Anthropic laid out Claude Duet's full security design in an official blog post on October 23. The agent, currently in research preview, keeps working for you on a cloud computer: reading email, drafting replies, placing orders, running scheduled tasks — even while you're away. The more power it has, the more urgent one question becomes: why should it be trusted?
The first lock is approval. Before sending a sensitive message, paying, or deleting something, Duet pops up an approval card showing the action, the target, the content, and every recipient, and waits for your nod. At the same time, a classifier independent of the working model checks in parallel whether the operation matches your intent — the check runs outside the model, so instructions hidden on a page can't interfere with it. Some operations can't even be approved: securities trading, transfers between bank accounts, and accessing someone else's account. Actions like payments, order cancellations, and account creation can never be set to "don't ask again."
The second lock is information classification. Before Duet sends a message, another independent classifier scans the content first: login credentials, full card numbers, bank account numbers, and government ID numbers fall into "never share" — they won't be sent even if you ask; health and financial details fall into "share only with consent," but your own explicit request counts as consent, so "send a message to my dentist saying my tooth hurts" needs no second confirmation.
The third lock is the most thorough: the model never touches your passwords at all. When you log in, you type your password into a form inside the Claude app; the form encrypts it with a one-time key on a secure browser machine in the cloud, and the ciphertext is passed through untouched to the browser for form filling — the model can neither see nor store it. Login tokens go through a proxy pattern: the agent machine holds only placeholders, and the real token is injected by an external agent at the exact moment the request goes out. The browser itself runs on a separate cloud VM; the agent can only issue fixed instructions, and websites' code and cookies never reach the model's memory.
Anthropic has also had external penetration testing firms test Duet with access to the source code; a new round of testing covering the cloud browser and login forms is underway, and Duet is already part of the public bug bounty program.
The direction of this design is clear: agent security is shifting from "restraining the model" to "restraining the system." Approvals, information classification, and credential isolation are three independent layers — if one is bypassed, the next one still catches it — and this may well become the industry template for personal agents.
