Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Is Claude Duet Safe to Use for Work?
No, not on work accounts whose pages or connected apps carry sensitive data: Anthropic says Duet asks before it "sends a message, makes a payment, signs a document, or deletes anything", not what keeps page or email values from the model. Check what the model receives from each screen, who approves and what record exists before connecting one.
No, not on work accounts whose pages or connected apps carry sensitive data. The owner of a small business who connects Claude Duet to the company mailbox and asks it to chase an overdue invoice is handing the model the invoice record, the customer's contact details and whatever else the invoicing app and the inbox render while it works. Anthropic's pages are specific about the actions Duet takes: it waits for approval before it sends, pays, signs or deletes, refuses some actions even when approved, routes a typed password through a separate form, pays with a one-time card without being given the full card number, and runs a classifier over each outgoing message for leaks of sensitive information, and every one of those acts after the model has read the page. None of the pages says what keeps the customer's name, balance and payment history away from the model once the invoice is open, and Duet works in a cloud browser the account holder cannot watch. So the answer is no as shipped, and it changes only with a control on the rendered screen: values replaced before the model reads them, a named person approving each action, and a record of what the model received. Duet is also a US research preview for Pro and Max accounts and is not yet on Team or Enterprise plans, so the work question is being asked today of a personal subscription. The invoice reminder is worked through below to show what reached the model at each step and who approved what.
Key findings
- For Claude Duet to be safe on those accounts, the values on an invoice page, in an email or in a connected app would have to be replaced with consistent tokens such as CUST_001 before the model reads them, with the real values resolving only at the approved destination at the moment of an approved action (What Is Render-Layer Tokenization?).
- It would also require a named person approving each payment, submission and record change for the organization, and a record it holds of every screen the model received, every action and every approval (What Is Supervised Delegation?).
- Anthropic's Duet pages describe approvals, refusals, a separate password form, one-time cards and a classifier on outgoing messages; they do not state what keeps the values on a page, in an email or in a connected app away from the model (Anthropic, Get started, 2026).
- Anthropic's launch post states that "before it sends a message, makes a payment, signs a document, or deletes anything" Duet "waits for your approval", and that "A few things are off-limits even with your approval", controls on the action rather than on what the model read before proposing it (Anthropic, Introducing, 2026).
- The Link by Stripe page states that "Claude isn't given your full credit card number (PAN) or bank account number", the one place the pages say what the model is not given, and it covers saved payment methods in Link rather than the invoice, email or app content Duet reads (Anthropic, Link by Stripe, 2026).
What does Claude Duet receive from a connected app or a rendered page?
Take the overdue invoice as the record: the owner connects the company mailbox and the invoicing app and asks Duet to draft a reminder to the customer. Duet "works on its own computer in the cloud, so it can keep working after you close the app", and that "You can't watch Claude Duet work in its browser or take over the browser" (Anthropic, Get started, 2026). So the invoice page opens on a machine the owner never sees, and the model reads it there: the customer's name, email, billing address, the amount owed, the payment history and the notes column. Duet was not among the products in the review, and the wider field offers context: 7 AI agent products from 5 leading vendors say in their own documentation that prompt injection risk remains despite safeguards (How Many AI Agent Vendors Publish a Prompt Injection Rate?).
What the pages say about the model's view concerns provenance rather than scope: "When it gives you a number or a summary, it tells you which email, file, or spreadsheet it came from", which confirms the source was read in full (Anthropic, Get started, 2026). The one place the pages state what the model is given is the payment integration, scoped to saved payment methods: Duet "can see the card type, last four digits of your card or bank account, nickname and expiration date of your saved payment methods, plus your shipping addresses" (Anthropic, Link by Stripe, 2026).
The owner chose one customer and one email; the model received the whole record plus every message the inbox search returned, since an agent reading a rendered page takes in the whole page, as a computer-use agent perceives a screen (Does an AI Agent See Everything on Your Screen?), and the way Anthropic's own browser extension captures whatever a tab shows (What Can Claude in Chrome Access in Your Browser?). Nothing on the invoice page is replaced before the model reads it, and every later control inherits that fact.
