Claude Duet launched with a product announcement. On 23 October, Anthropic followed up with the part that matters more: what sits under the hood against misuse. Duet is the first Claude that keeps working when nobody is watching, so the detail is worth reading.
What Duet is never allowed to see
The agent runs on a cloud computer, uses the apps you have connected to Claude, reads your inbox, drafts replies, books things and runs routines. It never sees your passwords, browser cookies, sign-in tokens or any other credentials. Anthropic keeps the credentials separate from the agent, the same way it does for Claude Managed Agents.
For purchases that means something concrete. Duet pays with a one-time card from a wallet like Link from Stripe, capped to that merchant and that amount. You see the item and the total and approve it in the Link app. Neither the agent nor the merchant gets your real card number.
Two tiers for private information
Before any message Duet sends, a separate safety classifier runs, outside the main model. It checks whether the message carries sensitive information and sorts it into two tiers.
Tier one is never share: sign-in credentials, full card and bank account numbers, government ID numbers. Duet passes those to nobody, not even if you ask it to. Tier two needs consent: health, finances and similar details go out only if you have approved it. Your own request counts as consent, so “send my dentist a note about my tooth pain” does not trigger a second approval.
Anthropic’s example lands the point. If you ask for a weekly recap to go to your team, you do not want your performance review conversation showing up in it.
The check sits outside the model
Before Duet does anything touchy, it shows you the action, the destination and the content, including every recipient, and waits. In parallel an automated check runs, built on the auto mode classifier from Claude Code and extended for Duet. It judges whether the action matches your intent, and it deliberately runs outside the model doing the work. Instructions someone hid in a web page cannot reach it.
Some things stay blocked even with your approval: trading securities, moving money between accounts, touching someone else’s account. Other steps never get a “don’t ask me again”, however often you have said yes: paying, deleting an order, creating an account. Routines that run while you are away sit under the same rules.
The real problem is approval fatigue
Anthropic puts the sentence in the post itself: too many requests teach people to tap through them. Which makes the calibration of how often Duet asks a security question, not a comfort question. An approval nobody reads any more is one protection gone, and it does not look any different from one that works. Anthropic says it will keep adjusting. You will know whether that worked the first time you catch yourself dismissing the third prompt of the day.