Anthropic Launches Claude Duet Agent With Approval Controls and Prompt-Injection Risks

Anthropic launched a U.S. research preview of Claude Duet for Pro and Max subscribers, offering a cloud-based agent that monitors connected accounts and prepares business tasks through a virtual machine and browser. Duet requires user approval before sending messages, making payments, signing documents or deleting information; securities trading and transfers between accounts are prohibited. Anthropic says it isolates sign-in credentials from the model and uses automated checks, a dedicated security classifier and system instructions to prevent unauthorized actions and sensitive-data disclosures.

Connected messages and webpages nevertheless expose Duet to prompt injection, and Anthropic acknowledges that its layered defenses cannot guarantee protection. The early version can also misunderstand conversations or misjudge urgency, while approval fatigue and limited visibility into its browser raise oversight concerns. The launch materials provide no independent security measurements, and neither report identifies a specific vulnerability, breach or observed safeguard bypass. Organizations evaluating Duet should limit connected-account access and retain meaningful human review of consequential actions.