Anthropic shows how it stops Claude Duet from going rogue

When the agent acts on its own

Claude Duet can monitor accounts, spot opportunities and complete tasks without waiting for instructions. That kind of autonomy is useful, but it raises a question anyone running AI agents has to answer: what stops it from doing something you don't want?

Anthropic has set out the security architecture behind Claude Duet ^[1]. The design is worth reading if you're thinking about letting AI act on your behalf, because the risks are concrete and the safeguards matter.

Think of it like this. A hotel key card opens your room, but not the safe. Even someone with your card can't get to what's in the safe without the combination. Claude Duet works the same way: the agent can see your account, but the parts that matter most are locked behind separate approval.

What the agent can and can't do

Claude Duet has three levels of action ^[1]. It can read information and suggest next steps. It can carry out simple tasks, like replying to an email or organising a calendar. And it can take sensitive actions, such as sending money or approving a contract, but only if you explicitly approve each one.

That approval layer is the first safeguard. The system is built so the agent can't skip it. Sensitive actions are defined in advance, and the list can be adjusted.

Keeping credentials out of reach

The infrastructure separates credentials from the model ^[1]. The agent doesn't hold your passwords or API keys. When it needs to act, it asks a separate service for temporary access, and that service checks whether the action is allowed.

If the model itself were compromised, an attacker couldn't pull credentials from it. They aren't there.

Checking for leaks before anything goes out

Every output is scanned for confidential information before it leaves the system ^[1]. The checks look for patterns like account numbers, API keys and personal details. If something sensitive shows up, it's redacted or the output is blocked.

That's the second layer. The agent can't accidentally send your bank details to someone else, because the filter sits between the model and the action.

Logs you can audit

Every action is logged ^[1]. The log includes what the agent did, when it did it, and whether it needed approval. That gives you a record to check later, or to hand to an auditor if you need to show what happened.

Under the AI Act, high-risk systems must log events for the lifetime of the system, starting from 2 December 2027 for systems in Annex III ^[2]. Claude Duet isn't necessarily high-risk, but the logging duty will apply to many agents that make decisions about people or handle sensitive tasks.

What this means for you

If you're building or buying an AI agent, here are three things to ask:

• Which actions need approval, and can the agent bypass it?
• Where are credentials stored, and can the model reach them?
• What gets logged, and who can check the logs later?

The answers to those questions tell you how much you're trusting the agent, and how much you can check.

Sealing the log so it stays unchanged

Logs are useful if people can trust them. That's harder than it sounds when the organisation keeping the log could also edit it.

Here, the thing to seal is each action record as it's written: the task, the approval status, the outcome and the time. Sealing takes a fingerprint of the record, not the record itself, so the log never leaves your systems. If something is questioned later, anyone you share the record with can check that it's the one written at the time.

A fingerprint tells you whether two things are identical, not what they say. You can't rebuild a log entry from it, just as you can't rebuild a person from a thumbprint. Change a single character in the log and the fingerprint won't match.

That's what WitniumChain does: it seals the fingerprint on a chain where any later change would show, even one made by us. To check, you calculate the fingerprint again and compare it with the sealed one.

What it shows is that the record hasn't changed since it was sealed. What it doesn't show is that the action was authorised, correct or lawful.

You can seal log records as they are written, with the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free.

How it would work

1. Your system writes an action record to the log and sends a fingerprint of it to WitniumChain.
2. WitniumChain seals the fingerprint and returns a witness ID.
3. When someone asks what the agent did, you calculate the fingerprint of the log entry again. If it matches, nothing has changed.

What to watch

Article 12 of the AI Act applies from 2 December 2027 for high-risk systems in Annex III, which covers systems used for assessing people in areas like employment, credit and law enforcement ^[2]. Article 26 adds an extra duty: when a high-risk AI system is used, the user must keep logs ^[3].

If your agent falls under those rules, the question isn't just whether you log events. It's whether the logs will hold up when someone questions them.