Anthropic details security layers for Claude Duet AI agent

How Claude Duet handles tasks

Claude Duet is designed as a proactive AI agent that can monitor connected accounts and finish business tasks while a user is away. It functions by using a cloud-based browser and computer to draft messages, prepare briefings, and manage various workflows. The service is currently available to Pro and Max subscribers in the United States through a research preview waitlist.

To perform these actions, the agent uses conversation history and memory to maintain context across different tasks. Users can monitor the agent's progress through a dedicated task list and provide real-time instructions as work is being completed. If a user disconnects a specific app, the agent loses the ability to access that app for new tasks.

The system is built to share usage limits with the standard Claude service. While the agent can carry out complex routines, it is restricted from certain high-risk activities regardless of user permission. These include trading securities, moving money between bank accounts, or accessing accounts belonging to other people.

Approval and intent verification

Anthropic has built a system where the agent must ask for permission before performing sensitive actions. When a request involves sending potentially sensitive messages, making payments, or deleting information, the agent presents an approval card. This card displays the proposed action, the destination, and the specific content, including who the recipient is.

A key security feature is that the approval flow and the automated intent check sit outside the AI model. This means that even if a website contains hidden instructions meant to trick the AI, those instructions cannot influence the approval card. This separation ensures that the check remains independent of whatever the agent is currently reading on the internet.

The company is aware of the risks associated with "approval fatigue," where users might start clicking through requests without thinking. Anthropic stated, "We will continue to adjust this calibration over time" to ensure users remain attentive to the agent's actions. Certain actions, such as creating new accounts or making payments, will always require a manual approval for every single instance.

Data privacy and filtering

To protect user privacy, Anthropic uses a separate classifier to identify sensitive information in outgoing messages and browser uploads. The agent is specifically instructed never to share credentials, full payment card numbers, bank account numbers, or government identification numbers. This applies even if a user explicitly asks the agent to share that information.

For other types of private data, such as health or financial details, the agent requires explicit consent from the user. If a user gives an instruction to send this data, that specific command counts as consent. If the system detects a violation, Duet can remove the sensitive content and submit a revised version for the user to review.

While the system is designed to be robust, Anthropic acknowledges that these automated checks might occasionally miss sensitive data or flag harmless messages. These limitations are part of the current research preview phase. Users have the ability to delete their conversation history or reset the agent's memory to clear retained context at any time.

Credential and browser security

One of the primary security concerns for AI agents is how they handle login information. Anthropic states that Duet cannot access a user's passwords, browser cookies, or sign-in tokens. Instead, users enter passwords into a form within the Claude app, which encrypts the data and sends it directly to a cloud browser.

For apps that are already connected, a separate service manages sign-in tokens. This keeps the credentials outside of the agent's workspace, meaning the AI cannot read them. The company also plans to support 1Password, which will allow users to approve credential requests without the login details ever passing through the AI model.

The browser used by Duet runs in a dedicated cloud virtual machine where the agent sends commands to click, type, and open pages. Because the website code runs inside this isolated environment, the agent cannot see browser cookies. However, the agent can see page text and downloaded content, which is why Anthropic uses specific defenses against prompt injections.

Testing and bug reporting

Anthropic has conducted extensive evaluations to ensure the agent does not exceed its authorization. These tests included routine tasks, scenarios with injected instructions, and attempts to trick the agent into leaking information. Internal red teams performed these tests to see if the agent would follow malicious prompts or act without permission.

In addition to internal testing, an external penetration-testing firm was hired to examine the service with access to its source code. Further testing is currently underway regarding the cloud browser and the specific sign-in forms used by the application. These layers of testing are intended to identify vulnerabilities before they can be exploited by attackers.

The service is also included in Anthropic's public bug bounty program. This allows independent security researchers to report vulnerabilities through HackerOne. The company warns users that any password requests coming from emails or texts claiming to be from Duet are fraudulent, as legitimate requests only appear inside the Claude app or on the official website.