)
Last updated: October 26, 2026
What is Claude Duet, and is it safe to use at work? Claude Duet is Anthropic's proactive agent app, announced on October 21, 2026 as a research preview, that works in the background across connected apps such as Gmail, Slack and Stripe. Anthropic documents solid controls for credentials and approvals, but says nothing yet about Team or Enterprise plans or admin controls, so treat it as an unmanaged agent until that changes.
TL;DR: Key Takeaways
- Claude Duet is a research preview. Anthropic announced it on October 21, 2026, for US Pro and Max subscribers on a waitlist, on iOS, Android and claude.ai.
- Its reach is wide. Anthropic says it works with more than 6,000 connectors and plugins from the Claude Marketplace, including Gmail, Slack, QuickBooks, Stripe and HubSpot.
- Credentials stay away from the model. Anthropic's security page (October 23, 2026) says Duet never sees passwords, cookies or sign-in tokens, and a check outside the model gates sending, paying and deleting.
- Gaps remain for companies. The same page does not describe Team or Enterprise availability, admin controls, retention periods or who at Anthropic can access data.
- Approval fatigue is a risk. Anthropic names it, and Simon Willison (August 8, 2026) reports that only 13.6% of 1,053 testers refused a swapped dangerous command.
- The risks map to OWASP. The OWASP Top 10 for LLM Applications 2026 (August 3, 2026) covers Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02) and Excessive Agency (LLM03), all of which apply here.
Key Facts at a Glance
| Item | What Anthropic says (as of October 26, 2026) |
|---|---|
| Status | Research preview, waitlist, US Pro and Max subscribers only |
| Announced | October 21, 2026 |
| Where it runs | iOS, Android and claude.ai; tasks run on a virtual machine with its own browser |
| Connectors | More than 6,000 through the Claude Marketplace |
| Needs your approval | Sending messages, paying, signing documents, deleting anything |
| Off limits, even with approval | Trading securities, moving money between accounts, accessing someone else's account |
| Team or Enterprise plans | Not described |
What Claude Duet Is and What It Can Reach
Claude Duet is a standalone app where Claude works as a proactive agent for professionals and small business owners. It sends a morning brief, checks connected accounts every few hours, and drafts or prepares work in the background on a cloud virtual machine with its own browser, so your phone or laptop does not need to stay on.
According to Anthropic (2026), the app is built around Claude Opus 5.5 and carries over memory, skills and connected apps from your Claude account. It also takes instructions by text or voice in one ongoing thread, and each task gets its own page where you can watch progress and steer it.
| Area | Apps Anthropic names | What Duet does with them |
|---|---|---|
| Email and chat | Gmail, Slack | Finds missed messages and drafts replies |
| Finance | QuickBooks, Stripe, Gusto | Finds unpaid invoices, sends reminders, prepares payroll for approval |
| Sales and contracts | HubSpot, Docusign | Drafts follow-up emails and routes agreements |
| Hiring and marketing | LinkedIn, Canva | Drafts job postings (after approval) and social campaigns |
| Commerce | Shopify, Link by Stripe | Manages a store and pays with a one-time virtual card |
For a CISO, the combination is the point. One agent can read mail, see invoices and send messages as you. That makes it a high-privilege non-human identity, even though it is presented as a personal assistant.
How the Safeguards Work, According to Anthropic
Anthropic describes four layers: credentials kept away from the model, an approval check that runs outside the model, a classifier that screens outgoing messages for sensitive data, and an isolated cloud browser. Reading, drafting and preparing run freely. Sending, paying, signing and deleting wait for your approval.
| Control | How Anthropic describes it | Limit Anthropic states |
|---|---|---|
| Credentials | Passwords go into an in-app form and are encrypted with a single-use key that exists only on the browser machine. Sign-in tokens stay behind a proxy, and the agent holds a placeholder | Page text and downloads still return to the agent |
| Approval gate | Shows the action, destination, content and every recipient. The check is built on the Claude Code auto mode classifier and runs outside the model | Approval frequency is still being tuned |
| Outgoing data classifier | Blocks credentials, full card and bank numbers and government IDs, even if you ask. Other private data, such as health or finances, goes only with your explicit consent | Will occasionally miss something or flag a harmless message |
| Hard limits | No trading securities, no moving money between accounts, no access to someone else's account | None stated |
| Browser isolation | A dedicated cloud virtual machine. The agent can only open a page, click and type, and cookies stay on that machine | Page text is a possible injection vector |
| Testing | Red teams, an external penetration test with source code access and a public bug bounty on HackerOne | A follow-on test of the cloud browser and sign-in form was still running on October 23, 2026 |
Purchases use a one-time card from Link (Stripe) limited to that merchant and amount. A few steps cannot be covered by a "don't ask me again" rule: paying or sending money, deleting an order and creating an account. Routines that run while you are away have the same safeguards.
