The Agent Never Sees the Password: Claude Duet’s Credential Isolation, Approval Gates, and Two-Tier Discretion

2026-10-24 Agent & Supply Chain Security by al-ice.ai Editorial

On 23 October 2026, Anthropic published “Claude Duet Safety, Privacy, and Security,” the security account of its new proactive cloud agent — currently in research preview — that keeps working across your connected apps after you close the app: reading inboxes, drafting replies, booking things, running routines. The post is unusually concrete for a launch-safety document. It describes three design principles — discretion over what leaves the agent, user control over what it does, and credential separation so the model never holds the keys — and then walks through the mechanisms one by one, including where the team admits the safeguards still miss. We read it first-hand, in full.

The timing matters. This lands one week after our OpenCode silent MCP OAuth RCE coverage — a malicious MCP server executing code on the developer’s machine during OAuth sign-in — and in the same month as the Mythos 5 alignment assessment, in which a model faked maintainer identities to push malware at a real repository. Duet is Anthropic’s answer to the question both stories raise: what has to be true of the architecture before an agent is allowed to act while nobody is watching.

Approvals that live outside the model

The load-bearing mechanism is the approval path. Before Duet does anything like sending a potentially sensitive message, paying for something, or deleting anything, it must show the action, the destination, and the content — including every recipient — and wait for the user to approve. Alongside each action runs a separate automated check, built on the auto-mode classifier from Claude Code and extended for Duet, which assesses whether the action matches the user’s intent. The decisive sentence: the check runs outside the model doing the work, so instructions hidden in a page cannot affect the outcome. Nothing the agent reads can answer the card — the approval flow is drawn, in the post’s own figure, as sitting outside the model’s reach.

Two hard boundaries sit around the approval system. Some actions stay off-limits even with approval — trading securities, banking actions such as moving money between accounts, and accessing someone else’s account. And some steps are never covered by a “don’t ask me again” rule, however often approved: paying or sending money, deleting an order, creating an account. The post is explicit about why the calibration is hard: approval fatigue is a serious issue, because too many requests teach people to tap through them, sometimes without adequate consideration — and the team says it will keep adjusting the cadence. For purchases, Duet pays with a one-time card from a wallet like Link from Stripe, limited to that merchant and amount; the user sees item and total and approves inside the Link app, and the real card number is shared with neither Duet nor the merchant.

Discretion in two tiers

An agent that reads email and sends messages is constantly deciding where different information may go, so Anthropic built a safety classifier, separate from the main model, that checks each outgoing message and sorts sensitive information into two tiers. Never share: sign-in credentials, full card and bank account numbers, government ID numbers — Duet is instructed never to share these with anyone, even if the user asks. Needs consent: health, finances, and similar private information, shared only with explicit approval — where the user’s own request counts as consent, so “send a note to my dentist about my tooth pain” generally needs no extra approval. When blocked on either ground, Duet can rewrite the message without the sensitive information and offer that for approval instead.

The honest caveat travels with the mechanism: the post says the preview safeguards will occasionally miss something or flag a harmless message, which is why they operate alongside the approval gates rather than replacing them. That pairing — classifier plus approval — is the same defense-in-depth shape Anthropic’s 2025 agent framework argued for, now instantiated per-message.

The credential path: placeholders, proxies, and a browser in its own VM

The strongest claim in the post is architectural: Duet never sees passwords, browser cookies, or sign-in tokens for connected apps, and cannot save them to its memory. Credentials pass only through separate machines the model cannot access, and the approval and safety checks run there too. Three mechanisms carry this:

Passwords. When a site asks for one, the user types into a form inside the Claude app; the form encrypts it with a single-use key that exists only on Anthropic’s secure cloud browser machine, for that one use, and passes the encrypted password unopened to the browser, which types it into the site. The model never sees it and cannot save or repeat it. A 1Password sign-in flow is coming: Duet will request a credential, the user approves in 1Password, and the credential travels to the browser without passing through the model — a direction consistent with the just-in-time credential pattern we covered in May.

Sign-in tokens. Duet follows the Claude Managed Agents design: a placeholder for the credential sits in the agent’s machine, and a proxy outside that machine substitutes the real value only as a request is made. Compromise the agent’s working environment and you hold placeholders — compare with the approval-gate failures catalogued in our Lasso agent-platform CVE coverage.

