Is Claude Duet Safe? What the Agent Can Reach and Do

Short answer: Claude Duet is designed to ask before it sends, pays, signs or deletes anything, and Anthropic has written that rule down clearly. What it has not written down yet is how long Duet keeps what it reads from your inbox and apps, or anything Duet-specific about training. So the safety question is less about the agent going rogue and more about what you connect to it.

Anthropic opened Duet as a research preview on 21 October 2026. This post sticks to Anthropic’s announcement, the Duet product page and the press coverage, and says plainly where those stop. We have not used Duet, and nothing here is a test result.

What Claude Duet is

Duet is a separate app from the main Claude app, on iOS and Android, and on the web at claude.ai. Anthropic aims it at professionals and small business owners. Each morning it sends a short brief about what needs attention across the apps you have connected, then stays quiet unless something comes up. You can also hand it tasks, from scheduling a meeting to building a dashboard or a forecast.

Three details matter for safety. It runs on its own cloud computer, so a task keeps going after you close your laptop. It carries over the memory, skills and connected apps from your Claude account. And it can use the more than 6,000 connectors and plugins in Claude’s marketplace, with Gmail, Slack, QuickBooks, Stripe, Gusto, HubSpot and Docusign among the examples Anthropic names. TechCrunch reports that it is built on Claude Opus 5.5.

Access is narrow for now. The product page says the waitlist starts with Pro and Max subscribers in the US, and that Team and Enterprise plans are not included yet. Anthropic gave no date for other countries.

What Anthropic documents about control

• —Duet reads, drafts and prepares work on its own. Before it sends a message, makes a payment, signs a document or deletes anything, Anthropic says it shows you exactly what it is about to do and waits for your approval.
• —Some actions are off-limits even with your approval: trading securities and moving money between accounts.
• —Purchases go through Stripe’s Link or Shopify’s Shop Pay. Anthropic says Link pays with a virtual card, so your real card number is not shared, and Link asks you to approve the spend.
• —A dedicated classifier and system prompt are meant to refuse to share the strictest tier of information, which Anthropic says includes card numbers and government ID. Health or personal-finance details are shared only when you explicitly tell Duet to send them.
• —Anthropic says Duet never directly sees your passwords or sign-in tokens, and that approvals, logins and safety checks run in your own cloud computer.
• —You can disconnect any app it has access to.

The approval step is the strongest control here, and it only works if you read what you are approving. An agent that drafts a reply to the wrong client, or a payment to the right supplier for the wrong amount, still needs a person to notice. If checking an AI’s work is new to you, how to check an AI answer when you are not the expert is a practical start.

Anthropic is also candid about the limits. The announcement says Duet might misread a thread or miscalibrate what is urgent, that it checks connected accounts every few hours rather than nonstop, and that it cannot yet show you its browser. Background checks count toward your plan’s usage limits.

What the pages do not say

This is the part that matters if your inbox holds client or employee data. The announcement and product page we read do not cover any of the following, and Anthropic says it will share more about how Duet is designed for safety in the coming days:

• —How long Duet keeps what it reads from your connected apps, or the files on its cloud computer.
• —Whether anything Duet reads is used for training. Both pages point to Anthropic’s general privacy policy rather than a Duet-specific rule, so check the settings on your own plan instead of assuming.
• —What each connector can do once connected: read only, or read and write.
• —How the urgency judgements behind the morning brief are made.

Anthropic does say Duet follows its framework for trustworthy agents, was penetration tested by an outside firm and is covered by its public bug bounty. Those are real commitments. They are not a retention policy.

Should a business connect it?

Not without asking first. Analysts quoted by TechTarget expect large companies to wait months or longer, because agents like this touch confidential data and internal systems. Forrester’s William McKeon-White praised the restraint in how Duet is being introduced. Duet is also only on individual Pro and Max plans for now, so it does not come with the admin controls of a Team or Enterprise plan. If your work account belongs to an employer, that is their decision, not a setting to guess at.

A practical way to try it

1. 01Start with one connected app, ideally one with no client or payroll data in it.
2. 02Read every approval card in full for the first week, including the recipient and the amount.
3. 03Turn down purchases and signing until you have seen how it drafts. Anthropic’s design asks first; your habit should too.
4. 04Look at what its memory carried over from your Claude account, and remove anything you would not want an agent to act on.
5. 05Disconnect any app you stop using. Access you forgot about is still access.

For background on what makes an agent different from a chatbot, AI agent vs LLM explains it, and what happens when an AI agent takes control of a computer covers the cloud-computer idea. OpenAI’s rival asks the same questions, and OpenAI Dots permissions walks through its controls. If you already use Anthropic’s earlier agent, OpenAI Dots vs Claude Cowork compares the two. Anthropic’s data-heavy launch earlier this month got the same treatment in is Claude Dashboards & Motion safe.

Coursium is a mobile app that teaches people to use AI at work, and it is on the App Store. Agents like Duet will keep changing. Deciding what to connect, reading what you approve and checking the output carry over to whatever ships next. If that is what you want to practise, have a look at Coursium.