Anthropic has built an agent that can spend your money, and it spent most of Thursday explaining what it won’t do. Claude Duet is a research-preview app for Pro and Max subscribers, waitlist only, running on Opus 5.5. It works in the background on its own virtual machine, assembles daily briefings and dashboards, and pings you when it needs approval. It can buy things through Stripe’s Link or Shopify’s Shop Pay, but only with a human sign-off. It will not trade securities, move money between accounts, or hand over a credit card number. The interesting part is the shape of the product: not an errand-runner but a coworker with a corporate card and a short list of forbidden moves.
The same day, 1Password shipped a way for agents to log in without seeing your password: the agent presents a key, you confirm, the credentials are filled in behind the curtain. Banks, TechCrunch notes, are already spotting agent traffic in customer accounts without being able to tell whether the customer asked for it. The plumbing of delegation is being built in real time, and the people building it are all drawing roughly the same line: the agent acts, but never holds the secret.
Why the caution? Because the other side is using agents too. Microsoft says a China-aligned group breached ConnectWise’s cloud backup service, stole the application credentials customers use to link their data, and then used an open-source AI framework to log in to roughly 2,250 organizations at close to 3,000 attempts a minute. Defenders, in Microsoft’s words, had little time to react. The lesson is the same one as above, inverted: a credential that can be replayed at machine speed is a liability whoever’s agent holds it.
One answer to that is to prove things rather than hope. Anthropic’s Frontier Red Team, working with Theorem, published research on using Claude to formally verify compiled code. Claude turned existing fuzz tests into specifications for 123 open-source libraries and 239 OSS-Fuzz entry points, then proved in Rocq, at the RISC-V assembly level, that they don’t crash on inputs under 64 MB. Along the way it found and patched hundreds of bugs, some that fuzzing had missed for years. The proofs run to about 180 million lines and can cost hundreds of millions of tokens, and the authors are blunt that “formally verified” is not “bug-free”: the specs and the machine model can be wrong, and the model here is RISC-V with musl, not the x86-and-glibc most people run. Still, it’s a credible sign that the same machines that attack can also audit.
Meanwhile the money keeps scaling to match the ambition. OpenAI is reportedly working on a $30B raise at a $1.25 trillion pre-money valuation, reportedly led by Coatue with Gulf money that may be tied to more compute. That is down from the $1.4 trillion Bloomberg reported a month ago, terms are still moving, and it would make OpenAI the most valuable private company ever. It also means OpenAI, which filed confidentially for an IPO in June, is going back to private investors first. Anthropic, which filed the same month, is reportedly eyeing $1.5 to $2 trillion for its debut. Everyone in this story is telling investors that agents will be trusted with real work, and everyone is also quietly building the locks. Both bets can be right, but only one of them gets a trillion-dollar valuation for being early.
