Anthropic says Claude Duet keeps credentials and approvals outside the model: what its safety post states and omits
Anthropic's 23 October safety post for Claude Duet says approvals, credentials and a separate check sit outside the model. It runs to 1,963 words and prints no error rate, retention period or approval count.
By Parminder Kumar Sharma · · 25 min read
The safety post prints no error rate, and the nearest figures belong to another product
Anthropic's safety post for Claude Duet, published on 23 October 2026, runs to 1,963 words (derived: a plain word count of the saved text, figure captions included) and prints no error rate. A search of that text finds no percentage and no count of tests, approvals or days (derived). The only numerals are the year 2025, the four figure numbers and the name 1Password. The post says Duet's approvals, its credential path and a separate safety check all sit outside the model, and that is the claim this briefing reads against the record. The announcement two days earlier (21 October, derived) had promised more detail on safety "in the coming days".
The nearest numbers are in Anthropic's own earlier post on the Claude Code classifier that, the Duet post says, its separate check is built on. In that post, published on 25 March 2026, Anthropic reported that the full two stage pipeline let through 17 per cent of a set of 52 real overeager actions, which is about 9 of 52 (derived), and blocked 0.4 per cent of benign actions in a set of 10,000 real tool calls, which is about 40 (derived). It wrote that users approved about 93 per cent of manual permission prompts, and called the 17 per cent figure "the honest number". The Claude Code post, repeated in a footnote of Anthropic's containment post, is the only place I found a miss rate for the classifier family Duet reuses.
Those figures do not describe Duet. They belong to a different product (shell commands and file edits), to a classifier Anthropic says ran on Sonnet 4.6 in that post, and to a date 210 days before the Duet announcement (derived). The Duet post says only that the check was "extended for Claude Duet". How it was extended, which model runs it, and how often it misses are not stated. Nor does a missing figure show the check is weak. It shows a reader cannot tell, and that is the point of reading the record closely: a control whose performance is unpublished is a design intention, not yet a result.
This briefing was written from Anthropic's own pages, read in a browser on Monday 26 October 2026 between 12:04 and 12:19 GMT: the safety post, the announcement, the product page, two help centre articles, the research and engineering posts the safety post links, the Opus 5.5 page and Anthropic's HackerOne policy and scope pages. Help Net Security's write up of the same day was read for what it reports, as a secondary source. Nothing was signed in to, submitted or downloaded, and Duet itself was not tested, because access is by waitlist. Everything below is what Anthropic says about Duet, not what Duet does. Anthropic sells Duet inside its paid Pro and Max plans and wrote every document cited as a primary here, so each statement is its own claim, and the outside penetration test the post mentions cannot be read by anyone but Anthropic.
What Duet is, as Anthropic describes it
Anthropic's announcement of 21 October 2026 calls Claude Duet a research preview of a proactive agent. It is an app for iOS and Android, also reachable on claude.ai, offered by waitlist to Pro and Max subscribers in the US. The product page says Team and Enterprise plans are not included yet and that Duet is powered by Opus 5.5. The safety post says it uses a cloud based computer, runs after the app is closed, and can read an inbox, draft replies, book things and run routines while the owner is away. Connected apps and memory carry over from the person's Claude account. The announcement says it checks connected accounts every few hours and that background checks count toward the plan's usage limits.
The help centre article adds limits that matter for security review. The owner cannot watch Duet work in its browser or take it over. The owner cannot choose a model. Duet can read the person's work in Claude but not change it. With approval it can send email from connected accounts. The same article says approvals come back later if the owner cannot approve right away: Duet finishes the rest of the task and brings the approval back. That sentence answers a question the safety post leaves open, which is what happens to a task when an approval is ignored.
Every control the post states, where it runs, and what it leaves out
The first table lists the controls the post states for decisions and information. The last column is the negative column: what the post admits it misses or does not say. "Outside the model" is the post's own phrase for the separate check, and the same table shows why that phrase needs a second question.