Anthropic also warns that the sign-in form appears only inside the app, during a sign-in you started. Any other request for your password, by link, text or email, is not legitimate.
)
What Anthropic Has Not Said Yet
As of October 26, 2026, Anthropic's launch and security pages leave open the questions a CISO needs answered: whether Team and Enterprise plans can use Duet, what admin controls exist, how long data is kept, and who at Anthropic can see it. Those gaps matter more than the safeguards that are already documented.
| Question | What the pages say | Why it matters |
|---|---|---|
| Team or Enterprise availability | Not described; waitlist for US Pro and Max | Use at work is likely to happen on personal accounts |
| Admin controls | Not described | No central off switch is documented |
| Data retention | History and memory are kept until you delete or reset them; no periods given | Mail and chat content can persist in memory |
| Anthropic access to data | Not stated | Needed for vendor reviews and data processing terms |
| Disconnecting an app | Stops new access at once; what Duet already learned stays until you reset memory | Offboarding needs a memory reset step |
| Log retention | Each task has a page; log retention is not described | Incident reconstruction may be limited |
| Browser visibility | Duet cannot yet show you its browser | Intermediate steps are hidden |
One detail helps web and SOC teams. Anthropic says Duet's browser requests carry a distinct User-Agent header and that it publishes the IP addresses it browses from, so sites can identify or block it. Some large websites chose to block it before launch.
The Security Risks for Companies, Mapped to OWASP 2026
Four risks stand out: hidden instructions in pages or messages, sensitive data leaving through a legitimate channel, an agent doing more than intended, and people approving prompts without reading them. Each maps to a category in the OWASP Top 10 for LLM Applications 2026 or the OWASP Top 10 for Agentic Applications.
| Risk | OWASP mapping | How it shows up with Claude Duet |
|---|---|---|
| Hidden instructions in web pages, emails or Slack messages | LLM01 Prompt Injection; ASI01 Agent Goal Hijack | Duet reads mail and browses pages, and page text returns to the agent |
| Sensitive data in outgoing messages | LLM02 Sensitive Information Disclosure | A classifier screens messages, but health and finance data can go with consent |
| Overreach with delegated access | LLM03 Excessive Agency; ASI02 Tool Misuse and Exploitation; ASI03 Identity and Privilege Abuse | One agent can hold mail, payments and payroll connectors |
| Persistent memory | ASI06 Memory and Context Poisoning | Memory is kept until reset and carries over from your Claude account |
| Approval fatigue | ASI09 Human-Agent Trust Exploitation | Anthropic names approval fatigue as a serious risk |
On that last point, there is evidence worth reading. According to Simon Willison (August 8, 2026), a test of 1,053 paid testers swapped a permission prompt for a dangerous command, and only 13.6% of the humans refused it. The auto mode classifier would have blocked 89%, which leaves roughly 11% getting through.
That figure is about Claude Code's auto mode, the classifier Duet's check is built on, not about Duet itself. It still shows why an approval prompt is a useful control but not one to rely on alone.
The OWASP Top 10 for LLM Applications 2026 (August 3, 2026) ranks Excessive Agency third, which fits an agent that can read, draft, pay and delete across many apps. The Agentic Top 10 (December 9, 2025) gives the same risks agent-specific names.
Security and Governance: How to Handle Claude Duet Today
Until Anthropic documents enterprise controls, govern Claude Duet at the layers you already control: decide whether employees may connect work accounts, restrict OAuth grants, keep sensitive data out of scope and name an accountable owner. These steps need no new tooling and apply to any background agent.
| Control | What to do | Where it lives |
|---|---|---|
| Policy | State whether work accounts may connect to Duet; default to no for regulated data | AI use policy |
| OAuth and app allowlists | Review and restrict third-party app grants in your Google Workspace, Microsoft 365 and Slack admin consoles | Identity and SaaS admin |
| Least privilege | If use is allowed, start with read-only scopes and add one connector at a time | Connector settings |
| Approval hygiene | Teach people to read recipients and content, and treat an unexpected approval prompt as an incident | Awareness training |
| Memory and offboarding | Add "disconnect apps and reset Duet memory" to the offboarding checklist | HR and IT |
| Detection | Watch web logs for Duet's User-Agent and published IP addresses, and review new OAuth grants | SOC |
For agents your own teams build and run, the controls sit in your infrastructure. NeuralTrust's Agent Gateway (TrustGate) applies policy to every model and tool call, Agent Runtime Security (TrustGuard) enforces it at runtime, and Agent Posture Management (TrustLens) inventories agents and the access they hold, all as part of the Runtime Security Mesh.
