TL;DR Before Claude Duet reaches your enterprise, here’s how security teams should prepare for emerging threats and safeguard their systems.
- Claude Duet is Anthropic’s proactive agent. It runs on its own cloud computer, checks connected apps on a schedule, and acts with the user’s approval. As of October 2026 it is a Pro and Max preview in the US, with Team and Enterprise planned later.
- In a company it becomes a standing identity with an employee’s entitlements, acting unattended.
- Six risks: unattended data movement, an unobservable browser, approval fatigue, cross-app blast radius, no inventory, and memory that outlives the connection.
- Trust3 AI covers Claude Code on Claude Enterprise through Anthropic’s Compliance and Analytics APIs, with nothing installed on developer machines. The same organization-level APIs are the pathway for Duet once Anthropic opens it to enterprise plans.
Claude Duet reviews your inbox and calendar before you wake up, drafts the replies, and pays for an approved purchase with a one-time card. It runs on its own cloud computer, so the work continues after you close the app. When a site has no connector, it opens its own browser, and you cannot watch or take over that browser.
For an individual on a Pro or Max plan, that is the product. Anthropic ships it as a research preview, US only, with Team and Enterprise later.
When Duet arrives on an enterprise plan, it arrives as a standing identity that holds an employee’s mail, calendar, files, chat, CRM, and e-signature access, checks those systems at set intervals, and acts on what it finds from a machine outside your perimeter.
Trust3 AI announced its integration with Claude Code in October 2026. The two products share a shape: an autonomous Claude surface, acting under a person’s credentials, that security could not previously see.
Each Claude release moves more work from the chat window to an agent acting on its own: Claude Code on the developer’s machine, Cowork on the desktop, Duet on a cloud computer the user never sees. Anthropic builds approval prompts and classifiers into each one, and its own research on trustworthy agents says those safeguards are not a guarantee. The enterprise still needs its own layer: an inventory of who is running what, a trace of what each agent touched, and policy enforced at the data it reaches. That layer is what Trust3 AI builds, and Claude Code is its first Claude surface.
What Claude Duet Does
Duet is one thread you message by text or voice. It uses your Claude account’s memory, skills, and connectors, and it reaches out to you rather than waiting for a prompt. Anthropic lists Gmail, Google Calendar, Google Drive, Slack, QuickBooks, HubSpot, Docusign, and Calendly as connectors, plus Stripe, Link, and Shop Pay.
Duet asks before sending messages, making payments, signing documents, or deleting anything. Only you can mark a task complete. Passwords go into a separate form on your device, outside the chat. It names the source email or file behind any figure it gives you. Trading securities, moving money between accounts, and using someone else’s account are off limits even with approval.
Those are user-side controls. They assume the person approving is the right person, is paying attention, and is the only one who should know what the agent did. In an enterprise, none of the three holds by default.
Where Duet Lands in an Enterprise
Each scenario below is the ordinary use Anthropic describes, placed inside a company that has connected the same apps at tenant scale.
| Scenario | What Duet does | What it touches |
| Sales director’s morning brief | Reads overnight email and calendar, drafts replies, flags what needs attention | Every thread in the mailbox, including customer pricing, legal redlines, and HR messages the director was cc’d on |
| Finance lead chasing receivables | Finds unpaid invoices, drafts reminders, prepares payroll for review | Customer payment data, employee compensation, bank-linked accounting |
| Operations manager closing a contract | Gets the contract ready to send | Counterparty terms, signature authority, a legally binding action one approval away |
| Ops lead building a business dashboard | Pulls point of sale, CRM, support inbox, payroll, and bank data into a dashboard that refreshes daily at 5:30 AM | Revenue, customer, and compensation data joined in one view, refreshed on a schedule with no review step |
| Anyone hitting a site with no connector | Opens its own cloud browser, logs in with credentials the user enters | A session on a SaaS tool that no corporate proxy or endpoint agent observed |
The Risks It Exposes
| Risk | Why it is new with Duet | What the enterprise demands |
| Unattended data movement | Duet runs on a schedule from its own cloud computer, so data leaves connected apps while nobody is in the session | Know which records an agent read, when, and what it produced from them |
| An unobservable browser | The user cannot watch or take over Duet’s browser; neither can security | An audit record of what the browser session reached, equivalent to any other egress |
| Approval fatigue | Every send, payment, and signature prompts the user; a busy user approves in bulk | Approval policy set by the organization, enforced before the action, with the user’s tap as the second check rather than the only one |
| Cross-app blast radius | One agent holds mail, chat, files, CRM, and payments at once, with the employee’s full role-based access | Access scoped to the task’s purpose, so a brief-writing job cannot read payroll |
| No inventory | Access is per user, by waitlist invitation, tied to an email address | A live list of which identities run Duet, which apps each has connected, and who owns the account |
| Memory that outlives the connection | Disconnecting an app stops future access but keeps what Duet already learned | Retention and deletion controls on what an agent retains about enterprise data |
You cannot write a retention rule for an agent you do not know is running.
Security Solution for Claude Code and Duet
The integration covers Claude Code, Anthropic’s coding agent, which runs on developer machines and calls tools and MCP servers under the developer’s credentials. On Claude Enterprise, Trust3 AI reads session transcripts, tool calls, MCP server activity, and per-user usage through Anthropic’s Compliance and Analytics APIs, available now. On Claude Team, an admin-pushed OpenTelemetry configuration sends telemetry to the customer’s own collector and S3 bucket, which the Trust3 AI Collector reads; that path is on the roadmap. Both are read-only and install nothing on endpoints.
Each Claude Code user becomes an accountable agent in the inventory with a named owner, plus the MCP servers and tools that user reached. When telemetry stops arriving, Agent DOS reports the missing coverage instead of dropping the data silently.
Duet shares the shape. The Claude Code controls, against each Duet risk:
| Duet risk | Trust3 AI control |
| No inventory | Each user inventoried as an accountable agent with a named owner, plus the MCP servers and tools reached. Shipped for Claude Code on Enterprise. |
| Unattended data movement | Session traces from prompt to tool call to output, retrieved from Anthropic’s APIs rather than the endpoint. Shipped for Claude Code on Enterprise. |
| Cross-app blast radius | Purpose-based access control at the data and tool layer: the morning-brief job gets mailbox read, the receivables job gets invoices, neither gets payroll. Shipped at supported data sources and MCP servers. |
| Approval fatigue | Organization-set policy evaluated before the action at the data and tool layer, independent of the user’s tap. Shipped at the same enforcement points. |
The remaining two risks (unobservable browser and memory that outlives connection) sit on Anthropic’s side of the line for now. Trust3 AI already traces tool and MCP activity from Anthropic’s APIs, so Duet’s browser session is covered the moment Anthropic exposes it. The same APIs carry Duet once it reaches Team and Enterprise.
Questions to Ask Before the Waitlist Email Arrives
- When Duet reaches your plan, who owns each Duet identity, and where does that ownership get recorded?
- What is the approval policy for a payment, a signature, or an external email sent by an agent, and who sets it: the employee or the organization?
- Can you produce, for one Duet task, the records it read and the output it wrote, within an hour of an auditor asking?
- Where does an agent’s browser session show up in your egress records today?
Claude Code reached production codebases before most security teams had a way to see it. Duet will reach every other function the same way, one waitlist invitation at a time.
Let’s chat further here: https://trust3.ai/demo/
Related Articles
