Claude 产品博客Source publication:
Loading content…
Anthropic has published the safety design behind Claude Duet, a personal agent still in research preview that uses a cloud computer to read inboxes, draft replies, book things and run routines after the app is closed. Before sending a potentially sensitive message, paying or deleting anything, it shows the action, destination and every recipient and waits for approval. Passwords, browser cookies and sign-in tokens never enter the model, and a safety classifier separate from the main model checks outgoing messages for sensitive information. Anthropic says these safeguards will still occasionally miss or over-flag, so they run alongside the approval mechanisms.
The personal agent is being designed as a system that needs its own security layer rather than trusting the model to police itself. Claude Duet runs continuously after the user closes the app, reading inboxes, drafting replies, booking things and running routines while the user is away. Anthropic had already published a framework for safe and trustworthy agents and argued that no single defense is enough and that protection inside the model cannot stand alone; Claude Duet keeps credentials separate from the agent as Claude Managed Agents does, then adds the protections an agent acting for a person needs. Anthropic says its team runs Claude Duet on its own accounts and uses it for work every day, and that testing began well before the research preview and continues.
Consequential actions are stopped for user confirmation, and an automated check outside the working model judges whether an action matches the user's intent. Before sending a potentially sensitive message, paying for something or deleting anything, Claude Duet shows the action, the destination and the content, including every recipient, then waits for approval. That check is built on the auto mode classifier from Claude Code and extended for Claude Duet, and it runs outside the model doing the work so instructions hidden in a page cannot affect the outcome. Trading securities, banking actions such as moving money between accounts, and accessing someone else's account stay off-limits even with approval; paying or sending money, deleting an order and creating an account are not covered by a don't-ask-again rule, and routines that run while the user is away carry the same safeguards.
Credentials and the browser sit where the model cannot reach them, and the agent drives the browser only through a fixed set of commands. The user types a password into a form inside the Claude app, which encrypts it with a single-use key that exists only on the secure cloud browser machine, and the browser types it into the site without the model seeing, saving or repeating it. Sign-in tokens for connected services follow the Claude Managed Agents design: a placeholder sits in the machine where the agent works, and a proxy outside that machine inserts the real value only as a request is made. The browser runs in its own dedicated virtual machine in the cloud, separate from the model and from the cloud computers the agent works on; site code and cookies do not reach Claude Duet's memory or connected apps, the agent's commands cannot read cookies out of the browser, and only page text and downloads come back.
The design targets individual users of the Claude Duet research preview and covers four parts: approvals, sensitive-information classification, credential isolation and browser isolation; Anthropic says it will keep adjusting as it learns from the research preview.
Anthropic states that these safeguards will occasionally miss something or flag a harmless message, and that the calibration of approval frequency, the sign-in method and the accuracy of the sensitive-information checks are all still changing.
