Anthropic launches Claude Duet research preview with new safety features

A proactive agent for daily tasks

Anthropic has introduced Claude Duet, a proactive agent currently available in a research preview. Unlike standard chatbots that wait for a prompt, this agent is designed to work for users even while they are away from their devices. It utilizes a cloud-based computer to interact with various apps and services that a user chooses to connect to the platform.

The agent is capable of performing a variety of automated routines, such as reading through an inbox, drafting replies, and booking appointments. Because it runs continuously, it can handle these tasks in the background without requiring the user to keep the application open. The team at Anthropic noted that they use the tool themselves for daily work to ensure it functions as intended.

To guide its behavior, the developers built the agent on three core principles. These include handling information with discretion, ensuring the user remains in control of major actions, and keeping credentials completely isolated from the model. These safeguards are intended to provide a balance between the convenience of automation and the necessity of security.

Approval layers and intent checks

Because Claude Duet can act on a user's behalf, it is designed to stop and ask for permission before performing sensitive actions. For example, if the agent needs to send a potentially private message, pay for an item, or delete something, it must show the user the specific content and the destination. The user then provides explicit approval before the agent proceeds with the task.

Alongside these manual approvals, an automated check runs to ensure the agent's actions align with the user's original intent. This check is built on a classifier from Claude Code and is designed to run outside the main model. By keeping this check separate, Anthropic aims to prevent

Classifying sensitive information

Anthropic developed a new safety classifier to manage how the agent handles private data within connected apps. This system is designed to distinguish between information that is safe to share and information that requires strict protection. It categorizes data into two distinct tiers to determine how the agent should behave when drafting messages.

The first tier includes highly sensitive data such as sign-in credentials, full bank account numbers, and government ID numbers. Claude Duet is programmed to never share this information with anyone, regardless of a user's request. The second tier covers other private details, such as health or financial information, which the agent will only share if the user provides explicit consent.

If the agent detects that a message contains information from either tier, it can attempt to rewrite the message to remove the sensitive parts. It then presents the revised version to the user for approval. While this system is still in preview and may occasionally flag harmless content, it serves as a primary layer of defense against accidental data leaks.

Credential and browser isolation

A key technical feature of Claude Duet is the isolation of user credentials from the AI model. The agent never sees passwords, browser cookies, or sign-in tokens, and it cannot save these items to its memory. Instead, these credentials pass through separate machines that the model cannot access, ensuring that the agent cannot be phished or forced to reveal secrets.

When a user types a password into the Claude app, it is encrypted with a single-use key that only exists on a secure cloud browser machine. The model never sees the plaintext password. Additionally, the agent uses a proxy system for sign-in tokens, where a placeholder sits in the agent's workspace and the real value is only inserted at the moment a request is made.

The browser itself runs in a dedicated virtual machine in the cloud, separate from the model and the computers where the agent performs its work. The agent interacts with the browser through a fixed set of commands, such as clicking or typing. This means that while the agent can read the text on a page to complete a task, it cannot access the site's cookies or underlying code.

Testing and future development

Anthropic conducted extensive testing before releasing Claude Duet into its research preview phase. Their safety team created evaluations based on routine tasks, including versions with injected instructions or prompts intended to tempt the agent into overstepping its bounds. They also employed red teams to test for information leaks and utilized an external firm to perform penetration testing on the source code.

The company is currently refining several aspects of the agent, including the frequency of approval requests and the accuracy of the sensitive-information classifier. They are also working on a new sign-in feature that will allow users to approve credentials directly through 1Password. This will allow the credential to reach the browser without ever passing through the model.

Because this is a research preview, Anthropic is looking for feedback from early users to understand what protections and controls are most valued. Users can provide feedback in plain words within the app, which will be used to iterate on the agent's behavior. The goal is to learn how people interact with personal agents while maintaining a high standard of security and privacy.