Claude Duet Proactive Agent Launches With Built-in Approval Workflows

Anthropic has launched Claude Duet, a proactive artificial intelligence agent designed to manage tasks across connected applications without requiring local computer access. According to MacRumors, the service functions as a standalone product available in research preview, targeting professionals and small business owners who need assistance tracking complex administrative duties. The agent utilises a virtual machine with its own browser to complete work in the cloud.

Root cause

The design philosophy behind Claude Duet addresses the need for autonomous task completion while maintaining strict user control over sensitive operations. Anthropic built the agent around the Opus 5.5 model, enabling it to process information from multiple connected apps and generate daily briefings. The system incorporates memory and skills from an existing Claude account, reducing setup complexity for users who already maintain a subscription.

Attack path

MacRumors reports that Claude Duet operates proactively by checking applications every few hours and alerting users when attention is required. While the agent can execute simple administrative tasks or complex projects like building web applications independently, it pauses for human intervention before performing high-impact actions. This includes sending messages, processing payments, signing legal documents, or deleting files, ensuring users retain final authority over critical decisions.

Affected versions

Claude Duet is built upon the Opus 5.5 model and is currently available as a research preview. Access is restricted to Pro and Max subscribers located in the United States, with entry granted through a waitlist. The service is accessible via web browsers or a dedicated iOS application, utilising existing plan limits for background checks and interactions.

Mitigation

• Verify that user approval workflows are functioning correctly for all sensitive actions.
• Ensure connected applications do not expose credentials to the agent’s virtual environment.
• Monitor daily briefings to confirm the agent’s suggestions align with business objectives.
• Review the safety system prompts and classifier settings to prevent data leakage.

Why it matters

Security teams must understand that proactive agents operate with persistent access to user data and connected services. Unlike reactive tools, these systems continuously monitor environments and can initiate actions without immediate human prompting. Teams usually verify that approval mechanisms are robust and cannot be bypassed. Check whether the agent’s virtual machine is properly isolated to prevent lateral movement. Ensure that sensitive information is not inadvertently exposed through the agent’s context window or memory functions.

Background: Lateral movement

Isolate compromised hosts immediately to stop the spread. Preserve forensic evidence before wiping drives. Reset credentials and patch vulnerabilities. Review access logs to map the full extent of the breach. Implement strict segmentation to limit future movement. Notify legal and regulatory bodies as required by law.

Read the full guide: Lateral Movement Response: Containment, Recovery and Prevention Steps

What to do and how to stay safe: Anthropic

• Review the approval settings for all connected applications to ensure sensitive actions require explicit consent.
• Monitor the agent’s activity logs for any unexpected attempts to sign documents or process payments.
• Verify that the virtual machine environment is isolated from internal corporate networks.
• Confirm that the safety classifier is correctly configured to detect and block sensitive data leaks.

Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Claude Duet require a new subscription or does it use existing limits?

Claude Duet uses existing Claude plan limits, and its background checks count toward those limits.

Can Claude Duet access passwords or login credentials from connected accounts?

No, Claude Duet does not see passwords or logins when given access to accounts.

Is Claude Duet available globally or are there restrictions?

Access is limited to Pro and Max subscribers in the United States via a waitlist.