How Anthropic keeps Claude Duet away from your passwords and money

Anthropic explained the guardrails on its Duet agent: approval cards plus a separate intent check that runs outside the model, actions it refuses even with your approval (trading, moving money between accounts, using someone else's account), and a classifier that sorts sensitive data into 'never share' and 'needs consent'. Passwords are only unlocked on an isolated cloud browser and sign-in tokens are added by a proxy, so the model never sees them, and purchases use one-time Link cards. These are Anthropic's own claims; only the penetration test was external, and its report isn't public.

Why it mattersThis is a ready-made checklist for any agent you connect to email, banking or client accounts. Ask the vendor two questions: does the model ever see our passwords, and what can't it do even if we approve it?

How we knowCompany figures are labelled as their own claims; anything we couldn't verify is labelled as a report or a claim.