Do the approval prompts and the outgoing-message classifier make Duet safe for work?
They narrow what Duet may do and leave what the model has read unchanged. Duet "is designed to ask before it sends a message, makes a payment, signs a document, or deletes anything", that "Some actions are off-limits even with your approval, such as trading securities, moving money between accounts, or accessing someone else's account", and that a password is typed "into a separate form on your device" that "sends it straight to the browser, which is designed to keep it out of your chat with Claude Duet" (Anthropic, Get started, 2026). The owner approves the reminder before it goes; the draft came from a record the model had already read.
The launch post describes a "new dedicated classifier and safety system prompt that checks each message and guards against leaks of sensitive information", "designed to reject requests to share the strictest tier of information, including credit card numbers and government identification", while health or personal finance details "are let through only when you've explicitly instructed Claude Duet to send it" (Anthropic, Introducing, 2026). The customer's balance was in the model's context before the check ran; the check decides whether it leaves in a message.
The credential controls end at the login. The launch post says Duet follows the Managed Agents design "so it never directly sees your passwords or sign-in tokens", a design whose write-up states that "The harness is never made aware of any credentials" while the data a tool call returns still reaches the model (Anthropic, Introducing, 2026; Anthropic, Managed Agents, 2026). The page the password unlocks renders to the model as before, the shape found wherever an agent's controls govern what it does and leave what its model reads to the connected app (Is It Safe to Let ChatGPT Work Access Sensitive Company Data?).
What do the vendors themselves say?
Anthropic's Duet pages are the primary record, and each states where its control acts. The product page says "Approvals, logins, and safety checks run in your own cloud computer, so sensitive details stay private", and that "You can see what Claude Duet has done and is doing for you, and steer it", statements of where the checks run and what the account holder is shown, neither of which says what the model reads from a page or a connected app (Anthropic, product page, 2026). On scope, the help center says "It isn't available on Team or Enterprise plans yet, and we plan to bring it to those plans later", that "Claude Duet is available in the US only during the research preview", and that "Disconnecting an app stops Claude Duet from accessing it from that point on, but memory of past information from earlier conversations is kept" (Anthropic, Get started, 2026).
| Dimension | Anthropic, per its documentation | What a buyer should verify |
|---|---|---|
| What the model receives | Figures are traced to the email, file or spreadsheet they came from; for Link, the card type, last four digits, nickname, expiration date and shipping addresses, never the full card number | Which values on an invoice page, in an email or in a connected app reach the model, field by field |
| Consequential actions | Asks before it sends a message, makes a payment, signs a document or deletes anything; some actions refused even with approval | Who other than the account holder can approve, and whether the approval is kept |
| Outgoing messages | A classifier rejects the strictest tier, such as card numbers and government identification; health and personal finance pass only on explicit instruction | What the model held before the check ran, and whether a customer's data counts as the strictest tier |
| Credentials and payment | Passwords typed into a separate form on the device; one-time card per purchase, scoped to merchant and amount | What the pages after login show, since the control ends at the login step |
| Visibility | Runs on its own cloud computer; the browser cannot be watched or taken over; the user can see what Duet has done | What an auditor can be shown for one run, screen by screen |
| Plan scope | Pro and Max in the US during the research preview; Team and Enterprise not included yet | Which contract and admin controls apply to a personal subscription used for work |
Read together, the documented controls govern the action, the login, the payment and the message, and the account holder is the person every approval and view is addressed to. An employer-held record of which screens the model received is not described in the pages reviewed. For the invoice reminder, that leaves the owner with a clear account of what Duet did and no statement of what the model took from the invoicing app and the inbox to do it.
What happens when an email or page Duet reads carries hidden instructions?
The help center says that "Claude Duet reads content written by other people, such as email and web pages, and that content can contain instructions meant to mislead it", and that "no defense is perfect, which is one reason consequential actions need your approval" (Anthropic, Get started, 2026). The computer use documentation carries the same warning for the tool class, "In some circumstances, Claude follows commands found in content even when they conflict with your instructions", and advises users to "Take precautions to isolate Claude from sensitive data and actions to avoid risks related to prompt injection" (Anthropic, Computer use, 2026).