Controls in Anthropic's Duet safety post of 23 October 2026 (https://claude.com/resources/articles/claude-duet-safety-privacy-and-security), read 26 October 2026. The right column is this briefing's reading of what is not stated.
| Control and where it runs | What the post says it does | Admitted or not stated |
|---|---|---|
| Approval card (a person, in the app) | Before something like sending a potentially sensitive message, paying or deleting, shows the action, the destination and the content, including every recipient, and waits. | Admits approval fatigue. Not stated: what the model read before proposing the action, how many cards a task produces, and the full list of actions that trigger one ("something like"). |
| Separate automated check (outside the model doing the work) | Built on the Claude Code auto mode classifier, extended for Duet. Assesses whether the action matches the person's intent, so that instructions hidden in a page cannot affect the outcome. | Not stated: its model, its inputs, its false negative and false positive rates, or whether it sees what the model read. |
| Off limits even with approval | Trading securities, banking actions such as moving money between accounts, and accessing someone else's account. | Not stated: how the limit is enforced, or whether the classifier or a fixed rule does it. |
| No standing approval | No "don't ask me again" for paying or sending money, deleting an order or creating an account, however often approved. | Not stated: whether other actions can be waved through with a standing rule. |
| Sensitive information classifier (runs apart from the main model) | Checks each outgoing message and browser uploads. Never share tier: sign in credentials, full card and bank numbers, government ID numbers. Needs consent tier: health, finances. Blocked messages can be rewritten and shown for approval. | Admits it "will occasionally miss something or flag a harmless message". Not stated: model, error rates, or how it handles attachments sent by email rather than uploaded through the browser. |
| One time card for purchases (Link from Stripe) | The card is limited to that merchant and amount. The person sees the item and total and approves in the Link app. The real card number is not shared with Duet or the merchant. | The Link help article says Duet can see card type, last four digits, nickname, expiry and shipping addresses, and that the approval is of a maximum amount. |
| Task list and memory controls | Each task has a page, the person can steer mid task, history and memory persist until the person deletes or resets them, and deleting the account wipes everything. | Not stated: any retention period, whether a task page is a full action log, or an export. Disconnecting an app stops new access but what Duet already learned stays until memory is reset. |
The numbers Anthropic has published for the pieces Duet reuses
Where the Duet post is silent, Anthropic's earlier posts give figures for the parts it says Duet builds on. They are set out below with their own product, model and date, because each is easy to misread as a Duet number.
Figures Anthropic published for products and models other than Duet. Sources: the Claude Code auto mode post (25 March 2026), the containment post (25 May 2026), the browser use post (24 November 2025) and the Opus 5.5 page, all read 26 October 2026.
| Figure as published | What it measured | Not Duet because |
|---|---|---|
| 0.4 per cent false positive rate (full pipeline) | Benign actions blocked, on 10,000 real Claude Code tool calls from Anthropic staff | Claude Code actions, classifier on Sonnet 4.6, March 2026 |
| 17 per cent false negative rate (full pipeline) | Real overeager actions let through, on a set of 52. About 9 of 52 (derived) | A small set from Claude Code sessions, so the figure is imprecise as well as old |
| 5.7 per cent false negative rate (full pipeline) | Synthetic data exfiltration attempts let through, on 1,000, many obfuscated | Synthetic Claude Code tasks |
| About 93 per cent of manual prompts approved | Claude Code users' approval of permission prompts, from telemetry | Developers answering shell prompts. Duet's users are described as professionals and small business owners |
| About 0.1 per cent single attempt, 5 to 6 per cent after 100 adaptive attempts | Prompt injection attack success on a Gray Swan benchmark, for Claude Opus 4.7 | A different model from Opus 5.5, and a benchmark, not Duet's browser |
| 1 per cent attack success | Browser extension on Opus 4.5 against an internal adaptive attacker given 100 attempts. Anthropic calls it "meaningful risk" | A different model and product, November 2025. The chart behind the figure was not in the page text read |
| No figure in the page text read | The Opus 5.5 page says it is more resistant than Opus 5 and ties Fable 5.1 for the lowest prompt injection success rate on a Gray Swan benchmark | This is the model Duet runs on, but the figure itself was not in the text read |
Two points follow. First, Anthropic's engineers describe the Claude Code classifier as one layer inside a sandbox, not a substitute for one, and write that any probabilistic defence has a miss rate above zero (containment post). The Duet post makes the same architectural choice by putting the browser and credentials in separate machines, which matches the order Anthropic's engineers recommend: containment first, a classifier second. Second, the Claude Code post says the classifier's misses were mostly cases where it saw the danger but wrongly judged that something the person had said covered the action. Duet's check also reads intent. The post does not say whether its approval card, which the person taps, counts as that consent signal, so what the check does with an ambiguous instruction is an open question (inference, not a finding).
