explicit consent, although user prompts requesting messages to specific recipients satisfy this rule automatically.

Claude Duet Safety, Privacy, and Security: how it works

When browsing the web, the agent runs inside an isolated cloud virtual machine detached from the model and connected integrations. The language model drives this cloud browser strictly through fixed commands: open page, click here, and type this. Website code, cookies, and session tokens remain on the browser machine, preventing external scripts from accessing local storage or agent memory. Only page text and downloads return to the agent, where prompt injection defenses evaluate incoming content. Uploads receive the same sensitive-information scan as outbound text.

Authentication and payments utilize out-of-band protections. Users enter passwords into a form within the Claude app, which encrypts values using single-use keys stored only on the browser machine. The encrypted secret passes directly to the browser unopened, keeping plaintext credentials invisible to the model. An upcoming 1Password integration will soon support approving login requests inside the password manager. For purchases, the agent generates single-use cards through Stripe Link, letting users confirm merchant totals in their Link app and shielding primary card numbers.

Claude Duet Safety, Privacy, and Security: why it matters now

Autonomous agents introduce security challenges because they execute tasks unattended without direct human observation. When agents read untrusted internet content, indirect prompt injection risks emerge because hidden directives can attempt to hijack execution. Relying strictly on in-model alignment has proven inadequate to protect systems against malicious instructions. By isolating approvals, credentials, and message classification on external cloud infrastructure outside the reasoning engine, the architecture guarantees that malicious prompt payloads embedded in web pages cannot falsify approvals, forge permissions, or trick the model into revealing secrets.

Approval fatigue presents an equally critical risk during persistent agent operations. Repeated confirmation dialogues condition users to accept prompts reflexively without evaluation, neutralizing oversight safeguards. Anthropic calibrated request frequencies to reserve confirmation prompts showing destinations, content, and recipients for consequential steps like spending funds or deleting files. Phishing risks are countered by confining authentication dialogues to native app interfaces during user-initiated sign-ins. Prompts never arrive via SMS, email, or third-party websites outside claude.ai, preventing attackers from deploying spoofed interfaces to harvest credentials.

Claude Duet Safety, Privacy, and Security: who is affected

The preview affects individuals and teams connecting workplace accounts to automate inbox monitoring and schedule execution. Services connected to a Claude account automatically sync with Claude Duet, applying identical permissions in both places. Disconnecting an application immediately revokes future access. However, information previously extracted remains in the agent's memory until cleared manually through settings. Claude Duet also inherits historical context from previous Claude chats, and deleting the primary account purges all stored task histories and agent memories permanently, giving users complete data lifecycle control.

Enterprises tracking Claude Managed Agents will see familiar security patterns, particularly strict credential separation. Connected app credentials never enter the environment where the agent reasons; placeholder tokens sit there instead while an external proxy substitutes live credentials as requests dispatch. Anthropic staff dogfood Claude Duet on their own accounts daily, testing background workflows against real-world operations. This internal testing provides operational data to refine the safety classifier, ensuring the model avoids sharing private personnel details like performance review discussions in broader team status recaps.

Claude Duet Safety, Privacy, and Security: what to watch

Users track agent activities through a centralized task list featuring dedicated pages for each workflow, allowing live adjustments while tasks execute. Because the classifier is actively learning during research preview, Anthropic noted it will occasionally flag benign content or miss sensitive details. When flagged for containing unauthorized private data, Claude Duet can rewrite drafts to omit sensitive material before requesting user approval. Observers should track ongoing classifier updates as Anthropic balances sensitive information detection against unnecessary false alarms across everyday messaging tasks.

Key milestones ahead include direct 1Password integration, enabling credential approvals within the password manager without exposing secrets to the reasoning engine. Administrators should also monitor approval calibration tuning and auto mode enhancements as broader usage data arrives. Non-negotiable boundaries will remain in effect: trading securities, moving funds between bank accounts, and accessing unauthorized third-party accounts remain completely forbidden even with user approval. Claude Duet outlines an operational framework for persistent autonomous agents, isolating credentials and sandboxing browser environments to execute tasks securely.