The research record says the defense will not hold every time: the StepJack benchmark found that, "averaged over the five CUAs that can reliably follow the reference chain (all but EvoCUA-32B), ASR rises from 31.3% at single-step to 36.9% at three-step", on a synthetic benchmark of 480 examples rather than a live-web measurement (Zhan et al., 2026). The auto mode classifier the launch post names as Duet's action safeguard was built so that "The classifier sees only user messages and the agent's tool calls; we strip out Claude's own messages and tool outputs, making it reasoning-blind by design", so it does not see the injected email either; it judges the proposed action (Anthropic, auto mode, 2026).
For the reminder, a customer email asking for the full statement to be forwarded to a new address meets a model holding the invoice record, the customer's contact details and the owner's inbox, with a send that waits on an approval the owner may grant quickly on a long task. What the attacker gets is bounded by what the model holds, which is why a token-only agent gives an injection far less to collect (What Does Prompt Injection Get From a Token-Only Agent?). The success rate decides how often the gate is tested; what the model was shown decides what passes when it fails.
What should a security team ask for in writing before approving Duet?
A request to use Duet for work will usually come from an individual with a personal subscription, and the approval memo should still answer five questions in writing.
- What does the model receive from each rendered screen and each connected app, and which values are replaced before the model reads them? The pages answer the first part and leave the second open, so record the whole invoice record and inbox as the exposure.
- Who approves a consequential action, and does the approval reach anyone beyond the account holder? The help center describes an approval the user grants; an employer needs a named approver whose decision is kept.
- What record exists of one run, screen by screen? The product page says the user "can see what Claude Duet has done and is doing", and the browser cannot be watched, so ask what an auditor could be shown for the reminder task (Anthropic, product page, 2026).
- What happens to data after an app is disconnected? The help center says memory from earlier conversations is kept, so ask what it holds and who can clear it.
- What does a successful injection collect, and does the outgoing-message classifier treat a customer's balance as the strictest tier when the data belongs to a third party rather than the account holder?
Anthropic's own guidance places the first question with the customer: "we encourage our customers to think carefully about which tools and data they provide to an agent, which permissions they grant" (Anthropic, Trustworthy, 2026). The memo would note that the vendor answers questions two through four for the user's side only, and that a personal subscription on a company mailbox sits outside any Team or Enterprise administration. Written down, the five answers are the baseline for re-reading the same agent when it reaches those plans.
What does a governed environment change?
A governed environment changes the first answer, and the other four follow. Values a policy names on the invoice page, the customer's name, email, address and balance, are replaced with consistent tokens on the rendered screen before any model reads it, so the same customer appears as CUST_001 in the invoicing app, in the inbox search and in the drafted reminder, and the model composes on the token. The real value resolves only at the approved destination at the moment of an approved action: the reminder goes to the customer's real address when a named person approves the send, and a value the model never held cannot be carried out by a summary, a message or an injected instruction. Every screen the model received as tokens, every action and every approval is written to a record the organization exports to its own logging.
Applied to the reminder, the amount and the due date reach the model because the task needs them, the customer identifiers reach it as tokens, and the approval moves from the account holder alone to a named person acting for the business. The vendor's controls keep their place, and the classifier still checks the outgoing message, which was drafted from tokens and so gives it far less to decide. The same control class answers the question for any agent that reads a work screen, whether it runs in the person's own browser or on a cloud machine (Should an AI Agent Use the Employee's Own Browser?), and it is what lets an organization move from experimenting with agents to running them on customer data (What Is the PII Wall?). For a team weighing Duet, it answers the memo without waiting on the vendor's documentation.