The Claude Code classifier is built to be blind to what the agent read. Anthropic's post says it strips the agent's own messages and tool results so that injected text and persuasive rationalisations cannot talk it round, and accepts that it then cannot tell where a target came from. If Duet's check works the same way, it is a strong design against injection and a weak one against an agent that fills in a recipient it was never given. If it does not, it can be reached by what the agent read. The Duet post does not say which. The approval card has the same shape: it shows the action, the destination, the content and every recipient, but not the page or email that led there.
Four labels that do the work a control should do
A comforting label is not a control. The table sets each of the post's friendly names beside what the primary records say it covers.
Friendly names in the Duet safety post, announcement and product page (read 26 October 2026), and what each does and does not establish. The last column is this briefing's reading.
| Label | What the records say it is | What it does not establish |
|---|---|---|
| "You approve important actions" | A card shows action, destination, content and recipients. The post says "something like" sending a sensitive message, paying or deleting. The announcement says before it sends a message, makes a payment, signs a document or deletes anything. | That every consequential action gets a card. The two pages word the trigger differently, and the announcement also says actions are "approved by our auto mode classifier", using one word for a person's tap and a model's verdict. |
| "Outside the model" | The separate check and the approval card run apart from the model doing the work, so nothing the agent reads can answer the card. | That the check is not itself a model. The Claude Code version is a model based classifier with a published miss rate of 17 per cent on real overeager actions. |
| "Never sees your credentials" | The post says Duet "never sees your passwords, browser cookies" or sign in tokens. The key that opens an encrypted password exists only on the browser machine. Tokens are swapped in by a proxy outside the agent's machine. | That nothing at Anthropic handles them. The browser machine opens the password and types it (derived from the post's description). The model still reads page text and downloads, and the help centre says it sees partial card details and shipping addresses. |
| "Identifies itself as an agent" | Requests from its browser carry a distinct User-Agent header, and Anthropic says it publishes the IP addresses it browses from. Large sites were offered an opt out before launch. | That a site can block it reliably. The post prints no header string and no link to the address list, and does not name any robots.txt token Duet honours. The help centre says only that it aims to follow the rules sites set for agents. |
One wording difference deserves a note. The product page says approvals, logins and safety checks run "in your own cloud computer", while the safety post describes separate machines the model cannot access and says the agent's cloud computers are apart from the browser machine. This briefing follows the safety post as the more specific document.
Credentials and the browser: where the boundary holds and where it does not claim to
The credential design is the best documented part of the post, and it follows Anthropic's Managed Agents post of 8 April 2026. That post describes the fix as keeping tokens unreachable from the sandbox where the model's generated code runs, with credentials held in a vault and a proxy that fetches them for each call. The Duet post uses the term placeholder, which the Managed Agents post does not, and says Duet's browser keeps site code and cookies on its own machine. The Managed Agents post as read does not mention a browser, so the link the safety post gives for the browser claim supports the vault and proxy idea, not a browser machine.
