Claude Duet, the Agent That Comes to You First

For the past year, the product logic of AI assistants has barely changed: you speak, it answers; you walk away, it stops. On October 21, 2026, Anthropic flipped that logic with Claude Duet: an agent app that comes to you first. Every morning it sends a brief; during the day it checks your connected apps every few hours and messages you only when something actually needs you; tasks you hand it keep running after you leave. This is not a model upgrade. It is a relationship upgrade: from a tool that answers questions to a partner that watches the shop for you.

What happened

Anthropic announced Claude Duet as a research preview, initially for Pro and Max subscribers in the United States, on a waitlist. It is a standalone app, separate from the main Claude app, available on iOS, Android, and the web, and built around Claude Opus 5.5. During the preview there is no extra charge, but Duet shares your plan's usage limits with the rest of Claude, and its background checks count against those limits. That is worth stating plainly: Duet is not a free extra assistant. It is a new way to spend limits you already pay for.

The daily rhythm is the most concrete part of the announcement. Each morning, Duet sends a short brief on the most important items across your connected apps. During the day it checks those apps every few hours rather than constantly — Anthropic's stated reason is practical: constant checking would burn through plan limits much faster. You can also tell it what you want to hear about and how often. Beyond receiving, you can hand it tasks in one ongoing thread, by text or voice, from scheduling a meeting to building a dashboard that uses dozens of tools, creating a sales forecast, prototyping, or building a simple web app.

What lets it keep working after you walk away is its own virtual machine in the cloud, with its own browser. Your phone or laptop can be off while the task continues; you get a notification when it finishes or needs your review. In other words, Duet works more like a remote assistant: you send a short message, it figures out which apps to use and which steps to take, instead of coming back to ask at every step.

How much work can it actually take on

The announcement is specific about connections: Duet can use more than 6,000 connectors and plugins in the Claude Marketplace. Examples include finding missed Gmail and Slack messages and helping you reply; checking QuickBooks or Stripe for unpaid invoices and drafting reminders; preparing payroll in Gusto, with hours, bonuses, and reimbursements filled in; drafting a job posting and, once you edit and approve it, posting it to LinkedIn; preparing agreements and sending them for review and signature through Docusign; drafting follow-up emails from contact and deal history in HubSpot; turning a product launch into a social campaign in Canva; and setting up and managing a Shopify store, with a richer visual editor coming soon so you can preview a storefront before anything goes live.

Payments are spelled out too. Duet can buy things for your business using Link, Stripe's digital wallet: it confirms the item with you, Link asks you to approve the spend, and it then pays with a virtual card so your real card number is never shared. It can also check out with Shopify's Shop Pay. In the future, with your permission, it will be able to sign in to sites with logins you have saved in 1Password. The common thread is that every payment and every outbound message is designed as a "show you first, wait for your nod" action, not something the agent quietly does on its own.

But Anthropic is also candid about the gaps. Duet is currently stronger at work tasks; personal errands such as booking tickets are, in its own words, not quite as strong. It may still misread a thread or misjudge how urgent something is. And it cannot yet show you its browser. That last point matters: right now you see results and notifications, not the step-by-step trail of what it opened. For an agent that will read your email, touch invoices, and prepare payroll, that transparency gap is the thing to watch.

Safety and boundaries: what it will never do

The safety section is the heaviest part of the announcement, and it deserves to be unpacked point by point. First, credential handling follows the design used for Claude Managed Agents: Duet never directly sees your passwords or sign-in tokens. Second, action approval uses an auto mode classifier, the same safeguard that keeps Claude and Claude Code from taking steps you did not ask for. Third, defenses against hidden instructions and prompt injection come from Anthropic's browser-use research. Fourth, red teams and an external firm penetration-tested Duet, and it is covered by a public bug bounty program.

Fifth, and most interesting as a product decision, is a new dedicated classifier and safety system prompt that checks each message to guard against leaks of sensitive information. The strictest tier — including credit card numbers and government identification — is rejected outright. Other sensitive information, such as health or personal finances, is only sent when you have explicitly instructed Duet to send it. This tiered approach is more useful than a generic "we take safety seriously": it admits the agent will handle sensitive information, and treats the question as what rules govern release, not whether contact happens at all.

Sixth, the approval red lines are absolute. Before Duet sends a message, makes a payment, signs a document, or deletes anything, it must show you exactly what it is about to do and wait for your approval. Even with your approval, two things stay off-limits: trading securities and moving money between accounts. You can also disconnect any app Duet has access to at any time. Taken together, Anthropic is positioning Duet as a careful steward: diligent, but without a master key.

Careful statements, however, are not verified guarantees. The announcement gives no numbers for the classifier's false-positive or false-negative rates in a real inbox, and checking "every few hours" will inevitably miss some time-sensitive items. The page also carries an October 23 update note saying protections will continue to be strengthened — itself a signal that the safety design is still being iterated, and preview users are its first validators.

Why this matters for vibe builders

First, proactive agents are now a head-on race. OpenAI launched its always-on agent Dots at DevDay in late September, Meta has its Muse agent, and Anthropic's own Cowork covered the "you start it, it finishes it" pattern. Duet fills Anthropic's gap in the "no need for you to start it" slot. Three major labs betting on the same direction at once tells you the consensus has shifted: the next agent competition is not about who answers better, but about who you trust with the boundary between "act first" and "ask first."

