Home
Latest reporting
News
Anthropic detailed approval checks, data boundaries and credential isolation for Claude Duet, its cloud-based AI agent in research preview.
Anthropic said Claude Duet, its cloud-based AI agent in research preview, is designed to act on a user’s behalf while keeping approvals, sensitive data checks and credential boundaries outside the model. In a post published Oct. 23, 2026, the company said the agent can read inboxes, draft replies, book items and run routines while a user is away, but is built to stop and ask permission for important actions and to keep passwords, cookies and sign-in tokens out of the model’s reach.
Evidence and context
The company said Claude Duet is based on three operating principles: user control, discretion over information shared through connected apps, and separation of credentials from the agent. According to Anthropic, the system uses a separate classifier to review messages before they are sent and an automated check, built on its auto mode classifier from Claude Code and extended for Duet, to judge whether a task matches the user’s intent. The company said that before actions such as sending sensitive messages, paying for something or deleting items, Claude Duet shows the destination, content and recipients, then waits for approval.
Anthropic said some actions remain prohibited even with approval, including securities trading, banking actions such as moving money between accounts and accessing someone else’s account. The post also said certain repeated actions, such as paying or sending money, deleting an order or creating an account, are not covered by a “don’t ask me again” rule. For purchases, Anthropic said Claude Duet uses a one-time card from a wallet such as Link from Stripe, limited to the merchant and amount, and that the user sees the item and total before approving in the wallet app.
On privacy, Anthropic said Claude Duet separates information into two tiers: “Never share,” covering sign-in credentials, full card and bank account numbers and government ID numbers, and “Needs consent to share,” covering other private data such as health or financial information. The company said Claude Duet can rewrite a message without sensitive details if it is blocked by either the sensitivity rule or consent requirement, but added that the safeguards can still miss something or flag harmless content because the product remains in research preview.
The post also described visibility and control features. Anthropic said users can see what Claude Duet has done in a task list, steer it mid-task, delete history or reset memory, and disconnect apps so new access stops immediately. It said the agent inherits connected apps from the Claude account and uses memory from prior Claude chats, with stored data wiped when the account is deleted.
Anthropic said credentials are isolated from the model and handled by separate machines. Passwords entered into a form inside the Claude app are encrypted with a single-use key on the cloud browser machine, then passed unopened to the browser. The company said sign-in tokens for connected services never enter the machine where the agent works, and that the browser runs in its own virtual machine with fixed commands such as opening pages, clicking and typing. The post said the system cannot read browser cookies, while page text and downloads do come back because the agent needs them to operate.
Security testing has been running throughout development, according to Anthropic. The company said its Safeguards team built evaluations from routine-shaped tasks with innocent, injected and overbroad variants; red teams tested for leaks, unauthorized actions and malicious prompts; and an external penetration-testing firm reviewed the source code, with a follow-on engagement on the cloud browser and sign-in form still under way. Anthropic said Claude Duet is included in its public bug bounty program on HackerOne.
The product remains in a waitlisted U.S. research preview for Pro and Max subscribers, according to background product information verified as of Oct. 23, 2026. Anthropic has also said Claude Duet runs in standalone iOS and Android apps and on the web, and that it is powered by Claude Opus 5.5. The company said some capabilities and protections, including approval cadence, sign-in flows and sensitivity checks, are still being refined as it gathers feedback.