Anthropic's containment post of 25 May 2026 supplies the cautions a reviewer should carry here. It says the weakest layer is usually the one a vendor built itself, and that its custom allowlist proxy was the component that failed in its most consequential incident, in Claude Cowork, when traffic to Anthropic's own API domain let a file upload reach an attacker's account. A placeholder swapping proxy is also custom software. That is not a finding about Duet's proxy, which the post does not describe beyond one sentence. It is a reason to ask who operates it, what it logs and what it will refuse.
The same post names persistent memory poisoning as a risk it is still working on: an injection that lands in memory is reloaded each time the agent starts. Duet keeps history and memory across tasks and carries over memory from Claude. The post does not say whether anything is checked before it is written to memory. It does say that disconnecting an app leaves what Duet already learned in place until memory is reset, so a poisoned or private item survives a disconnect.
The post is candid on one point worth keeping. A sign in form that asks for a password is itself a target, so Anthropic says Duet's form appears only inside the app, during a sign in the person asked for, and never as a link, text message, email or website other than claude.ai. That is a rule a person can apply to a message in seconds, and it is the most practical sentence in the post for a security awareness team.
Questions a reviewer would ask, and where the answer is
What the post leaves unstated, and whether any other Anthropic page I read fills it. Read 26 October 2026.
| Question | Safety post (23 Oct) | Anywhere else read |
|---|---|---|
| False negative and false positive rates of Duet's checks | Not stated | Only for the Claude Code classifier (March 2026), not for Duet |
| Model behind the check | Not stated | Claude Code version ran on Sonnet 4.6. Duet's not stated |
| Approvals per task or per day | Not stated. Says calibration will keep changing | Not stated for Duet |
| What happens when an approval is ignored | Not stated | Help centre: Duet finishes the rest and brings the approval back later |
| Retention of history and memory | Until the person deletes or resets. Account deletion wipes all | No period stated. Help centre confirms past memory is kept after a disconnect |
| Audit after the fact | A task list with a page per task | Help centre: Duet says which email, file or sheet a figure came from. The owner cannot watch the browser. No log export stated |
| External penetration testing | A firm, with source code access. A follow on covering the browser and sign in form is running | Firm, dates, scope and findings not stated |
| Shadow traffic | Evaluations run alongside it | Not defined |
| Cost | Not stated | Included in Pro and Max at no extra cost in the preview, sharing usage limits. A one time limit reset is offered until 30 November 2026 |
| Which websites opted out | "Some chose to" | No list |
| Header string and IP list | Says both are published | Neither printed nor linked on the pages read |
The bug bounty: in scope, but on the lower pay table for a month
The post says Duet is in scope of Anthropic's public bug bounty on HackerOne. Anthropic's HackerOne policy, last updated on 28 September 2026 on the page read, says reports in products or features released in Research Preview or Beta status are treated as non core for a one month period after their initial release. If that month runs from the 21 October announcement it ends about 21 November 2026 (derived; the policy does not define the release date). Non core assets pay less than core ones, as the table shows.
Reward ranges per severity from Anthropic's HackerOne policy page, read 26 October 2026 (https://hackerone.com/anthropic).
| Asset class | Low | Medium | High | Critical |
|---|---|---|---|---|
| Non core | $100 to $250 | $250 to $750 | $1,000 to $2,500 | $3,000 to $5,000 |
| Core | $250 to $750 | $1,000 to $2,500 | $3,000 to $5,000 | $7,500 to $10,000 |
The scope page lists 15 assets, last updated on 15 July 2026 on the page read, and Duet is not named on it. The listed core assets include the Claude iOS and Android apps and claude.ai, which Duet shares platforms with but is a separate app. Whether Duet counts as one of them is not stated on the page read. The policy also puts issues of model content and responses, including jailbreaks, out of scope, and excludes social engineering and phishing. Whether a hidden instruction that makes Duet act without approval is an infrastructure flaw, which is in scope, or a model response, which is not, is not stated. A researcher would want that answered before testing, and a customer should want it answered before relying on the program as a signal.
