Claude Duet messages you first, and asks before it pays or sends

Anthropic has opened a research preview of Claude Duet, a standalone app where Claude acts as a proactive agent. In its announcement on X, the company says it surfaces what needs attention, finishes tasks, keeps working when you leave, and checks before acting for you.

Access is by waitlist, starting with Pro and Max subscribers in the US.

A waitlist app that works while you are away

According to Anthropic’s product page, Duet is built on Claude Opus 5.5 and aimed at professionals and small business owners. It sends a short morning brief on priority items across connected apps, then watches those apps through the day and only messages the user when something needs a decision.

The tasks Anthropic lists range from scheduling meetings to building dashboards, forecasts, prototypes and web apps. Duet runs on its own virtual machine with its own browser, so a laptop or phone does not have to stay on. It reuses memory, skills and connected apps from the user’s existing Claude account, and the user talks to it in one ongoing thread by typing or by voice.

Anthropic says it works with more than 6,000 connectors and plugins from the Claude Marketplace, including Gmail, Slack, QuickBooks, Stripe, Gusto, HubSpot, DocuSign, Canva and Shopify. Purchases can go through Stripe’s Link wallet, which pays with a virtual card, or through Shopify Shop Pay.

It is available on iOS, Android and claude.ai. It is included in Pro and Max plans at no extra charge, but it shares usage limits with the rest of Claude, and Anthropic says background checks and big jobs such as financial models or decks use more of that allowance. 9to5Mac reports that invitations go out in waves and that Team and Enterprise plans are not covered yet.

Approval gates and a short list of banned actions

The safety design is the part Anthropic spends the most words on. Duet can read, draft and prepare work by itself, but before it sends a message, makes a payment, signs a document or deletes anything, it shows the planned action and waits for a yes. Anthropic adds that some actions stay blocked even with approval, among them trading securities and moving money between accounts.

On credentials, Anthropic says Duet follows the design it uses for Claude Managed Agents, so it never directly sees passwords or sign-in tokens. Its actions pass through the auto mode classifier, and its prompt-injection defenses draw on the company’s browser-use research. A separate classifier and system prompt are meant to stop the most sensitive data, such as card and government ID numbers, from being shared. Health and personal finance details go out only when the user explicitly says so.

Anthropic says red teams and an outside firm penetration-tested the app, and that a public bug bounty covers it. These are the company’s own statements, and the page does not publish test results.

Proactive agents raise the stakes for oversight

A chatbot that waits for a prompt can only be wrong when asked. An agent that decides on its own what deserves your attention can also be wrong by omission, and the page says as much: Duet may misread a thread or misjudge urgency. A missed message is harder to notice than a bad answer, because the user never sees what was filtered out.

That makes the approval gates and the limited view into the agent’s work more important. Anthropic says users cannot yet watch Duet’s browser, so for now the user sees the planned action but not how the agent got there. Personal errands such as booking tickets are also, by Anthropic’s own account, less developed than work tasks.

The credential question is one the industry is working on from several sides. As reported in our coverage, 1Password will let AI agents sign in for you, free, without ever seeing the password, and Anthropic’s page says saved 1Password logins are coming to Duet soon, with the user’s permission. Oversight of the agents themselves is a separate concern: OpenAI says two agents weakened the system built to catch their misbehavior, a reminder that checks on agent behavior are themselves something researchers have to test.

What the preview does not settle

Several things remain open. Anthropic has not given a date for wider access, and nothing in the sources covers availability outside the US or on Team and Enterprise plans beyond saying those are not included yet. Claims about reliability, such as how often Duet misjudges urgency, come with no figures. The testimonials on the page come from small business owners chosen by Anthropic; one of them, Mya Dalton, says, “I love that proactivity.”

Duet also lives in a separate app from the main Claude app for now, so existing Claude users get a second place to manage. For anyone on a Pro or Max plan in the US, the practical step is joining the waitlist and watching how fast background checks eat into the usage limit they already have.