On October 23, 2026, Anthropic published an account of safety, privacy, and security for Claude Duet. The page says it is a research preview. It uses a cloud computer, keeps running after the app is closed, and can use the apps a person has connected. It can read an inbox, draft replies, book things, and run routines while the person is away. The company says its own team runs Claude Duet on their own accounts and uses it for work every day. That is a product description, not a finished outside audit.
[1]
The page lists three principles. Information belonging to the user, and what other people share in connected apps, is handled with discretion, and a new classifier checks drafts before they go out. The user stays in control of what the agent does in the user's name. The company also says Claude Duet never sees passwords, browser cookies, sign-in tokens, or other credentials. That last sentence is the company's claim. The article describes how credentials move. This piece does not repeat that procedure.
[1]The figure is the article's Figure 1. Its caption says the approval card and a separate check sit outside the model doing the work, so nothing the agent reads can answer the card. The prose matches that picture. Before a potentially sensitive message, a payment, or any deletion, Claude Duet shows the action, the destination, and the content, including every recipient, and then waits for approval. A separate automated check asks whether the action matches the user's intent. The page says that check runs outside the model doing the work, so instructions hidden in a page cannot change its outcome.
[1]Some actions stay off limits even with approval. The examples on the page are trading securities, moving money between accounts, and opening someone else's account. Other steps are not dropped from the approval list just because they have been approved many times: paying or sending money, deleting an order, or creating an account. Routines that run while a person is away use the same limits. For purchases, the company says Claude Duet pays with a one-time card from a wallet such as Link from Stripe, limited to that merchant and that amount. The person sees the item and the total and approves the purchase in the Link app. The real card number is not shared with Claude Duet or with the merchant.
[1]Outgoing information is split into two tiers, again as the company categorizes it. Sign-in credentials, full card and bank-account numbers, and government ID numbers are in a never-share tier, even if someone asks. Other private information, such as health or finances, is shared only with explicit approval. The page says the user's own request counts as consent, so a note to a dentist about tooth pain generally does not need a second approval. The company says these checks will occasionally miss something or flag a harmless message during the research preview. The page does not give a rate for misses or false flags.
[1]The company says browser requests carry a distinct User-Agent and that it publishes the public addresses the browser uses, so sites can recognize the agent. Before launch it contacted several large websites and offered them a way to refuse visits. Some chose to. Red-team testing, an outside penetration test, and a public bug bounty are all named. The page says a follow-on test of the cloud browser and the sign-in form is still running, and it does not give a pass or fail count. How often approval is requested, how sign-in works, and how well the sensitive-information check separates private from harmless are all described as still changing.
[1]