Anthropic's own research post of 9 April 2026 states a limit that applies to everything in the testing section of the Duet post. It says companies test their own systems with their own methods and "none are independently verified". That sentence is about the industry, not Duet, but it describes the position: the evaluations, red teams and outside penetration test are real as described, and none of their results can be read by a reader of the post.
Technical details
The Duet safety post prints no configuration, rule text, header string or address list, and the announcement, product page and the two help centre articles read print none either. So there is no Duet specific indicator to copy. What follows are the nearest artifacts Anthropic does print, each captioned with its source and what it does not establish, and a code free table of the architectural boundaries the post describes.
Architectural boundaries as the Duet safety post describes them (23 October 2026). Where a cell says derived, it is this briefing's reading of the post's wording.
| Place | Holds, per the post | Kept out, per the post |
|---|---|---|
| The person's phone, in the Claude app | The password form, which encrypts with a single use key. The approval card. The Link app approves spend | Not stated |
| The browser machine (its own virtual machine) | Site code and cookies. The key that opens the encrypted password, so the password is opened and typed here (derived) | Cookies cannot be read out by the agent's commands. Passwords stay out of the model |
| The agent's cloud computers | The work, with a placeholder where a token would go | Real tokens never enter them |
| A proxy outside the agent's machine | Puts the real token into a request as it is made | Not stated: who operates it, logs, refusal rules |
| The model | Page text and downloads, because it must read them. Files it uploads get the sensitive information check | Passwords, cookies and sign in tokens |
| Approvals and safety checks | Run on the separate machines the model cannot access | Nothing the agent reads can answer the card |
The post says Anthropic publishes the public IP addresses Duet's browser uses, but gives no link. The only Anthropic IP list I could find is the one linked from the crawler help article as the list of source addresses for Anthropic's bots. It is printed below as published. Neither that article nor the safety post says Duet browses from these addresses, so a site owner should not treat a block on this list as a block on Duet.
{
"creationTime": "2026-10-20T00:00:00Z",
"prefixes": [
{ "ipv4Prefix": "216.73.216.0/22" },
{ "ipv4Prefix": "34.162.230.222/32" },
{ "ipv4Prefix": "34.162.244.71/32" },
{ "ipv4Prefix": "34.162.191.81/32" },
{ "ipv4Prefix": "34.162.86.102/32" },
{ "ipv4Prefix": "136.79.143.251/32" },
{ "ipv4Prefix": "136.83.20.215/32" },
{ "ipv4Prefix": "34.162.111.78/32" },
{ "ipv4Prefix": "34.162.90.102/32" },
{ "ipv4Prefix": "34.162.27.34/32" },
{ "ipv4Prefix": "34.152.124.140/32" },
{ "ipv4Prefix": "34.153.21.190/32" },
{ "ipv4Prefix": "34.186.252.4/32" },
{ "ipv4Prefix": "34.162.153.71/32" }
]
}
The same help article names three Anthropic bots: ClaudeBot for training data, Claude-User for requests made at a user's direction, and Claude-SearchBot for search. It does not mention Duet. Which token, if any, Duet's browser honours is not stated. The only robots.txt example the article prints is for ClaudeBot, shown next. It is reproduced because a reader will look for it, and it should not be read as a way to block Duet.
User-agent: ClaudeBot
Crawl-delay: 1
User-agent: ClaudeBot
Disallow: /
For the classifier Duet's check is built on, the Claude Code post tells readers they can see its default block rules with one command. This shows the Claude Code defaults, not Duet's. It is the only way I found to read what the family of check blocks, and it needs a Claude Code installation.
claude auto-mode defaults
For anyone testing within Anthropic's program, the HackerOne policy requires an account created with a HackerOne email address and a header on requests. The research guidelines also forbid attacks on any account that is not the tester's own and any social engineering of staff.
