Claude Duet: What Anthropic's Proactive Agent Actually Does

Most product announcements are lists of things a system will do. Anthropic's announcement of Claude Duet, published on 21 October 2026, is more useful read the other way round, as a list of things it will not do. It will not watch your connected accounts continuously — it checks them every few hours, and the company gives the reason in plain words: checking nonstop "would use up your plan's limits much faster." It will not trade securities or move money between your accounts, even if you approve the action yourself. It will not carry a credit card number or a government identification through a message at all. And it will not send, pay, sign or delete anything without showing you the exact action first and waiting for your approval. The app is built around Claude Opus 5.5, and those refusals are the most informative thing about how it was designed.

The plain answer to the search that brought most people here: Claude Duet is a separate Anthropic app, on iOS and Android and on claude.ai, in which Claude works as a proactive agent instead of a chat window you go back to. It comes to you with what needs attention, completes tasks you hand it, keeps working while you are away from your laptop, and checks with you before it acts on your behalf. Anthropic says it built the product for "professionals and small business owners with more on their plates than they can track." It is a research preview, available by waitlist, starting with Pro and Max subscribers in the United States.

What it does that a chat window does not

Two habits separate Duet from the Claude you already know. The first is a morning brief: each day it sends a short summary of the most important items across the apps you have connected. The second is silence. Through the rest of the day it keeps tabs on those apps and messages you only when something actually needs attention — a calendar collision, an invoice that has gone unpaid, a thread that stopped waiting for a reply. The judgment about what counts as urgent is the product; the messaging is just the delivery mechanism.

The second difference is that the work continues without you. Claude Duet runs on a virtual machine with its own browser, so your laptop can be shut and your phone can be in a pocket. You describe a task in a short message, it works out which apps to use and what steps to take in the background, and you get a notification when the task is finished or needs your review. That is a meaningfully different arrangement from an agent that borrows the browser tab you are looking at, because nothing in the job depends on you staying in your seat.

Conversations happen in one ongoing thread, by typing or by voice, so a two-line reply and a week-long project start in the same place rather than in separate chats. The tasks Anthropic lists for it run from scheduling meetings to "building dashboards with dozens of tools, creating financial or sales forecasts, prototyping, and building web apps" — a range wide enough that the interesting question is not capability but supervision, which is where the rest of this article goes.

The first refusal: every few hours, not every second

The agent products of the last two years have competed on how closely they watch. Claude Duet declines that competition on purpose. "Claude Duet checks your connected accounts every few hours, because checking nonstop would use up your plan's limits much faster," the announcement says. Read that as an engineering decision rather than a hedge. A polling loop that runs every thirty seconds is a quiet way to convert a flat monthly plan into a metered one, and Anthropic has chosen the cadence that keeps the plan usable instead of the cadence that makes the demo look attentive.

The same accounting applies to everything else the app does in the background. Its checks count toward the same usage limits as the rest of Claude, and larger jobs — building a financial model, assembling a deck — "require more model turns and background work." Nothing here is unmetered. If you have used an agent that seemed to work for free, it was being subsidised somewhere; Duet tells you where the cost lands before you connect anything.

What replaces constant vigilance is user control and tuning. You can tell it what you want to hear about and how often, and Anthropic says it is still testing its judgment about when to message you and will keep adjusting that judgment based on what testers report. That is an admission worth taking at face value: the rate of interruption is a work in progress, and the first month of a research preview is not the right time to judge the final cadence.

The approval gate, and what sits behind it

Duet reads, drafts and prepares work on its own. The line is drawn at four specific acts. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it is about to do and waits. The approval is per action, not per session, and it is not something you can switch off to speed things along.

Behind that gate there is a second, shorter list. "A few things are off-limits even with your approval, like trading securities or moving money between accounts," the announcement says. This is the sentence that distinguishes Duet from a general-purpose agent with a confirmation dialog. A confirmation dialog assumes the user is the final authority and that anything the user approves is therefore acceptable. Anthropic has decided there are categories where the user's approval is not the relevant permission — where the firm, not the customer, is the one who would be blamed, and where a mistake is not recoverable by saying sorry. Brokerage trades and inter-account transfers are the examples given. You can also disconnect any app Duet has access to, which is the other half of the same design: access is revocable at the account level, not just denied at the prompt.

