Anthropic details safeguards keeping Claude Duet agent from acting without approval
Original title: Anthropic details what stops Claude Duet from going rogue
Approval checks and credentials are kept outside the model, and Anthropic warns that password requests from Duet via email or text are fraudulent.
Anthropic published the security and privacy design of Claude Duet, a proactive agent that monitors connected accounts and completes tasks via a cloud browser. Approval cards and an automated intent check sit outside the model so injected web content cannot answer them, and payments or account creation require approval each time. Credentials stay out of the model's reach, a sensitive-data classifier screens outgoing messages, and red teams plus an external penetration-testing firm evaluated the service. The app is in research preview for US Pro and Max subscribers.
Unconfirmed: Anthropic acknowledges its sensitive-information checks may miss content or flag harmless messages during the research preview.
- Approval checks run outside the model to resist instructions hidden in web pages.
- Duet cannot access passwords, cookies or sign-in tokens; 1Password support is planned.
- Red teams and an external penetration-testing firm assessed the service.
- Anthropic warns password requests outside the Claude app or claude.ai are fraudulent.
Impact: compromise of agent accounts via fake password forms or injected instructions
- 1.Approve Duet actions only inside the Claude app or on claude.ai; report password requests from email or texts as fraudulent.
- 2.Disconnect unused connected apps to stop new access in both services.
- Vendors
- Anthropic
- Countries
- US
- AI models
- Claude Duet
From the original article
3 min read at helpnetsecurity.com
Anthropic has outlined the security and privacy protections behind Claude Duet, its proactive AI agent that can monitor connected accounts and complete tasks while users are away. The safeguards include approval requirements, checks for sensitive information and infrastructure that keeps credentials outside the model’s reach.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.