X-HackerOne-Handle: <your handle>
What a security team should do, in the order worth doing
Duet is for individuals on consumer plans, and Team and Enterprise are not included yet. For most organisations the first exposure is therefore staff connecting work accounts to a personal agent, not a deployment someone approved. The list is ordered with that in mind. Items that ask a vendor question are framed as questions because the record does not answer them.
Take this with you
Actions for teams evaluating a personal or proactive agent, ranked
- Decide a policy now on personal agents that connect to work mail, chat, calendar, files and finance tools. Review the third party app grants in your identity provider, Google Workspace, Microsoft 365 and Slack admin consoles for Claude connectors and see who has granted what.
- Ask for the exact list of actions that raise an approval card. The post says something like sending a sensitive message, paying or deleting. Ask whether posting in a channel, sharing a file, sending a calendar invite, changing a setting or sending a message judged not sensitive raises one.
- Ask what the approval card does not show. It lists action, destination, content and recipients. Ask whether the person can see the email, page or file that led to the action, and whether the card is logged as shown.
- Ask for the false negative and false positive rates of the Duet check and of the sensitive information classifier, with sample sizes, the model behind each and what each sees. Anthropic published such figures for the Claude Code classifier, so a request for Duet's is reasonable.
- Prefer a connector with scoped tokens over a browser sign in wherever both exist, since a browser sign in gives the agent whatever the signed in session can do. Ask whether browser sessions persist between tasks, how long, and who at the vendor can access the browser machine.
- Ask what record exists after the fact: a log of actions, approvals and the content shown, its retention, and whether it can be exported. Anthropic's own containment post warns that once a poisoned input has steered an agent, a log may show only an authorised call.
- Ask for memory and history retention periods, whether disconnecting an app purges what was learned from it, whether memory is screened for planted instructions before it is stored, and what the process is for deleting it on request.
- Ask for the list of sub processors and partners in the data path, such as the wallet and checkout providers, and where the browser and cloud computers run.
- Brief staff on the phishing rule in the post: Duet's password form appears only inside the Claude app or on claude.ai, during a sign in the person started, and never by link, text or email. Any message that asks for a Duet password is not legitimate.
- For payments, set the card's own limits, read the Link spend request for the maximum amount before approving it, and watch statements in the first weeks. Remember the amount approved is a maximum.
- If you run public sites, ask Anthropic for the exact Duet `User-Agent` string and the location of its address list, add both to your own log queries, and do not rely on either as access control. A header is a declaration, not a credential, and sites that want to refuse an agent should require a signed in session with its own approval for any state changing action.
- Try it in a throwaway account, not production data, and within Anthropic's research guidelines. Plant a harmless instruction in a test inbox and see whether any action reaches an approval card. Record what the card showed.
- Ask Anthropic whether a hidden instruction that makes Duet act without approval is in scope for the bug bounty, and read the answer before treating the program as evidence of coverage.
What could not be verified
- How Duet behaves. Duet was not tested. Access is by waitlist, so every statement is Anthropic's description, and any of it may change during the research preview.
- Duet's error rates, model and checks. Not stated in any page read. The Claude Code figures are for another product.
- The header string and address list for Duet. Not printed. The IP list shown comes from the crawler help article and is not stated to be Duet's.
- The penetration test. The firm, scope, dates and findings are not stated, and no independent confirmation was found.
- Whether Duet is on the HackerOne scope list. It is not named on the page read. The post says it is in scope.
- The Opus 5.5 injection figure. The page text read gives a ranking, not a number. Any chart on the page was not read.
- Other reporting. Help Net Security's article of 26 October 2026 was read as a secondary source and matches the post on the points it covers. Other reporting about Anthropic models and agents was not read for this briefing, and nothing here compares it with Duet.
