Inside Claude Duet’s safeguards: what it can’t see, and what it won’t send

Giving an agent access to your email, bank tools and business accounts is a big ask. Alongside the Claude Duet research preview, Anthropic published a brief explaining how it is trying to make that ask reasonable. Duet builds on Claude’s existing model training and product safeguards, with extra protections for working across connected accounts and acting for a user.

A second check on what goes out

The most notable addition is a new classifier, separate from the main model, that checks the messages Duet drafts before they are sent. Having an independent checker matters because the main model is the part that might be fooled, for example by a cleverly worded email trying to trick it.

Three tiers of sensitive data

Anthropic sorts data by risk. The most sensitive items, including credentials, full card and bank numbers and government IDs, must never be shared, even if the user asks. Health and financial details need explicit consent before they go anywhere. Engadget highlighted the same consent rule in its look at Duet’s pricing.

Approvals and an intent check

Before Duet sends a sensitive message, makes a payment or deletes something, it shows you the action and waits for approval. A separate automated check then verifies that the action matches what you intended. That two-step approach targets a familiar failure: a user approving something without reading it closely.

Credentials stay off the model

Anthropic says Duet never sees passwords, browser cookies, sign-in tokens or other credentials. They stay on isolated machines the model cannot reach. When Duet buys something, it uses a one-time card from a wallet such as Stripe Link, so the model never handles your real card number. TechCrunch adds that by default Duet refuses requests for card numbers and government IDs, as we noted in Duet is built for work.

Testing

Anthropic says red teams, an external penetration test and its public bug bounty cover the preview, and that more testing on Duet’s cloud browser and sign-in form is underway. That last note is a candid admission that the parts of the agent that touch the open web are still being hardened.

How rivals handle it

OpenAI’s Dots take a rules-based approach. They ask for approval before sensitive actions such as installing software or changing a password, and users can write Custom Rules to allow, require approval for, or block specific actions, as we explained in our Dots privacy guide. WIRED noted that if your OpenAI account allows model training on your data, that setting carries over to Dot conversations.

Retailers are adding their own guardrails too. Walmart’s new Agent Gateway requires approval for every agent purchase by default and blocks agents that break its rules, as we covered in Walmart’s agent shopping plan.

What it means for you

No safeguard makes an agent risk-free, and Anthropic does not claim otherwise. Still, keeping credentials away from the model and checking outgoing messages separately are meaningful design choices. If you join the preview, keep approvals on, connect only the accounts you need, and review what Duet drafts before it goes out. Our full Duet launch story covers the rest.