23 OCT 2026 — Anthropic has opened a waitlist for Claude Duet, a separate app in which Claude acts as an agent that contacts the user first, rather than waiting to be asked. The company announced the research preview on 21 October. It is limited to people in the US who pay for the Pro or Max plans, and it runs on Claude Opus 5.5.
Disclosure: RECATOOLS is written with the assistance of Claude, made by Anthropic, whose product is the subject of this article. Readers should weigh that interest.
What Anthropic has released
Duet is a standalone iPhone and Android app, also reachable through claude.ai, kept apart from the main Claude app. Anthropic pitches it at a particular user. "We built Claude Duet for professionals and small business owners with more on their plates than they can track," the announcement says.
The routine it describes is simple. Each morning the agent sends a short summary of what matters across the apps a user has connected. For the rest of the day it monitors those apps and sends a message when something needs a decision. Users can also hand it jobs by text or voice in a single running thread, from booking meetings to building dashboards, sales forecasts and small web apps.
Setup is light because Duet inherits the memory, skills and connected apps already attached to a person's Claude account. Anthropic says it can draw on more than 6,000 connectors and plugins in its marketplace, and lists Gmail, Slack, QuickBooks, Stripe, Gusto, HubSpot, Docusign, Canva and Shopify among the services it can work with.
Work continues on a cloud machine
The design choice that matters most in practice is where the work happens. Each Duet account gets a virtual machine in the cloud, browser included, so a task carries on after the user closes a laptop or locks a phone. When a website has no connector, the agent opens it in that cloud browser instead.
That browser has limits during the preview. A help centre article says users cannot watch it work or take control of it, cannot pick a model, and cannot yet connect Microsoft 365. Some connectors, Slack among them, work only with restrictions.
Approvals before anything binding
Anthropic's answer to the obvious worry is a gate on consequential actions: sending a message, paying for something, signing a document and deleting anything all require a yes from the user, after Duet has shown exactly what it intends to do. Some actions are refused outright. "A few things are off-limits even with your approval, like trading securities or moving money between accounts," the company writes.
Purchases go through Link, Stripe's digital wallet, or Shopify's Shop Pay. Anthropic says each approved purchase is paid with a one-time card, so the user's real card number is not shared. The company also describes a new classifier and safety system prompt that check each message. Their job is to refuse to pass on the most sensitive tier of data, such as card numbers and government identification, while health or financial details go out only on the user's explicit instruction.
The help article is candid about the weak point. An agent that reads email and web pages will meet text planted to steer it, known as prompt injection. The agent is meant to read that text as content and follow only its user, the article says, but adds that "no defense is perfect". That is one reason the approval step exists. Anthropic says Duet's handling of credentials follows its Managed Agents design, so the agent never directly sees passwords or sign-in tokens, and that red teams and an outside firm have tested it. Those are the company's own descriptions; no independent security assessment has been published.
The cost sits in the usage limits
Anthropic is not charging extra during the preview. The bill arrives another way: Duet draws on the same five-hour and weekly limits as ordinary Claude chats, and its background work counts too, including the morning summary and the periodic check-ins. The announcement explains why the agent does not watch accounts continuously: "checking nonstop would use up your plan's limits much faster."
Large jobs such as a financial model or a slide deck take more model turns, so they eat further into the allowance. To soften this, people admitted to the preview get one full reset of both limits, usable until 30 November 2026, according to the help article.
Where it sits among rival agents
MacRumors described Duet as the company's answer to Meta's Muse and OpenAI's Dots, noting that both rivals also give their agents a virtual machine with a browser.
One early hands-on came from Dan Shipper of Every, which had two weeks of access before launch. He called it "the first personal agent I'd call a pro tool", while listing gaps: its email drafts trailed those of OpenAI's agent, its scheduled runs could not reach his custom connectors, and voice input was transcription only. Every discloses that Anthropic gave it early access and says Anthropic had no input on the review.
What is still unknown
Anthropic calls this an early version. Its own announcement warns that Duet "still might misread a thread or miscalibrate what's urgent", and that personal errands such as booking tickets are weaker than work tasks. The company says it will publish more on Duet's safety design "in the coming days".
The help article states that Duet is available only in the US during the research preview, and that Anthropic plans to bring it to Team and Enterprise plans later. Neither page gives a date for other countries or for business plans. Readers comparing Claude's other products can find our Claude directory entry.
View author profile → · Editorial policy