- Time stamped. Pages were read between 12:04 and 12:19 GMT on Monday 26 October 2026. Duet's availability, the help articles, the policy and the post could all change within hours.
The question that exposes the gap
When a page or email that Duet reads tells it to send something, and the only things between that instruction and the send are a classifier whose miss rate for this product has not been published and a card that users of Anthropic's other agent approved 93 times in 100, which of the two is meant to be the control, and who has measured it?
Key facts
Sources
- PrimaryClaude Duet Safety, Privacy, and Security, 23 October 2026: every control, the credential path, the browser, testing and the bug bounty statement. Read in full in a browser (about 12:15 GMT)Anthropic (claude.com)accessed 2026-10-26
- PrimaryIntroducing Claude Duet, 21 October 2026: what Duet is, who can join, the Opus 5.5 basis, approvals, usage and the promise of more safety detail in the coming daysAnthropic (claude.com)accessed 2026-10-26
- PrimaryClaude Duet product page: US Pro and Max waitlist, Team and Enterprise not included, safe secure private claims, FAQAnthropic (claude.com)accessed 2026-10-26
- PrimaryGet started with Claude Duet: limitations, the approval that returns later, memory kept after disconnect, usage and the limit reset until 30 November 2026Anthropic help centreaccessed 2026-10-26
- PrimaryHow to use Link by Stripe with Claude Duet: one time card, what Duet can see of saved payment methods, approval of a maximum amountAnthropic help centreaccessed 2026-10-26
- PrimaryDoes Anthropic crawl data from the web: the three named bots, the robots.txt example, the link to the bot address list. Duet is not mentionedAnthropic help centreaccessed 2026-10-26
- PrimaryPublished bot address list, creationTime 2026-10-20: one /22 prefix and 13 single addresses, not stated to be Duet'sAnthropic (claude.com)accessed 2026-10-26
- PrimaryHow we built Claude Code auto mode, 25 March 2026: the classifier design, Sonnet 4.6, 0.4 per cent false positives on 10,000, 17 per cent false negatives on 52, 5.7 per cent on 1,000 synthetic, 93 per cent of manual prompts approvedAnthropicaccessed 2026-10-26
- PrimaryHow we contain Claude across products, 25 May 2026: containment before classifiers, the proxy that failed, memory poisoning, Opus 4.7 Gray Swan figures, the 83 per cent and 17 per cent footnoteAnthropicaccessed 2026-10-26
- PrimaryScaling Managed Agents: decoupling the brain from the hands, 8 April 2026: tokens kept out of the sandbox, vault and proxy. No mention of a browserAnthropicaccessed 2026-10-26
- PrimaryMitigating prompt injections in browser use, 24 November 2025: 1 per cent attack success on Opus 4.5 with 100 adaptive attempts, and the statement that no browser agent is immuneAnthropicaccessed 2026-10-26
- PrimaryOur framework for developing safe and trustworthy agents, 4 August 2025: human control, transparency, privacy and security principles the Duet post citesAnthropicaccessed 2026-10-26
- PrimaryTrustworthy agents in practice, 9 April 2026: defences at several layers, and the statement that benchmark results are not independently verifiedAnthropicaccessed 2026-10-26
- PrimaryIntroducing Claude Opus 5.5: more resistant to prompt injection than Opus 5, and tied lowest on a Gray Swan benchmark, with no figure in the page text readAnthropicaccessed 2026-10-26
- PrimaryAnthropic bounty policy, last updated 28 September 2026: research preview products treated as non core for a month, reward table, model safety exclusions, the handle headerHackerOne (Anthropic program)accessed 2026-10-26
- PrimaryAnthropic bounty scope list, last updated 15 July 2026: 15 assets, Duet not namedHackerOne (Anthropic program)accessed 2026-10-26
- Reported byAnthropic details what stops Claude Duet from going rogue, 26 October 2026: a write up of the post, used only for what it reportsHelp Net Securityaccessed 2026-10-26
