Claude Duet Is Here, and Banks Are Locking Out AI Agents: How to Use a Personal Agent Safely

Anthropic’s Claude Duet joins OpenAI’s Dots and Meta’s Muse as always-on personal agents, just as US banks start blocking agents that log in with shared passwords. Here’s what changed this week and how to hand over tasks, not keys.

[email protected]

Oct 24, 2026, 8:38 AM6 min read

Illustration of a phone showing a bank app warning that reads Access blocked: AI agent detected

The AI agent you text like a coworker has officially arrived. On 21 October 2026, Anthropic opened a research preview of Claude Duet, a standalone app that watches your connected apps, sends you a morning brief and keeps working in the background. It joins OpenAI’s Dots and Meta’s Muse in a fast-growing category: personal agents that don’t wait for a prompt.

But the same week showed the catch. The day after Duet’s debut, Axios reported that major US banks were finding unvetted AI agents inside customer accounts, and that several were moving to block them. Hours later, 1Password launched a product designed to let agents sign in without ever seeing your password. Put together, these three stories are the clearest picture yet of where personal agents are, and how to use one without handing it the keys to your life.

Timeline infographic: 13 Oct JPMorgan's Jamie Dimon says outside agents won't get in; 21 Oct Anthropic opens Claude Duet preview; 22 Oct banks restrict third-party agents; 22 Oct 1Password for Agents launches — The week personal AI agents met the bank vault.

What Claude Duet actually is

Anthropic describes Claude Duet as a proactive agent that “comes to you with what needs your attention, completes tasks you ask of it, keeps working even when you step away, and checks with you before it acts on your behalf.” It’s aimed at professionals and small business owners, and it runs on Anthropic’s Opus 5.5 model.

Instead of a chat window you open when you remember to, Duet lives in one ongoing message thread. According to Anthropic, it sends a short brief each morning on the most important items across your connected apps, then messages you during the day only when something needs you. It works on its own computer in the cloud, with a browser, using apps you connect. Reuters reports it integrates with more than 6,000 connectors in the Claude Marketplace, including Gmail and Slack, and can make purchases via Stripe’s Link wallet and Shopify’s Shop Pay.

Anthropic’s help center says Duet is designed to ask before it sends a message, makes a payment, signs a document or deletes anything. The Verge reports it also uses a dedicated classifier and safety system prompt designed to refuse requests to share the most sensitive information, such as credit card numbers.

Access is limited for now. Duet is a waitlisted research preview for Pro and Max subscribers in the US, available on iOS, Android and claude.ai. It’s included at no extra cost during the preview, but it shares your plan’s usage limits, and Anthropic notes that its background checks count toward them. Team and Enterprise plans aren’t supported yet.

Anthropic is also candid about the rough edges. The company says Duet “still might misread a thread or miscalibrate what’s urgent,” that personal errands like booking tickets “aren’t quite as strong,” and that it can’t yet show you its browser.

A crowded field of always-on agents

Duet isn’t alone. Reuters notes that OpenAI launched always-on “dots” agents last month that pursue user goals across apps such as Slack and Microsoft Teams, and that Meta’s Muse drew millions of downloads. The Verge framed Duet as Anthropic’s answer to both.

The common thread is a shift from answering questions to acting. These agents read your inbox, watch your calendar, move through websites and, increasingly, spend money. That’s exactly what makes them useful, and exactly what makes the next part of the story matter.

Banks are slamming the door on shared passwords

On 22 October, Axios reported that major US banks were detecting unauthorized third-party AI agents operating inside customer accounts, with some agents attempting actions that appeared independent of user instructions, such as contacting call centers. In most cases, according to Axios, the agent got in because the customer handed over their own login.

Axios reported that Morgan Stanley has begun blocking third-party agents, and that JPMorgan, Bank of America and Citi are also restricting them. Citi told USA Today it does “not permit third-party AI agents or assistants to log into a customer’s account or transact directly” on its digital banking platforms. A Morgan Stanley spokesperson told Axios the bank hasn’t observed “rogue AI agents accessing our platforms.”

JPMorgan had already drawn the line. On the bank’s third-quarter earnings call on 13 October, CEO Jamie Dimon said, as reported by CNBC, “We’re not going to allow just any … outside agent to come in inside the company, because it’s just too risky for clients and for JPMorgan.” A JPMorgan spokesperson later told Axios: “Under no circumstance should customers share passwords with any person or thing. Period.”

There’s a sting in the tail for users, too. Reuters reported that transactions made with credentials a customer shared themselves cannot be deemed unauthorized. If your agent makes a mistake with your banking login, you may have a harder time arguing it wasn’t you.

The direction banks are heading, per Axios, is read-only access through approved open-banking connections. That lets an agent see balances and transactions without moving money.

1Password’s answer: approve the login, never share the password

On 22 October, 1Password launched 1Password for Agents. The idea is simple: the agent never holds your password at all.

According to 1Password, when a supported agent reaches a sign-in form, it uses a unique digital key to verify its identity. You see which credential it wants and why, and approve or deny the request on your own device. 1Password then fills the credential directly into the sign-in form, so the agent never sees the username, password or one-time code.

Launch integrations include Meta’s Muse, Anthropic’s Claude Duet, OpenAI’s ChatGPT Work and Dots, Grok Bot, and Town’s Townie, with more listed as coming soon. 1Password says it’s available at no additional cost for Individual and Family accounts on 1Password.com, and that availability varies by integration. Accounts on 1Password.eu and 1Password.ca aren’t currently supported.

“Handing over a password, secret, or credential is a common shortcut to an agent, but can leave people with sensitive information in places they can no longer control,” the company wrote. That’s the same problem the banks are complaining about, approached from the user’s side.

How to use a personal AI agent safely right now

Illustration of an AI assistant completing tasks while a key and a payment card stay protected under a glass dome — Illustration (AI-generated): let the agent do the tasks, keep the keys under glass.

Whether you’re on the Duet waitlist or already using another agent, these habits will keep you useful and out of trouble:

Never paste passwords into an agent chat. Use a credential broker like 1Password for Agents, or your agent’s own approval-based sign-in, so passwords stay out of chat logs and agent memory.
Keep banking read-only. Don’t give an agent your bank login. If you want spending summaries, use an approved open-banking connection. Your bank’s terms may prohibit shared logins anyway.
Keep approvals on for anything irreversible. Payments, sending messages, signing and deleting should always need your OK. Duet does this by design; check that your agent does too.
Connect apps one at a time. Start with calendar and email, see how the agent behaves for a week, then add more. Every connection widens what can go wrong.
Use a payment method with limits. If an agent can buy things, give it a wallet or card with spending caps rather than your main card.
Read the morning brief critically. Anthropic itself warns Duet can misjudge urgency. Treat the agent’s priorities as a suggestion, not a verdict.

For the workplace side of this story, see our breakdown of how NVIDIA, SentinelOne and BeyondTrust are putting guardrails on AI agents. And if you’d rather build your own assistant with tighter control, start with our guides to building an AI agent with n8n or creating an AI agent without code.

Personal agents are finally good enough to hand real work to. The trick for the next few months is handing over tasks, not keys.

Related: The models behind personal agents are getting cheaper and more open, too. See what Kimi K3.1 Pro means for open-weight AI.

Sources