Can you trust a proactive AI agent? How Claude Duet handles approvals and privacy
Short answer: On paper, Claude Duet covers the basics well: it waits for your approval before sending, paying, signing or deleting, keeps credentials away from the model, and checks outgoing messages for sensitive data. The gaps are what the docs don't say: whether your data trains models, how long data is kept, and how to pause it. This review is based on Anthropic's docs and press coverage, not hands-on tested.
TL;DR
- Claude Duet waits for your approval before it sends, pays, signs or deletes. [Help Center]
- It never sees your passwords, cookies or sign-in tokens, and a classifier checks outgoing messages for sensitive data. [Anthropic safety]
- Gaps: the docs we read don't state a training policy, a retention period in days or a pause control.
What Claude Duet is, in one paragraph
Claude Duet is Anthropic's research-preview agent that works on its own cloud computer, sends a morning brief, and keeps working when you close the app. [Anthropic] For the full feature list, plans and limits, see our explainer on what Claude Duet is and who can get it. Because it acts while you're away, the question that matters is what it may do without you.
The eval checklist
We use the same six questions for any agent that acts for a person: approval gates, data retention and training use, scope of access, audit trail, ability to interrupt, and connector permissions. We added three rows the docs cover in depth. Each row says only whether the sources state it. There are no scores.
| Check | Status | What the sources say |
|---|---|---|
| Approval gates | Stated in the docs | Before it sends a message, pays, signs a document or deletes anything, it shows the action and waits for your OK. [Anthropic] The approval card lists the action, destination, content and every recipient. [Anthropic safety] |
| Hard limits even with approval | Stated in the docs | Trading securities, moving money between accounts and accessing someone else's account stay blocked. [Help Center] |
| Data retention | Partly stated | Conversation history and memory are kept until you delete or reset them; deleting your account wipes what it stored. [Anthropic safety] No retention period in days is given in the sources we read. |
| Training use of your data | Not stated | None of the five sources says whether Claude Duet conversations or connected-app data are used to train models. |
| Scope of access | Stated in the docs | It works only in apps you connect, and you start every connection. [Help Center] It can't see files on your computer or all your projects, and can read but not change your work in Claude. [Help Center] |
| Credential isolation | Stated in the docs | The model never sees passwords, cookies or sign-in tokens; a proxy outside the agent's machine inserts tokens per request. [Anthropic safety] |
| Audit trail | Partly stated | A task list gives each task its own page showing what it has done and is doing. [Anthropic safety] Numbers and summaries name the email, file or sheet they came from. [Help Center] An exportable action log is not mentioned. |
| Ability to interrupt | Partly stated | You can steer it mid-task [Anthropic safety] and disconnect any app. [Anthropic] A pause or stop control is not described, and you can't watch or take over its browser. [Help Center] |
| Connector permissions | Partly stated | Disconnecting stops new access, but what it already learned stays until you reset memory. [Anthropic safety] Per-connector read-only versus write settings are not described. Slack works with limits; Microsoft 365 isn't available yet. [Help Center] |
| Sensitive-data checks | Stated in the docs | A separate classifier checks outgoing messages: card and bank numbers, credentials and government IDs are never shared; health or finance details need your consent. [Anthropic safety] |
| Prompt-injection defence | Stated in the docs | An automated check outside the working model judges whether each action matches your intent, so hidden page instructions can't answer the approval card. [Anthropic safety] Anthropic says no defence is perfect. [Help Center] |
| Independent testing | Stated in the docs | Red teams and an external penetration-testing firm with source-code access tested it, and it is in the public bug bounty. [Anthropic safety] No results are published in these sources. |
Approval gates: strong, with fatigue in mind
The approval design has two layers. First, a card shows the exact action, destination, content and recipients. [Anthropic safety] Second, a separate check built on the auto mode classifier from Claude Code runs outside the model and asks whether the action matches your intent. [Anthropic safety] Some steps, like paying, deleting an order or creating an account, can never be covered by a "don't ask me again" rule. [Anthropic safety]
Anthropic says it tuned how often it asks because too many prompts teach people to tap through. [Anthropic safety] If you can't approve right away, it finishes the rest of the task and brings the approval back later. [Help Center] Purchases use a one-time card from Link or Shop Pay, limited to one merchant and amount. [Anthropic safety]
Privacy: two tiers of sensitive data
A classifier separate from the main model checks each outgoing message. [Anthropic safety] "Never share" covers sign-in credentials, full card and bank numbers and government ID numbers, even if you ask. "Needs consent" covers things like health or finances, where your own request counts as consent. [Anthropic safety] Files it uploads through the browser get the same check. [Anthropic safety] Anthropic admits the classifier will sometimes miss something or flag a harmless message. [Anthropic safety]
Retention is the weaker area. History and memory stay until you delete or reset them, and memory of a disconnected app is kept until you reset it. [Help Center] Training use isn't addressed in any source we read.
Access, credentials and the browser
The cloud browser runs on its own virtual machine, separate from the model. The agent drives it with a fixed set of commands, and site code and cookies stay on that machine; page text and downloads come back. [Anthropic safety] Its browser requests carry a distinct User-Agent header, and Anthropic publishes the IP addresses it browses from. [Anthropic safety] Its sign-in form appears only inside the app during a sign-in you asked for, never as a link, text or email. [Anthropic safety]
What to check before you connect your accounts
- Connect only the apps you need. You start each connection and can disconnect any time. [Help Center]
- Reset memory after disconnecting an app if you want what it learned gone. [Anthropic safety]
- Turn off Search and reference chats if you don't want it searching past chats. [Help Center]
- Read every approval card. Anthropic says it can misread a thread or misjudge urgency. [Help Center]
- Remember checks run at intervals, so something urgent can arrive between them. [Help Center]
How do rival agents handle the same questions? See Claude Duet vs Meta Muse vs OpenAI Dots compared.
FAQ
Does Claude Duet ask before it acts?
Yes, for consequential steps. Anthropic says it shows you what it is about to do and waits for approval before it sends a message, makes a payment, signs a document or deletes anything.
Can Claude Duet see my passwords?
Anthropic says no. You type passwords into a separate form, they are encrypted for one use and passed to its cloud browser, and sign-in tokens are added by a proxy the model cannot reach.
Is my Claude Duet data used for training?
Not stated. None of the official pages or press coverage we read on 26 Oct 2026 addresses training use for Claude Duet specifically.
Can I stop Claude Duet from using an app?
Yes. You can disconnect any app at any time. That stops new access, but what it already learned stays until you reset its memory.
Can I watch or take over its browser?
No. During the research preview you can't watch Claude Duet work in its browser or take it over.
What can it never do, even with approval?
Trade securities, move money between accounts, or access someone else's account.
Sources
- Anthropic: Introducing Claude Duet (read 26 Oct 2026)
- Claude Help Center: Get started with Claude Duet (read 26 Oct 2026)
- Anthropic: Claude Duet safety, privacy, and security (read 26 Oct 2026)
- Claude Duet product page (read 26 Oct 2026)
- The Verge, 21 Oct 2026 (read 26 Oct 2026)