The company says Duet can continue tasks after a user closes the app and use connected apps and services to read inboxes, draft replies, make bookings, and run routines.
The system requires approval for actions such as sending potentially sensitive messages, paying, or deleting items. Anthropic says some actions remain unavailable even with approval, including securities trading, moving money between bank accounts, and accessing another person's account. A separate check outside the working model assesses whether an action matches the user's intent; a second classifier reviews outbound messages for potentially sensitive information.
Anthropic says passwords, browser cookies, and sign-in tokens are kept outside the model and its memory. Duet uses a separate cloud browser and fixed browser commands, while a proxy inserts credentials when needed. The company also says its browser requests use a distinct User-Agent header and that it publishes its browsing IP addresses.
The source describes Anthropic's design and testing approach, including red teaming and external penetration testing. It does not provide independent validation, error rates for the classifiers, or evidence that the controls prevent all prompt-injection, privacy, or authorization failures.