Claude Duet Safety

Claude Duet approvals: you make the big calls

The central rule of Claude Duet safety is that the agent does the work but you make the irreversible decisions. Anthropic says Duet waits for approval on sensitive actions, and names four of them. Everything else, such as reading, researching, drafting and building reports, it can do on its own.

Sending

Emails, Slack messages and other outgoing communication are drafted, then held. The launch video shows an offer letter sitting behind "Not now" and "Send" until the owner taps Send.

Paying

Payments wait for you. In the demo, Duet prepares a health-permit application and asks the owner to "take a look and pay when you're ready."

Signing

Documents are not signed on your behalf without approval.

Deleting

Files and records are not deleted without approval, so a misread instruction cannot quietly wipe something important.

You can also see what Duet has done or is doing and steer it, according to Anthropic's product page. Ask in the thread for a list of recent actions at any time.

Claude Duet never sees your passwords

Anthropic's launch thread is direct about credentials: Duet "never directly sees your passwords."

Logins in a private cloud computer

Approvals, logins and safety checks run inside a private cloud computer. The practical effect is that the model doing the reasoning is kept away from your raw credentials; it works with the sessions those logins create rather than with the passwords themselves.

Classifier for sensitive info

Anthropic added "a new classifier" that guards against Duet sharing sensitive information. Think of it as a second check that looks at what the agent is about to send or reveal and blocks things that should not leave your accounts, such as financial details or personal identifiers. Anthropic has not published how the classifier decides, so treat it as a safety net, not a guarantee.

Claude Duet privacy: where your data goes

Privacy is the part of Claude Duet safety people most often misunderstand, so it is worth being precise.

Cloud processing

Duet works on a cloud computer run by Anthropic. Anything it reads from your connected apps is processed in the cloud, which is also why it can keep working when your phone is off.

Not local-only

There is no on-device or local-only mode. If your rules require that certain data never leaves your device or your company's systems, do not connect that data to Duet.

Visibility into actions

In the preview you cannot watch Duet's browser live. Instead you see its sources and the work it produced. Anthropic has not published Duet-specific retention rules yet; until it does, assume your Claude account's privacy settings and Anthropic's consumer privacy policy apply.

How the safeguards compare with other agents

Every company shipping a personal agent this autumn has landed on a similar shape: a dedicated cloud machine, credentials kept away from the model, and a human gate on risky actions. The differences are in who does the gating.

• Meta Muse uses a second agent called Sentinel on the same machine. Nothing Muse sends reaches the internet unless Sentinel approves it, and Muse also checks with you before purchases and emails.
• ChatGPT Dots lets you set custom rules for how much each dot may do on its own, from acting without asking to handing the task back to you.
• Duet keeps a fixed list of actions that always need you, plus a classifier that screens for sensitive information.

A fixed list is less flexible than configurable rules, but it is also harder to misconfigure. Full comparisons are on the Duet vs Muse and Duet vs Dots pages.

Use Claude Duet safely

Anthropic's safeguards cover the agent. These habits cover you.

Least-privilege connectors

Connect only the accounts Duet needs, and check the permissions each connector requests before approving it. A read-only calendar is safer than one it can edit if you only want scheduling suggestions. The connectors guide lists what each app allows.

Review drafts

Approve from the draft, not from the notification. Check recipients, amounts and attachments, especially for messages to people outside your organization.

Prompt injection awareness

Any agent that reads your email can read a malicious email. An attacker might write instructions into a message hoping the agent follows them. Duet's approval rule limits the damage, because the dangerous actions still need you, but be suspicious if the agent suddenly proposes sending data or paying someone you did not expect.

• Start with a low-stakes inbox or a test account, as the setup tutorial suggests.
• Never approve a payment to a new recipient from a notification alone.
• Disconnect apps you stop using; every connection is attack surface.
• Review what Duet is following once a week and stop anything finished.

Frequently asked questions