Claude Duet can work through connected accounts while a user is away, but Anthropic says actions such as sending sensitive messages, making payments or deleting information require approval. The company also says the agent cannot access passwords or sign-in tokens, and that some actions remain prohibited even with approval.
Anthropic Watch analysis
What happened
Duet runs in a cloud browser and can read web pages and downloaded material, which could contain malicious instructions. Anthropic says a separate automated check assesses whether each action matches the user’s intent, while approval requests show the proposed action, destination and content. Certain actions, including payments and account creation, require approval each time.
Anthropic also says Duet cannot trade securities or transfer money between accounts, even if a user approves. A separate classifier checks outgoing messages and browser uploads for sensitive information. The company acknowledges that these checks may miss sensitive material or flag harmless messages during the research preview, according to Help Net Security’s account of Anthropic’s safeguards.
Passwords entered through a form inside Claude are encrypted and sent directly to the cloud browser, rather than passed through the model. Anthropic says connected-app sign-in tokens are likewise kept outside the agent’s workspace. It warns that attackers could imitate password forms: legitimate requests should appear only during a sign-in initiated by the user in Claude or claude.ai.
Why it matters
The useful details are the boundaries, not the reassuring label “safeguards”. Duet can act across connected services, but some steps still need user approval, some are barred, and credentials are intended to stay away from the model. That gives potential users a more practical picture of what the agent may do and where Anthropic says it draws the line.
Those protections are not a guarantee. Anthropic acknowledges possible misses and false alarms in the research preview, and the report says further testing of the cloud browser and sign-in form is under way. Approval prompts also bring the familiar risk of people clicking through too many requests. Even the security gate can become another button to hurry past.
Our read
This is a useful map of the controls Anthropic says it has built, not an independent demonstration that every boundary holds. If you are considering Duet, the important distinction is between tasks it can prepare, actions it asks you to approve and actions it says it will not perform. Read the prompt before approving it, and treat unexpected password requests as a reason to stop.
What to watch
- Whether Anthropic publishes results from its ongoing browser and sign-in-form testing.
- How the company adjusts approval prompts to limit both missed checks and approval fatigue.
- Whether users can readily inspect and delete the memory Duet retains between tasks.
Discussion spark: Would you trust an agent with access to your connected apps if it showed you each consequential action for approval, or do the remaining limits and possible missed checks make that too much to ask?
Sources and evidence
- Anthropic details what stops Claude Duet from going rogue – Help Net Security (26 October 2026, 10:41 UTC)
Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.