The classifier that decides what leaves

The third refusal is about information rather than action, and it is the one most likely to be tested by accident. Anthropic shipped Duet with a new dedicated classifier and safety system prompt that examines each message for leaks of sensitive data. "An agent that reads email and sends messages for you is constantly deciding where information should go," the announcement notes, and that framing is the whole argument. The new classifier is designed to reject requests to share what Anthropic calls the strictest tier of information, "including credit card numbers and government identification." Health information and personal finances are handled differently: they pass only when you have explicitly instructed Duet to send them.

Credentials follow a separate design borrowed from Claude Managed Agents, so Duet "never directly sees your passwords or sign-in tokens" — it acts through them rather than reading them, which means a leaked transcript is not automatically a leaked password. Defences against hidden instructions and prompt injection come from Anthropic's browser-use research, which is the relevant lineage given that Duet drives a browser for a living. The security work is documented rather than merely asserted: internal red teams, an external firm's penetration test, and coverage under the public bug bounty. Anthropic also says it will share more detail about how Duet is designed for safety in the coming days, so what is published today is a description, not a full specification.

What it connects to

Duet can draw on "over 6,000 connectors and plugins in the Claude Marketplace." Anthropic names a set of examples that map closely to the work of a small company, and they are worth reading as a list of the jobs rather than the integrations:

• Inbox and messages — find the Gmail and Slack messages you missed and help you reply.

• Money in — check Intuit QuickBooks or Stripe for unpaid invoices and draft the reminders.

• Payroll — prepare and run Gusto payroll with hours, bonuses and reimbursements filled in.

• Hiring — draft a job posting and, after you edit and approve it, post it to LinkedIn.

• Contracts — prepare agreements and send them for review and signature through Docusign.

• Sales follow-up — draft emails from the contact and deal history in HubSpot.

• Marketing — turn a product launch into a social campaign in Canva, and set up, design and manage a Shopify store.

Buying things has its own arrangement. Duet confirms the item with you, then Stripe's Link wallet asks you to approve the spend and pays with a virtual card, so your real card number is never handed over. Shop Pay from Shopify works for online checkouts. Signing in to sites with logins saved in 1Password is listed as coming soon.

What it cannot do, in Anthropic's own words

The limitation paragraph is unusually candid for launch copy, and it is the section that should set expectations for the first weeks. Duet "still might misread a thread or miscalibrate what's urgent." Its core functionality was built around work, so "personal errands, such as booking tickets, aren't quite as strong." It "can't yet show you its browser" — you get the result, not the replay. And it "lives in its own app, separate from the main Claude app," with Anthropic saying that what it learns from early users will shape how the two eventually work together.

Two absences are worth stating because they are the questions people ask next. There is no published Claude Duet API; it is a consumer app, and nothing in the announcement suggests otherwise. And there is no independent benchmark of Duet's task completion. The testers quoted by Anthropic are anecdotes from people who work there or were given early access — a broker who had a property showing flagged on the wrong day, a restaurant owner with about 110 employees who says he no longer needs a hundred browser tabs, a brand strategist whose client call was spotted sitting right before a flight. Those are useful signals about what the product is for. They are not evidence about how often it gets things right, and no one has published that number.

Where the model underneath comes from

Anthropic says it designed Claude Duet around Claude Opus 5.5 and built it "to be resourceful and to decide what needs you, what can wait, and when to check with you first." That model is on our catalogue, which matters if you are building an agent of your own rather than waiting for a consumer invitation: Claude Opus 5.5 is available at $4.00 per million input tokens and $20.00 per million output tokens, with a 1M-token context window and cache reads at $0.20 per million, through one OpenAI-compatible endpoint and one key that also reaches 200-plus other models. We pass provider list price through with no markup, so a change on the vendor's side shows up on ours the same day.

To be explicit about the boundary: we host the model, not the app. Claude Duet is Anthropic's consumer product, distributed by Anthropic to its own subscribers, and nothing here should be read as an offer of Duet access through a third party.

How to get it

Access runs through a waitlist, not a store. Anthropic is starting with Pro and Max subscribers in the United States, the preview is included in those plans rather than sold as a separate product, and the company says it will email as soon as Duet is ready for you. Nothing about timing has been published, and we have a separate piece on what access looks like today and what is worth deciding before an invitation arrives.

Three things are worth watching from here. The first is the safety detail Anthropic has promised to publish, because the classifier and the credential design are the parts of this product that will be hardest to verify from the outside. The second is the cadence — whether "every few hours" survives contact with users who want to be told sooner. The third is the refusal list itself. A product that will not trade securities or move your money even when you ask is making a bet that users will read the limit as protection rather than as a missing feature, and that bet is not settled until strangers, not testers, have used it for a while.