Anthropic’s Claude Duet asks before it pays, sends or signs

Anthropic on October 21 opened a waitlist for Claude Duet. The agent checks your connected accounts every few hours, works on its own cloud machine while you’re away, and stops for your approval before it sends a message, pays, signs a document or deletes anything. Every one of those background checks comes out of the same plan limits you already use for Claude.

The research preview is open to Claude Pro and Max subscribers in the US. Team and Enterprise plans aren’t included yet, according to the Claude product page. Duet is a standalone app for iOS and Android, and on a computer it opens on the web at claude.ai. Anthropic built it around Claude Opus 5.5 and says it is aimed at “professionals and small business owners with more on their plates than they can track.”

How Duet runs

Duet gets a virtual machine with its own browser, so your laptop and phone can be off while it works. You describe a task in a short message, by text or by voice, and Duet decides which apps to use and what steps to take. All your history sits in one ongoing thread, so a quick reply and a weeklong project start in the same place. You get a notification when a task is done or needs your review. Finished work comes back as a doc, sheet or deck.

Setup is mostly inherited. Memory, skills and connectors carry over from your Claude account and are there from the first message. Anthropic’s own contrast is that the Claude app waits for you to open a chat, while Duet comes to you: a morning brief on the most important items across your connected apps, drafted next steps, then quiet until something needs you.

That “until something needs you” depends on polling. Duet checks your connected accounts every few hours, because checking nonstop “would use up your plan’s limits much faster,” Anthropic says. You can tell it what you want to hear about and how often. Anthropic says it is still testing Duet’s judgement about when to message you and will keep tuning it from tester feedback. The same product page warns that Duet “can miss something that arrives between checking in with you”, which is the honest cost of a few-hour cadence for anyone who expects it to catch an urgent email.

The cloud machine is what separates Duet from Cowork, which launched as a research preview for Max subscribers through the macOS desktop app and worked inside a folder you picked on your own machine, VentureBeat reported. Duet works through connected apps from a remote computer. OpenAI’s dots, which rolled out in September, each run on their own cloud computer and browser too, and connected to over 4,000 apps at launch. Duet also stays in its own app, while Cowork has been folding into Claude chat since September 16.

What it costs you in limits

There’s no separate price: Duet is included in Pro and Max during the preview. The catch is how it spends your allowance. It shares your plan’s usage limits with the rest of Claude, and it uses them differently than a typical conversation does. The background checks count toward those limits, and larger tasks, like building a financial model or a deck, need more model turns and more background work.

The controls Anthropic describes are direct: tell Duet what to watch and how often to report, and disconnect any app you don’t want it to have access to.

Where it has to stop

Duet reads, drafts and prepares work on its own. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it’s about to do and waits. Some things stay off-limits even with your approval: trading securities and moving money between accounts.

Information gets a separate filter. Duet ships with a new dedicated classifier and a safety system prompt that check each message for leaks of sensitive data. “An agent that reads email and sends messages for you is constantly deciding where information should go,” Anthropic writes. The strictest tier, which includes credit card numbers and government identification, is rejected outright. Other sensitive material, such as health or personal finance information, goes through only when you’ve explicitly told Duet to send it.

The rest of the safety design is reused from other Anthropic products:

• Credentials are handled the way Claude Managed Agents handles them, so Duet never directly sees your passwords or sign-in tokens.
• Actions go through the auto mode classifier that already guards Claude and Claude Code against steps you didn’t ask for.
• Defenses against prompt injection, instructions hidden inside a page or an email, come from Anthropic’s browser-use research.
• Red teams and an external firm ran penetration tests, and Duet is covered by the public bug bounty program.

Approvals, logins and safety checks run in your own cloud computer, Anthropic says, so sensitive details stay private. You can see what Duet has done and is doing, and steer it. Anthropic says it will publish more on Duet’s safety design in the coming days.

Connectors and purchases

Duet can use the more than 6,000 connectors and plugins in the Claude Marketplace. Anthropic’s examples lean toward running a small business:

• finding missed Gmail and Slack messages and helping you reply;
• checking Intuit QuickBooks or Stripe for unpaid invoices and drafting reminders;
• preparing and running payroll in Gusto, with hours, bonuses and reimbursements filled in;
• drafting a job posting and, once you edit and approve it, posting it to LinkedIn;
• preparing agreements and sending them for review and signature through Docusign;
• drafting follow-ups from contact and deal history in HubSpot;
• turning a product launch into a social campaign in Canva;
• setting up, designing and managing a Shopify store.

Beyond those, Anthropic lists dashboards built with dozens of tools, financial or sales forecasts, prototypes and web apps.

Purchases go through two wallets. With Link, Stripe’s digital wallet, Duet confirms the item with you, Link asks you to approve the spend, and payment goes out on a virtual card so your real card number isn’t shared. Duet can also check out at online stores with Shopify’s Shop Pay. “It’s the first time we’re opening Shop Pay in agents to stores not on Shopify,” Shopify wrote on October 21. Two things are marked as coming soon: signing in to sites with logins you’ve saved in 1Password, with your permission, and a richer visual editor for designing a Shopify storefront and previewing it before it goes live.

How Anthropic’s own people use it

Mike Krieger posted that he had been using Duet “for a few weeks, at work and at home,” and that “it drafted questions for a fireside chat, watched Slack over the weekend.” Boris Cherny, who leads the Claude Code team, talks through his mental to-do list with Duet on walks instead of saving it for his desk. Chelsea Larsson, who leads model and product behavior design, hands it her to-do list before leaving to be with her kids, and the results wait for her in an evening report. Karan Ahuja, who leads the Duet team, uses it to schedule user interviews, work on prototypes and ship code. Anthropic also gave early access to some small business owners and entrepreneurs.

What the preview won’t do yet

Anthropic lists the gaps itself. Duet may misread a thread or get wrong what’s urgent. Its core functions are built around work, so personal errands such as booking tickets are weaker. It can’t yet show you its browser.

For now Duet stays separate from the main Claude app, and Anthropic says what it learns from early users will shape how the two work together. Access starts with the waitlist: sign up, and Anthropic emails you when Duet is ready for you.