What the record shows
No, not on work accounts whose pages or connected apps carry sensitive data, because nothing in the vendor's pages says what the model receives from a rendered screen. What the model receives, who approves the action and what record remains decide the question, and the pages settle the first by what they describe: approval before a send, a payment, a signature or a deletion, refusals, a separate form for passwords, one-time cards, a classifier on outgoing messages, and a payment integration that withholds the full card number. None of them says what keeps the invoice record or the inbox away from the model, and the browser runs on a cloud machine the account holder cannot watch. The answer changes when values are replaced on the rendered screen before the model reads it, a named person approves each action, and a record of what the model received exists. The test is short: name one customer record and one reminder, and after the run list every field the invoice page and the inbox showed beside the fields the reminder used; the difference is what the approvals never covered.
Methodology and limitations
This page rests on Anthropic's documentation for Claude Duet (the launch post, two help center pages and the product page), three Anthropic research write-ups the launch post draws on, the computer use tool reference and one preprint benchmark of computer-use agents, read in full. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read between October 22, 2026 and October 23, 2026, and each Sources line carries the date for its page.
The products on this page are described from documentation and none was tested for this page; "not described" means the pages reviewed, vendor features change, and the page carries its date; the vendor calls Duet a research preview. RedactSure is deploying now with enterprise and government customers. The invoice reminder describes a record type, not an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing on this page replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Is Claude Duet safe to use for work?
No, not on work accounts whose pages or connected apps carry sensitive data, because Anthropic's pages say Duet asks before it sends, pays, signs or deletes, refuses some actions even with approval, takes passwords through a separate form, pays with one-time cards and checks outgoing messages with a classifier, and none of them says what keeps the values on a page or in an email from the model. The answer changes when those values are replaced before the model reads them, a named person approves each action and a record exists.
What does the model receive from an invoice page or a connected email account?
Whatever the page or the app returns, as far as the pages state. The help center says Duet tells you which email, file or spreadsheet a number came from, which confirms the source was read rather than limiting what was read. The one scoped statement is the payment integration: for Link, the model sees the card type, last four digits, nickname, expiration date and shipping addresses and is not given the full card number. Nothing comparable is stated for page or email content.
Who approves what Duet does, and does that approval reach an employer?
The account holder approves, and the pages describe no route to anyone else. Duet shows what it is about to do before it sends a message, makes a payment, signs a document or deletes anything and waits for approval, and some actions are refused even when approved. That approval is a safeguard for the person who asked. An employer who needs a named approver whose decision is kept would have to supply one from the environment the agent runs in.
Does the outgoing-message classifier change what the model reads?
No. It checks each message on its way out. The launch post says the classifier is designed to reject requests to share the strictest tier of information, credit card numbers and government identification among it, while health and personal finance information is let through when the user has explicitly instructed Duet to send it. The customer's balance and history were in the model's context before the check ran. The classifier decides what a message may carry, after the model has already read the record it was drafted from.
What record exists of what the model read during a run?
Not from the pages reviewed. The product page says you can see what Duet has done and is doing and steer it, and the help center says you cannot watch its browser or take over. Neither describes an exported, screen-by-screen record of what the model received that an auditor could hold. Ask for that record from the environment before the agent touches any account with regulated data.
Can a company use Duet on Team or Enterprise plans today?
No. Both the product page and the help center say Team and Enterprise plans are not included yet, with the plan to bring Duet to them later, and the preview is US only for Pro and Max users. A request to use Duet for work therefore means a personal subscription connected to company mail or apps, outside any administration those plans would carry. Treat it as a personal tool reading company data until the plan scope changes.
How RedactSure Keeps Customer Records Out of Duet's Model
An agent drafting a reminder from an invoice reads the whole customer record before any approval, refusal or outgoing check runs. Anthropic's help center says no defense is perfect, which is one reason consequential actions need your approval.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: the invoicing app rendered the customer's name, address, balance and payment history to the model on a cloud machine the owner could not watch. Inside the governed environment: the page renders CUST_001 and ACCT_001 in their place, the model drafts on the tokens, the real address resolves only at the send when a named person approves it, and every screen, action and approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Whether Duet belongs on a work mailbox turns on what the model read before any approval ran. Bring one customer reminder your team sends and see, with test values, the page as the model receives it, the approval and the record. Book a demo