Notes from Việt Nam on law, technology, languages, history, culture and travel.

An Agent That Never Sees Your Password: How Anthropic Built Claude Duet

Most AI assistants still wait for you to type something. On Wednesday, 21 October 2026, Anthropic opened a research preview of Claude Duet, which works the other way round. It reads your connected apps on a schedule, sends you a morning brief, and keeps working on tasks in the background after you close the app. Two days later, on 23 October, the company followed up with a long post on safety, privacy and security. For developers, that second post is the more useful of the two, because it describes how an always-on agent can be given access to someone’s accounts without the model ever holding their keys.

What was announced

The basic facts below appear in Anthropic’s announcement and are repeated by VentureBeat, MacRumors and SiliconANGLE:

  • Status and access: a research preview by waitlist, for Pro and Max subscribers in the US only. Team and Enterprise plans are not included, and no Duet API was announced.
  • Platforms: a standalone app on iOS and Android, plus claude.ai. For now Duet is separate from the main Claude app.
  • Model: built around Claude Opus 5.5.
  • Price: no separate charge. Duet uses the same usage limits as the rest of the plan, and Anthropic says plainly that its background checks count against those limits.
  • Behaviour: a short brief each morning, then a check of connected accounts “every few hours”. Anthropic gives the reason for not checking continuously: it “would use up your plan’s limits much faster”. Duet messages you only when something needs your attention.
  • Reach: Anthropic says Duet can use the Claude Marketplace’s “over 6,000 connectors and plugins”. Named examples include Gmail, Slack, Google Calendar, Notion, Microsoft 365, QuickBooks, Stripe, Docusign, HubSpot, Gusto and Shopify.

The example tasks are mostly small-business admin: catching missed Slack threads, finding unpaid invoices in QuickBooks or Stripe and drafting reminders, preparing payroll in Gusto, and drafting a job post for LinkedIn. Anthropic also lists heavier work such as dashboards, sales forecasts and building web apps. People inside the company use it too. Boris Cherny, who leads Claude Code, talks through his to-do list with it while he walks, and the Duet team lead, Karan Ahuja, says he uses it to prototype and ship code.

The technical substance: three walls around the model

A proactive agent with access to your inbox, payroll and storefront is a large attack surface. Any email, web page or document it reads could carry a prompt injection. Anthropic’s 23 October post describes three separate defences.

1. The model never holds credentials. Duet runs on a cloud computer, so your phone or laptop doesn’t have to stay on. Its browser runs in a dedicated virtual machine, “separate from the model”, and the agent can drive it only through a fixed set of commands such as open a page, click and type. None of those commands can read cookies. When a site needs a password, you type it into a form inside the Claude app. The form encrypts it with a single-use key that exists only on the browser machine, and the browser types it into the site, so the password reaches the browser without passing through the model. API-style sign-in tokens follow the design Anthropic already uses for Claude Managed Agents: the agent’s machine holds a placeholder, and a proxy outside that machine swaps in the real value at request time. Anyone who has built secret injection with a sidecar or an egress proxy will recognise the pattern.

2. Approval happens outside the model. Before Duet sends a potentially sensitive message, pays for something, signs a document or deletes anything, it shows you the action, where it goes, the content and every recipient, and then waits. A separate classifier, built on the auto-mode classifier from Claude Code, checks each action against what you asked for. Because that check runs outside the model, Anthropic says, “instructions hidden in a page cannot affect the outcome”. Some actions can never be covered by a “don’t ask again” rule, including paying or sending money and creating an account. Purchases go through a one-time Link card limited to one merchant and one amount.

3. Some actions are banned outright. Trading securities, moving money between bank accounts and accessing someone else’s account are blocked even if the user approves. A second classifier checks every outgoing message and uploaded file for sensitive data. Credentials, full card and bank account numbers, and government ID numbers are never sent. Health and financial details go out only with explicit consent.

The design principle behind all three is easy to state and hard to follow: don’t rely on the model to resist manipulation. Put the secrets and the final decision where text the model has read cannot reach them.

How this compares

Duet is not the first agent of its kind. Meta’s Muse and OpenAI’s Dots already promise proactive help that runs on a cloud computer, and VentureBeat argues that cloud execution and human approval “do not, by themselves, differentiate Duet”. VentureBeat also reports that Dots starts at a $100 Pro subscription for individuals, while Duet is available from the $20 Pro tier. Anthropic’s own products overlap as well: Cowork has run on Anthropic’s servers since early October. What sets Duet apart is mainly product design, meaning a single persistent thread, a schedule and a morning brief, along with a security architecture that is described in more detail than most competitors have published.

Why it matters for the future of IT

For anyone building software, the bigger change may be who your users are. Anthropic says Duet sends a distinct User-Agent header and publishes its IP addresses. It also says it contacted several large websites before launch, and that some of them chose to block it. Sites now have to decide whether to allow agents, block them or rate-limit them, much as JPMorgan and Schwab did for banking agents. If you run a SaaS product, a clean, well-scoped API or MCP connector will soon be the path agents prefer to scraping your UI. The credential-proxy and out-of-model approval patterns are also a reasonable template for anyone building their own agents.

Open questions

The safeguards are described, not measured. Neither post gives a prompt-injection success rate, a false-positive rate for either classifier, or any benchmark. Anthropic says its Safeguards team built evaluations in which each task has an innocent version, an injected version and a version that tempts the agent to overreach, but it published no results. An outside penetration-testing firm reviewed the source code, and a second engagement covering the cloud browser and the sign-in form is “running now”, so that work isn’t finished.

Anthropic is candid about the limits. Duet “might misread a thread or miscalibrate what’s urgent”, it can miss something that arrives between checks, and personal errands such as booking tickets “aren’t quite as strong”. It also names approval fatigue: “too many requests teach people to tap through them.” Two data-handling points matter too. Disconnecting an app stops new access, but what Duet has already learned from that app stays in memory until you reset it. And neither post says whether Duet data is used for training. Finally, there is the cost question VentureBeat raises: once recurring monitoring has used its share of a $20 plan, how much useful work is left?

Duet is best read as a public experiment in the hardest problem for consumer agents: letting software act for you without giving it your keys. The architecture is sensible. Whether it holds up against real injected email at scale is still an open question.

Sources