Claude Duet won’t share your card number even if you ask

Anthropic has explained how Claude Duet keeps your passwords, cookies and card numbers out of reach of the model that does the work. Most of the answer is about where things run. Credentials, the browser, the approval prompts and the safety checks all sit on separate machines the model cannot access.

The details are in a safety, privacy and security post from Claude published October 24. Duet is an agent, still in research preview, that works on a cloud computer through the apps you have connected to Claude. It keeps running after you close the app. It reads your inbox, drafts replies, books things and runs routines while you are away. Anthropic opened the preview with a waitlist on October 21, per CNBC. The launch page says Duet is built around Claude Opus 5.5 and comes with Pro and Max plans, under the same usage limits as the rest of Claude. Anthropic says its own team runs Duet on its own accounts for daily work.

Where the password goes

When a site asks for a password, you type it into a form inside the Claude app. The form encrypts it with a single-use key, and that key exists only on Anthropic’s cloud browser machine. The encrypted password goes to the browser unopened, and the browser types it into the site. The model never sees it, so it can’t save the password to memory or repeat it later. Anthropic says sign-in through 1Password is coming soon. Duet will request a credential, you approve the request in 1Password, and the credential goes to the browser without passing through the model.

Anthropic says this design changes phishing in two directions. An agent that holds no secrets can’t be tricked into giving one up, whatever instruction is hidden in a page. But “the sign-in form is itself a target, because anything that asks for a password can be imitated.” So the form appears only inside the app, during a sign-in you started. It never arrives as a link, a text message, an email, or on any website other than claude.ai. “If something that looks like Claude Duet asks for your password anywhere else, it’s not legitimate,” the post says.

Connected apps follow the same split Anthropic uses in Claude Managed Agents. The sign-in token for a service never enters the machine where the agent works. That machine holds only a placeholder. A proxy outside it swaps in the real token at the moment a request goes out.

A browser on its own machine

Duet’s browser runs in a dedicated cloud virtual machine, kept apart from the model and from the cloud computers the agent works on. The agent controls it through a fixed set of commands: open this page, click here, type this. Site code and cookies stay on the browser machine. None of the commands can read cookies out of it, and nothing from a site reaches Duet’s memory or your connected apps.

Page text and downloads do come back, because the agent can’t do its job without reading them. That return path is how prompt injection, instructions planted in content the agent reads, gets in. Anthropic says this is why the other checks exist, alongside the injection defenses from its browser-use research. Files Duet uploads through the browser go through the same sensitive-information check as its messages.

The browser also identifies itself. Its requests carry a distinct User-Agent header, and Anthropic publishes the IP addresses it browses from, so sites can recognize Duet and decide how to treat it. Before launch, Anthropic offered several large websites the option to block Duet, and some took it.

What still needs your tap

Before a potentially sensitive message, a payment or a deletion, Duet shows you the action, where it goes and its content, every recipient included, then waits for your approval. A separate automated check runs alongside each action and judges whether it matches what you asked for. It runs outside the working model, so a hidden instruction in a page can’t sway the result. That check is built on the auto mode classifier from Claude Code, extended for Duet. It is the same classifier family behind Claude’s auto mode, which uses connectors even when every action is set to “Always ask”.

Some actions are blocked even with your approval: trading securities, banking moves such as transferring money between accounts, and accessing someone else’s account. Other steps can never go under a “don’t ask me again” rule, however often you’ve approved them. These include paying or sending money, deleting an order and creating an account. Routines that run while you’re away get the same safeguards.

Anthropic says it spent a long time tuning how often Duet asks, because too many requests “teach people to tap through them, sometimes without adequate consideration.” It plans to keep adjusting that balance.

For purchases, Duet pays with a one-time card from a wallet such as Link from Stripe, locked to one merchant and one amount. You see the item and the total, then approve in the Link app. Neither Duet nor the merchant gets your real card number. TechCrunch reported that Shopify’s Shop Pay is supported as well.

Two tiers of secrets

Outgoing messages go through a new classifier, also separate from the main model, that looks for sensitive information before anything is sent. Anthropic’s example is a weekly team recap. It should contain only what everyone on the team can already see, and never something like your performance review conversations.

The classifier sorts information into two tiers:

• Never share: sign-in credentials, full card and bank account numbers, government ID numbers. Duet is instructed never to send these to anyone, even if you ask.
• Needs consent: other private information, such as health or finances, goes out only with your explicit approval. Your own request counts, so “send a note to my dentist about my tooth pain” generally needs no extra confirmation.

When the classifier blocks a message, Duet can rewrite it without the sensitive part and send it to you for approval. Anthropic says the classifier will sometimes miss something or flag a harmless message, which is why it works alongside the approval prompts. Separately, CNBC reported Anthropic’s warning that the early Duet “might misread a thread or miscalibrate what’s urgent.”

Memory works on a different schedule from access. Duet keeps your conversation history and its memory between tasks until you delete or reset them, and deleting your account wipes everything it stored. Apps connected to Claude carry over, and switching one off in either place switches it off in both. But disconnecting an app only stops new access. Whatever Duet already learned from that app stays until you reset its memory in settings. Duet also reads your Claude account memory, so details from earlier chats show up there too.

How it was tested

Anthropic’s Safeguards team built evaluations from tasks shaped like real routines, each in three versions: an innocent one, one with injected instructions, and one that tempts the agent to do more than it was asked. These run alongside shadow traffic from real use. Red teams tested whether Duet would leak information, act without approval or follow malicious prompts. Anthropic also built a threat model covering the repositories and trust boundaries the system touches. Every new credential feature is red-teamed on an isolated rig before anyone gets it. Duet falls under Anthropic’s public bug bounty on HackerOne, with safe harbor for good-faith research.

An external penetration-testing firm has already tested Duet with access to Anthropic’s source code. A second engagement, covering the cloud browser and the sign-in form, is running now.