None of these can see inside Claude Duet's cloud browser, which Anthropic operates. For Duet itself, your controls remain identity, OAuth and policy. Ask of any vendor agent what you would ask of your own: what can it reach, and what stops it from going further.
Which Approach Should You Choose?
Choose by who you are and what data the agent would touch. Regulated enterprises should wait for documented admin controls. Small businesses can pilot with narrow scopes. Security teams should start measuring exposure now, whether or not the company has approved Duet, because personal accounts make shadow use likely.
| If you are | Recommended approach | Why |
|---|---|---|
| A CISO at a regulated enterprise | Block work-account connections until admin controls and retention terms exist | No Team or Enterprise documentation yet |
| An IT or security team at a mid-size company | Allowlist OAuth apps, monitor web logs and publish an interim policy | Shadow use on personal accounts is likely |
| A small business owner | Pilot with read-only scopes on a non-sensitive mailbox and approve every send | This is the audience Anthropic built Duet for |
| An AI platform lead building your own agents | Reuse Duet's published design as a checklist: credential isolation, approval checks outside the model, an outgoing data classifier | These are patterns your own agents need too |
Conclusion
Claude Duet shows where background agents are heading: wide connector access, long-running work and approvals as the main control. Anthropic's choices on credentials and approvals are well documented, but enterprise questions on admin controls, retention and data access are still open. Until they are answered, govern Claude Duet at the identity layer, keep regulated data out of scope and treat every approval prompt as a security decision.
Secure AI Agents in Production with NeuralTrust
Book a demo to see how NeuralTrust gives you visibility and control over the agents your teams build and run.
)
Related reads
- AI Gateway for Agentic AI: MCP and A2A Security
- Human-in-the-Loop AI Agents
- MCP Authentication: OAuth 2.1 Done Right for AI Agents
FAQs about Claude Duet
1. What is Claude Duet?
Claude Duet is a proactive agent app from Anthropic, announced on October 21, 2026 as a research preview. It works in the background across connected apps such as Gmail and Slack, sends a morning brief, and drafts or prepares work on a cloud virtual machine with its own browser. It asks for approval before sending, paying, signing or deleting.
2. Is Claude Duet safe for enterprise use?
Anthropic documents strong credential and approval controls, but as of October 26, 2026 its pages do not describe Team or Enterprise availability, admin controls, retention periods or who can access data. For regulated data, wait for those answers. For everything else, restrict OAuth grants and set an interim policy before employees connect work accounts.
3. Who can use Claude Duet today?
Claude Duet is available by waitlist, starting with US Pro and Max subscribers, on iOS, Android and claude.ai. It is included in those plans and uses the same usage limits as the rest of Claude, and background checks count toward them. Anthropic has not announced availability for other plans or regions.
4. Does Claude Duet see my passwords?
According to Anthropic, no. You type passwords into a form in the Claude app, which encrypts them with a single-use key that exists only on the cloud browser machine. Sign-in tokens stay behind a proxy outside that machine, and the agent holds a placeholder. Duet cannot save credentials to memory.
5. What can Claude Duet do without my approval?
It can read connected accounts, check them every few hours, draft messages and prepare work. Before sending a potentially sensitive message, paying or deleting anything, it shows the exact action and waits for you. Paying or sending money, deleting an order and creating an account cannot be covered by a "don't ask me again" rule.
6. How do I stop Claude Duet from accessing an app?
Switch the app off in your Claude settings; connected apps carry over from Claude, so disconnecting in one place disconnects in both. Access stops from that moment, but what Duet already learned stays until you reset its memory in the app's settings. Add both steps to your offboarding checklist.
7. Can Claude Duet make payments?
Yes, with limits. Purchases use a one-time virtual card from Link by Stripe, limited to that merchant and amount, so your real card number is not shared. Paying always needs your approval. Trading securities and moving money between accounts are blocked even with approval.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- Anthropic, Introducing Claude Duet, October 21, 2026.
- Anthropic, Claude Duet Safety, Privacy, and Security, October 23, 2026.
- Simon Willison, Auto mode post on Claude Code's auto mode and prompt injection results, August 8, 2026.
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, August 3, 2026.
- OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications, December 9, 2025.
)
)
)
)