Second, Duet turns attention into a design dimension. Assistants used to allocate attention according to your questions; Duet must decide for itself what deserves to interrupt you, what can wait, and what needs approval first. Done well, it saves you time; done badly, it becomes a new source of notification spam. For vibe builders, this is a directly borrowable design question: if your product has an agent feature, you must answer "when should it stay quiet and when must it speak," and you must write that rule into the product rather than leaving it to the model to improvise.

Third, the business model is worth noting. Duet is not separately priced; it draws on Pro and Max limits. Anthropic is pricing "always working" agents through subscriptions rather than per-task fees. For an independent builder, that suggests a pricing idea: if your agent feature is a standing watch, per-use pricing makes users hesitate every time; bundling it into a subscription with clearly stated limits makes habit formation easier. The precondition, as Anthropic demonstrates, is stating up front that background checks count toward limits — before the bill surprises anyone.

Fourth, the target user is deliberately narrow: professionals and small business owners with more on their plates than they can track. The tester stories are small-business routines — scheduling user interviews, preparing payroll, drafting agreements — not consumer errands. The lesson is that an agent product does not need to do everything on day one; doing ten high-frequency chores deeply for one specific group builds trust faster than a vague promise to do anything.

How the competition differs

Placed in the autumn 2026 proactive-agent landscape, Duet's differences are more informative than its similarities. OpenAI's Dots is also an always-on agent with its own cloud computer and browser. But where Dots emphasizes constant presence, Duet emphasizes restraint: one morning brief, checks every few hours, silence otherwise. That is a bet on two different trust strategies — Dots bets that seeing it work often builds trust; Duet bets that interrupting rarely builds trust. Which bet wins depends on the user's tolerance for interruption, which varies enormously between, say, a small-business owner juggling customer email and an engineer whose deep-work hours cannot be broken.

Meta's Muse leans toward consumer life: shopping, booking, emailing, everyday tasks. Duet explicitly leans toward work, and admits personal errands are weaker. Anthropic chose to get the approval, credential, and payment plumbing right for work scenarios before chasing generality. That is a replicable strategy: the narrower the scenario, the easier it is to draw a clean safety boundary, and the cleaner the boundary, the more real work users dare to hand over. An agent that claims to do everything often ends up trusted with nothing.

Within Anthropic's own lineup, Cowork and Duet complement rather than replace each other. Cowork solves "you know what needs doing but have no time to do it." Duet solves "you don't yet know what needs doing." If you already use Cowork, Duet's value is not another pair of hands but a lookout. That distinction is also how you should explain agent features in your own product: say clearly whether it waits for assignments or finds work on its own, because users' expectations and tolerance will be completely different.

One gap remains: transparency. Duet cannot yet show you its browser, so unlike Cowork's work process, you cannot trace exactly what it opened and read. That gap is understandable in a preview, but it is precisely the lesson proactive agents most need: the more an agent acts while you are away, the more it needs a checkable action record. If something goes wrong once and nobody can say at which step it went wrong, trust is hard to rebuild.

A seven-question checklist before you build proactive features

If you are considering an "active reminder" or "automatic follow-up" feature in your own vibe project, use this announcement as a mirror and answer seven questions. One: what triggers it — a schedule, an event, or the model's own judgment that something is worth interrupting you? Write the trigger down; do not let the model decide it on the fly. Two: what is the interruption budget — how many messages per day, which hours are off-limits, and does it back off after days of no response? Duet's "every few hours" is a budget, just one set by the vendor; your product should let users set their own.

Three: what is the approval granularity — what can be done directly, what must be shown first, and what is permanently off-limits? Put those three tiers in a table in your product docs, not hidden in a prompt. Four: how are credentials handled — will the agent ever touch passwords or tokens, and what is the isolation plan? Duet's answer, "it never directly sees them," is worth copying. Five: is sensitive information tiered — is the top tier rejected outright, and does health or financial data require explicit instruction? The more specific the tiers, the more users dare to authorize.

Six: is there an action record — for every proactive action, a time, a target, and an outcome that can be reviewed? Proactivity without a record is unauditable proactivity. Seven: is the off switch easy — can users disconnect one app or pause all proactive behavior in one tap? Duet's "disconnect any app at any time" is the answer to this question. A proactive feature that cannot be switched off will be met with suspicion, not trust.

Measured against those seven questions, Duet gives clear answers on approval tiers, credential isolation, sensitivity tiers, and exit, a rough answer on triggers, and no answer yet on action records. That is what a preview is for: letting real users test whether the answers are good enough. For vibe builders, the more practical move is to answer all seven questions in your own product first — even if the answer is "for now we only remind, we never act." That honesty is more credible than vaguely claiming "fully autonomous agents." In the end, the proactive-agent race will not be won by whoever is most proactive, but by whoever's proactivity feels safest to live with.

Closing: from answering questions to watching over things

The most interesting thing about Duet is not a new model or a few more integrations. It is the change in default posture: from you going to it, to it coming to you. That reversal touches a lot — notification rhythm, approval granularity, limit accounting, transparency baselines. Anthropic deserves credit for writing those choices into the announcement instead of leaving users to discover them. But the real test is still ahead: the first time Duet messages you unprompted with "you should look at this now," will you feel helped or interrupted? That answer will decide whether proactive agents are the next generation of assistants or the next generation of notification spam. And only people who actually use one can give it.