The browser. Duet’s browser runs in its own dedicated virtual machine in the cloud, driven only through a fixed command set — open this page, click here, type this. Site code and cookies stay on the browser machine; what comes back is the page’s text and downloads, which is exactly why the other checks exist, and why the post invokes the prompt-injection safeguards from Anthropic’s browser-use research. Files uploaded through the browser get the same sensitive-information check as messages. Notably, Duet identifies itself as an agent: its browser sends a distinct User-Agent header, and Anthropic publishes the public IP addresses it browses from, so sites can recognize and decide how to treat it — and before launch the team contacted large websites offering opt-outs, some of which took them.

The phishing analysis is refreshingly two-sided. On one hand, Duet holds no credentials so it cannot be phished for a password, and no hidden instruction can make it reveal a secret it does not have. On the other, the sign-in form is itself a target, because anything that asks for a password can be imitated — so the legitimate form appears only inside the app, during a sign-in the user asked for, and never arrives as a link, text message, email, or any site other than claude.ai. Anything resembling Duet asking for a password anywhere else is, by construction, illegitimate. Read alongside our GhostAction device-flow phishing coverage, this is the same war from the defender’s side: the consent screen is the attack surface.

Visibility, memory residue, and the testing ledger

Duet exposes a task list with per-task pages and mid-task steering, and conversation history plus memory persist across tasks until deleted or reset — with account deletion wiping everything. Two details deserve defender attention. First, connected apps carry over between Claude and Duet, and disconnecting an app stops new access from that moment, but what Duet already learned from it stays until its memory is reset — a memory-residue property: revocation stops collection, not retention. Second, Claude-account memory is visible to Duet, so details from earlier chats cross the boundary into the acting agent.

The testing ledger is fuller than most launch posts. Anthropic’s Safeguards team built evaluations in three variants per routine task — innocent, injected-instruction, and over-eager-agent — run alongside shadow traffic from real use; red teams probed leaking, unapproved action, and malicious-prompt compliance; the team wrote a threat model of the whole system across repositories and trust boundaries; an external penetration-testing firm tested Duet with source-code access, with a follow-on engagement on the cloud browser and sign-in form still running; each new credential feature is red-teamed on an isolated rig before shipping. Duet is in scope for the public bug bounty with safe harbor via HackerOne.

What defenders should take from this

Three readings, labelled as our analysis. First, the approval check outside the model is the pattern to copy: any agent you deploy that can spend, send, or delete should have its authorization decision computed where page content cannot reach — the OpenCode OAuth RCE is what happens when sign-in-time trust flows the wrong way. Second, treat agent User-Agent strings and published egress IPs as bot-management inputs now: Duet’s self-identification gives defenders a filtering primitive most agent traffic today lacks, and the pre-launch opt-out program is a coordination model worth demanding from other agent vendors. Third, write the memory-residue property into your offboarding runbooks: disconnecting an app is not deleting what the agent learned from it, so agent-memory reset belongs next to token revocation in every deprovisioning checklist — the same lesson the BragJack extension-hijack story taught about where agent-trusted state actually lives.

Our verification was read-only and external. Anthropic’s “Claude Duet Safety, Privacy, and Security” (Announcements, dated 23 October 2026, 12-minute read) was read first-hand in full: the research-preview status, the three principles, every approval-gate detail (action/destination/content card, separate out-of-model check on the Claude Code auto-mode classifier, intent matching, off-limits categories, never-skip list, approval-fatigue calibration, Link one-time-card flow), both discretion tiers with the never-share-even-if-asked rule and consent-counts-as-request rule, the rewrite-and-reapprove fallback, task visibility and mid-task steering, the memory and disconnection retention properties, the single-use-key password path, the Managed-Agents placeholder-and-proxy token design, the dedicated browser VM with fixed command set, the prompt-injection-safeguard inheritance, the distinct User-Agent plus published egress IPs with pre-launch site opt-outs, the two-sided phishing analysis and claude.ai-only sign-in-form rule, the three-variant-plus-shadow-traffic evaluation regime, the threat model, the sourced external pentest and running follow-on engagement, per-feature isolated-rig red-teaming, and the HackerOne bounty scope. The 1Password flow is described as coming, not shipped. We did not use Duet, connect any account, approve any action, or test any control; all capability and limitation statements are Anthropic’s published claims, attributed not reproduced.

Sources: