Anthropic has opened a research preview of Claude Duet, a standalone app in which Claude stops waiting to be prompted and starts acting on its own. Announced on 21 October, Duet runs on a dedicated computer in the cloud with its own browser, watches the applications a subscriber connects, and keeps working after the laptop is closed.
- Proactive by design: Duet reads email and calendar, flags what it judges urgent, drafts next steps and then goes quiet until something needs a human.
- Cloud-native execution: it does not lean on your phone or notebook, so scheduling, dashboards, forecasts and web prototypes finish while you are away.
- Approvals plus hard limits: it asks before sending messages, paying or deleting, and it cannot trade securities or move money between accounts even with permission.
- US-only waitlist: Pro and Max subscribers in the United States get in first, and background work draws on the same usage quota as the rest of Claude.
A proactive assistant on a machine you never see
Duet is built on Claude Opus 5.5 and inherits the memory, skills and connected apps of an existing Claude account, so setup is minimal. It ships as a separate app for iOS and Android and as a distinct surface at claude.ai, detached from the main Claude application. Anthropic says what it learns from early users will determine how the two eventually fit together.
The integration surface is the real muscle: more than 6,000 connectors and plugins from the Claude Marketplace, with Gmail, Slack, QuickBooks, Stripe, Gusto, LinkedIn, Docusign, HubSpot, Canva and Shopify among the examples. Tasks arrive by text or voice message with no configuration — a meeting, a dashboard, a sales forecast, a working prototype delivered as a file. Anthropic also lists back-office chores such as chasing unpaid invoices, preparing payroll for review and getting contracts ready to send. Where no connector exists, Duet browses the site itself. On the roadmap: a fuller visual editor for Shopify and, with permission, access to credentials stored in 1Password.
Approvals, hard prohibitions and credentials it cannot read
Before sending a message, making a payment, signing a document or deleting anything, Duet shows exactly what it intends to do and waits. Users can disconnect any app and decide which alerts arrive and how often. Anthropic says it uses the design of its managed agents so the system never directly sees passwords or tokens; purchases route through Link, Stripe’s digital wallet with a virtual card, and through Shopify’s Shop Pay.
The more interesting part is the prohibition list. Duet cannot operate with securities or move money between accounts, even with explicit approval — an unusually public statement of what an agent will refuse. Sensitive data gets its own classifier and system prompt: card numbers and identity documents are rejected outright, while health and personal finance details surface only on explicit instruction. Anthropic points to internal red teams, penetration testing by an outside firm and inclusion in its HackerOne bug bounty programme. The technical details, however, are not published; the company promised to expand on them in the coming days.
US waitlist, shared quotas and no published numbers
Access is a research preview behind a waitlist, released in waves and starting with Pro and Max subscribers in the United States. Team and Enterprise are excluded for now, with expansion promised, and no other countries or languages have been announced. There is no separate price tag, but there is a cost: Duet draws on the same usage limits as everything else in Claude, and both background checks and large jobs such as a financial model consume more of it. No estimate of how much has been published.
The pattern echoes the rest of the field. OpenAI’s always-on agents did not reach the Pro tier in Europe; Meta’s Muse, which executes tasks and buys on a user’s behalf, drew millions of downloads and this week had to suspend its conversation-sharing feature over a privacy problem.
What Anthropic admits does not work yet
More than a launch note usually concedes. Anthropic states that Duet may misread a thread, miscalibrate urgency, prove weaker at personal errands such as booking tickets and cannot yet show you its browser — meaning users cannot watch what it is doing.
“It may misread a thread or miscalibrate what’s urgent, and it can miss something that arrives between checking in with you.”
That last admission matters. An agent browsing uncatalogued sites on a machine you do not control, with a screen you cannot see, is precisely the setting where hidden instruction injection is hardest to catch; Anthropic says its defences derive from its browser-use research. Testimonials number six, and three come from Anthropic staff — the heads of Claude Code, model behaviour design and the Duet team itself. There is no benchmark, no performance figure and no metric for how often Duet correctly decides something is urgent.
The honest framing is also the incomplete one. Publishing a list of actions the agent refuses is the strongest idea in the launch, and admitting it can misjudge urgency is rarer than it should be. But the number that decides whether Duet is useful is not what it can do — it is how often it interrupts when it should stay silent, and how often it stays silent when it should speak. Until that figure exists, and until someone estimates what all-day background checks cost in quota, buyers are being asked to judge a proactive assistant on curated testimonials.