Anthropic opens Claude Duet, a proactive agent that keeps working while you step away
On October 21, 2026, Anthropic opened a research preview of Claude Duet, an app in which Claude acts as a proactive agent: a morning brief, monitoring of your connected apps and background task execution, with systematic approval before any sensitive action. The promise is bold, but it is the safety stack — leak-blocking classifier, credentials never exposed, sensitive actions gated — that will decide whether the bet holds.
October 21, 2026. Anthropic opens a research preview of Claude Duet, an app in which Claude acts as a proactive agent instead of waiting for a prompt. October 21, 2026. Access starts via waitlist for Pro and Max subscribers in the US, on iOS, Android and claude.ai. October 21, 2026. The agent runs on Claude Opus 5.5 and more than 6,000 connectors from the Claude Marketplace. Why it matters: it is the first time a major lab hands an agent permission to read your email and send messages on your behalf — and the safety stack will determine whether the gamble pays off.
What Claude Duet actually does
Claude Duet inverts the relationship to the tool. Instead of opening a conversation and asking a question, the user receives a short morning brief on the important items across their connected apps. The agent then keeps tabs on those accounts and only messages you “when something needs your attention”. You can also hand it tasks of any size: scheduling a meeting, building a dashboard across dozens of tools, producing financial or sales forecasts, prototyping a web app.
The key mechanism is a virtual machine with its own browser: the agent does not need your laptop or phone to stay on. You describe the task in a short message, it works out which apps to use and which steps to take in the background, then notifies you when it is done or needs a review. It does not poll your accounts constantly — “every few hours” — precisely so it does not burn through your plan’s limits.
The announced use cases paint a back-office assistant more than a butler: catching up on missed Gmail and Slack messages, flagging unpaid invoices in QuickBooks or Stripe, preparing payroll in Gusto, posting a job opening to LinkedIn, sending agreements for signature through DocuSign, or running a Shopify store.
The personal-agent market is already crowded
Claude Duet does not arrive into a vacuum. Meta claims more than 10 million users for Muse, OpenAI has shipped Dots, and the list keeps growing: Hark, Instinct, Grok Bot, Fo. All promise the same thing — an agent that acts for you. Differentiation comes down to two axes: target and trust.
Anthropic chooses its target carefully: professionals and small business owners with “more on their plates than they can track”. It is an explicit distinction from personal agents like Instinct: Duet admits it is weak on personal errands and ticket booking, and cannot yet show you its browser as it works. The company is not claiming to do everything — it claims to do desk work well.
The shift goes beyond the app duel. The market is moving from assistants that answer when prompted to agents that work on the user’s behalf, and each rival is sharpening its position. Meta has spun out a business version of Muse wired to third-party apps; OpenAI is steering Dots toward professional tools; Anthropic, for its part, is betting on trust as the differentiator, documenting its guardrails where others stay silent. In a market where the agent will have access to your email and your payments, trust is not a marketing line — it is the barrier to entry.
Safety is the real product
This is where the announcement separates itself from yet another consumer agent. Anthropic details five safety building blocks, not a statement of intent.
First, the trustworthy agents framework, the same one guiding Claude Code and Claude in Chrome. Second, credential handling follows the Claude Managed Agents design, so the agent never sees your passwords or sign-in tokens. Third, actions pass through the auto mode classifier that already protects Claude Code from taking steps you did not ask for. Fourth, defenses against hidden instructions and prompt injection come from Anthropic’s browser-use research. Finally, the infrastructure was run through red teams, an external penetration test, and is covered by the public bug bounty on HackerOne.
The most concrete novelty is a dedicated classifier paired with a safety system prompt that checks each message and blocks sensitive-information leaks. An agent that reads your email and sends messages is constantly deciding where information should go. This classifier rejects requests to share the strictest tier — credit card numbers and government IDs — and lets health or personal finances through only when you have explicitly instructed it to.
The important decisions stay with you: before it sends a message, makes a payment, signs a document or deletes anything, the agent shows exactly what it is about to do and waits for your approval. Some actions are off-limits even with your consent — trading securities or moving money between accounts. Purchases go through Link (Stripe) or Shop Pay (Shopify), using a virtual card so your real card number is never shared.
What remains to be proven
Caution is warranted. This is a research preview, waitlist-gated to US Pro and Max subscribers. Anthropic concedes the agent may still “misread a thread or miscalibrate what’s urgent”. It shares the usage limits of your Claude plan and spends them differently from a normal conversation: background checks and large tasks consume more model turns. And for now the agent lives in its own app, separate from main Claude — a sign that the two experiences have not yet been merged.
One point deserves special attention for enterprises: the announcement only covers individual Pro and Max subscribers for now. No timeline is given for Claude Enterprise, SSO deployments, or the administrative controls a CISO demands before letting an agent read a team’s inbox. The day Duet targets company accounts will be the real test: the individual governance that impresses today will have to translate into policies, audit logs and centralized revocation.
Verdict
If you are an overloaded professional already paying for Claude Pro or Max, join the waitlist: the marginal cost is zero and the payoff — a morning brief plus a back office that runs while you step away — is concrete. If you handle health or financial data, probe the classifier’s behavior on edge cases before connecting anything. If you want a personal-life agent that books tickets and runs errands, look elsewhere for now: Duet is candid that this is not its target. The real signal of this announcement is not the agent — it is that Anthropic has understood the agent race will be won on trust, not features.