Introducing Claude Duet / Claude Duet Safety, Privacy, and Security
B · Useful, limited Anthropic product launch and companion safety post for a background agent; the control design is described in useful detail, but there are no evaluation numbers and the evidence is vendor testimonials.
Summary based on the full text·Original: about 17 minutes to read
In short
Two Anthropic posts (21 and 23 October 2026). The first announces Claude Duet, a research-preview app in which a model built around Opus 5.5 works as a proactive agent: it sends a morning brief, watches connected apps, runs tasks in its own cloud virtual machine and browser, and asks before acting on the user's behalf. Access is by waitlist for US Pro and Max subscribers. The second post sets out the safety, privacy and security design: approval gates, a separate classifier on outgoing messages, credential handling the model never sees, and browser isolation. Neither post reports evaluation results.
Key numbers
- over 6,000connectors and plugins in the Claude Marketplace the agent can use
- two tierssensitive-information categories: never share (credentials, government ID, card and bank numbers) and share only with consent
- every few hourshow often the agent checks connected accounts, chosen to limit plan usage
As reported by the source.
English·Web page·opens claude.com
What it reports
- Before sending a message, making a payment, signing a document or deleting anything, the agent shows the action and waits for approval. Trading securities and moving money between accounts are blocked even with approval.
- Actions pass through the auto mode classifier used in Claude Code; a separate automated check runs outside the model.
- A new classifier and safety system prompt screen each outgoing message: the strictest tier (credentials, government ID, card and bank numbers) is never shared; health or financial details need explicit instruction.
- Passwords and sign-in tokens are kept from the model: passwords are passed encrypted to the browser, tokens are substituted by a proxy outside the agent's machine. Purchases use Stripe Link virtual cards or Shop Pay.
- The browser runs on an isolated cloud machine, accepts only fixed commands, and identifies itself with a distinct User-Agent header.
- Testing described: safeguards evaluations with innocent, injected-instruction and temptation variants of tasks, shadow traffic, red teams, an external penetration test with source access, and the public bug bounty.
- Background checks count against plan limits; Anthropic says the agent may misread a thread or misjudge urgency.
How they got it
Product documentation and design description from the vendor, plus quotes from Anthropic staff and three small-business early testers. The safety post describes test methods but publishes no pass rates, failure counts or classifier accuracy, and says approval frequency and classifier accuracy are still being tuned.
Limits
- No quantitative evaluation of the agent, the classifier or prompt-injection defences.
- Testimonials are selected by the vendor.
- Research preview, US only, waitlist; behaviour may change before wider release.
Why it matters for companies
This is the consumer and small-business version of the agent design many firms are building internally, and its control list is a usable reference: approval before irreversible actions, hard blocks on money movement, an outbound data-leak classifier, credentials held outside the model, and an isolated browser. Firms should expect staff to connect agents like this to work email and calendars, so policy on which accounts personal agents may access is now due. Ask for measured leak and injection rates before relying on the classifier.
Summary based on the full text. Read the original for the full argument and data.Read the original on claude.com