The AI Assistant That Asks Permission Before It Spends Your Money Has Arrived

A new kind of AI assistant is designed to keep working after you step away, while pausing for your approval before it sends a message, pays, signs, or deletes something. That raises a practical question for anyone thinking about linking an AI tool to money: what should it be allowed to do, and what should remain off-limits?

Anthropic introduced Claude Duet as a research preview on October 22, 2026. The most useful part of its announcement may be the boundaries it describes. In particular, Claude Duet will not trade securities or move money between accounts, even with a user’s approval.

The blocked list is the real design. That choice offers a useful starting point for households: decide what an agent must never do before you connect accounts or face a rushed decision.

Quick Answer

Claude Duet is a proactive AI agent that can read connected apps, prepare work, and continue working while you are away. Anthropic says it requires approval before sending a message, making a payment, signing a document, or deleting something. It also says the agent cannot trade securities or move money between accounts, even with approval.

For consumers, the broader lesson is to set limits in advance. Keep reading access separate from permission to act, and maintain a written list of actions no agent may take.

Knowledge Snapshot

• Product: Claude Duet, a research preview available on iOS, Android, and claude.ai.
• Access: Waitlist for Pro and Max users in the United States; it shares the plans’ existing usage limits.
• Controls stated by Anthropic: Approval before messages, payments, signatures, and deletions; securities trading and transfers between accounts are blocked.
• Purchase flow: With Link, the user approves the spend in the wallet before a virtual card is used. Online checkout through Shop Pay is also supported.
• Important caveat: Anthropic says the early version may misread a thread or misjudge urgency. ATMC has not tested it.

What Claude Duet says it can do

Claude Duet is built around Claude Opus 5.5. Anthropic describes it as an agent that sends a short morning brief, flags items that need attention, and handles tasks across connected apps. It checks connected accounts every few hours rather than continuously, because more frequent checking would use the plan’s limits faster.

The agent has its own virtual machine and browser, so the user’s phone or computer does not need to stay on while it works. Anthropic says Claude Duet can use more than 6,000 connectors and plugins in its marketplace.

For users, that can mean less time chasing routine work. But connecting more apps can also widen what the agent can access. The sensible question is not only “What can it do?” It is “What access does this task actually require?”

Write your blocked list before connecting anything

A blocked list is a rule set of actions an agent may not take, even if it asks and you approve. Write it down before you are hurried, distracted, or dealing with a persuasive prompt.

Start with this list:

• Trading securities or moving investments: An automated investment action can create losses, fees, or tax consequences. Anthropic says Claude Duet blocks securities trading.
• Moving money between accounts: A transfer can affect bill payments, overdraft risk, or savings plans. Anthropic says this action is blocked, even with approval.
• Sending money to a new or unknown payee: A mistaken name or payment instruction may be difficult to reverse.
• Using standing authority over a primary bank account: Broad ongoing access is harder to supervise than a one-time, clearly defined task.
• Opening or closing accounts, changing beneficiaries, or taking on debt: These choices can have lasting financial and legal effects. Keep them under your direct control.
• Sharing full account credentials or one-time codes: These details can give someone direct access, not just permission to complete a limited task.
• Signing on your behalf: An agent may prepare a document, but you should review it and provide your own signature.

Some of these are Anthropic’s stated product restrictions. The rest are household guardrails to consider, not claims about Claude Duet’s settings. For related context, see ATMC’s coverage of AI agents for money management and limits for agents connected to bank accounts.

A practical permission plan for any AI agent

1. Separate what it can read from what it can do

Reading a calendar is not the same as sending an email. Reading a bill is not the same as paying it. If a service offers different access levels, grant only what the specific task needs.

For example, an agent might summarize upcoming bills without permission to change bank details or submit payments. Do not treat “connect my account” as a single, harmless choice. Ask what information it can see and what actions it can take.

2. Require approval for actions you cannot easily undo

Anthropic says Claude Duet reads, drafts, and prepares work on its own, but waits for approval before it sends a message, makes a payment, signs a document, or deletes anything. That pause matters because some mistakes cannot be cleanly reversed.

Before approving, check the recipient, amount, destination, and exact content. An approval request is a chance to inspect the action, not a reason to click through automatically.

3. Understand what the agent can see

Anthropic says Claude Duet’s credential handling follows the design used for Claude Managed Agents, so the agent does not directly see passwords or sign-in tokens. It also says a dedicated classifier and safety system checks messages for sensitive information.

According to Anthropic, that system is designed to reject requests to share the strictest tier of information, including credit card numbers and government identification. Health or personal financial information may be sent only when the user has explicitly instructed Claude Duet to share it.

That distinction is useful, but it is not a reason to connect every account. Credentials, account content, and permission settings are different things. Even if an agent does not see your password, it may still be able to access information through an authorized connection.

4. Use a virtual card for purchases when available

Anthropic says users can ask Claude Duet to purchase items for a business through Link, Stripe’s digital wallet. Claude Duet confirms the item with the user, Link asks the user to approve the spend, and the purchase uses a virtual card rather than sharing the real card number. The agent can also check out through Shop Pay.

A virtual card changes what a merchant receives. If the merchant is later compromised, it does not have your primary card number from that transaction to reuse. This reduces exposure of the real card details. It does not eliminate the possibility of a wrong purchase, a dispute, or other checkout problems.

5. Review connections and keep an exit route

Anthropic says users can disconnect any app Claude Duet can access. Check connected apps regularly and remove tools you no longer use.

Before enabling an agent, also find out how it contacts you and how you can stop or pause its work. Keep control of the account used to reach you, and make sure an approval request cannot quietly turn into a standing permission.

What the product announcement does not prove

Claude Duet is a research preview, not evidence that AI agents in general are safe to connect to financial accounts. Anthropic says this early version may misread a thread or misjudge what is urgent. It also says the product is designed mainly around work, so personal errands such as booking tickets are not as strong, and its browser is not yet visible to users.

Anthropic says the product draws on its framework for trustworthy agents, uses an action classifier and defenses informed by browser-use research, and has been red teamed and externally penetration tested. It is also covered by a public bug bounty program. These are published design claims, not a guarantee that every risk has been removed.

Availability is limited to U.S. Pro and Max users who join a waitlist. During the preview, background checks and larger tasks use the same plan limits as the rest of Claude. For additional context on setting permissions and credentials, read ATMC’s agentic banking security rules. For independent reporting on the launch, see The Verge’s coverage.

Frequently Asked Questions

Can an AI agent spend my money?

Some AI agents can help complete purchases or other payment tasks, depending on their design and the access a user grants. In Anthropic’s stated Claude Duet flow, the user approves the item and the wallet separately requests approval before the spend.

What should I never let an AI agent do?

Consider prohibiting securities trades, transfers between accounts, payments to new or unknown payees, account changes, and signing documents on your behalf. Do not give an agent full credentials, one-time codes, or standing authority over a primary bank account.

What is a one-time virtual card?

It is a payment credential used for a particular purchase rather than exposing the user’s real card number to the merchant. Anthropic says its purchase flow uses a virtual card so the real card number is not shared.

How do I keep an AI agent from seeing my passwords?

Use a service that clearly explains how it handles credentials, and never paste passwords or one-time codes into a chat. Anthropic says Claude Duet never directly sees passwords or sign-in tokens, but that claim does not mean every AI service handles credentials the same way.

Is it safe to let an AI agent access my accounts?

There is no general yes-or-no answer. Review what the agent can read and do, require approval for consequential actions, keep a written blocked list, and disconnect apps you no longer need. A product announcement or security test is not proof that all risks are gone.