Anthropic opened Claude Duet on October 21, 2026: a research preview of a proactive agent that watches your connected apps, works on tasks from its own computer in the cloud, and asks before it sends, pays, signs or deletes anything. Access is a waitlist for Claude Pro and Max subscribers in the US, in a standalone app on iOS, Android and claude.ai, running on Claude Opus 5.5.
I haven’t used Duet. I read Anthropic’s announcement, product page, safety post and help article on 2026-10-26. The morning brief interests me less than the approval design underneath, because Anthropic documented it in unusual detail and it maps onto problems every agent builder has. Below: the verified facts, five implications, and what I’d do this week.
1. Context: What Anthropic Actually Shipped
Duet is not a new mode inside the Claude app. Anthropic’s own FAQ draws the line: the Claude app waits for you to open a chat, while Duet reaches out to you with updates and approval requests. For now it lives in its own app, separate from the main Claude app, and it brings your Claude memory, skills and connected apps along from the first message.
Fact sheet (checked against Anthropic’s pages)
How I sourced this
Every fact in the sheet comes from four Anthropic pages: the Oct 21 announcement, the product page, the Oct 23 safety post and the help center article. Where only press coverage says something, mostly about OpenAI’s products, I say so in the same sentence. I have not used Duet myself.
Duet also lands in a crowded quarter. OpenAI launched dots, always-on ChatGPT agents with their own cloud computers, at DevDay on September 29, and secondary coverage citing OpenAI’s release notes reports parallel agents for GPT-6 Pro in ChatGPT on October 16. Thurrott names Gemini Spark, Meta Muse, Microsoft Autopilot and OpenAI dots as the field. I compare Duet with dots below because it is the closest product I could document; GPT-6 Pro’s parallel agents split one task across agents you watch in a chat, which is a different shape from a background agent.
2. Five Implications for Builders and Buyers
If you build agent products, Duet is more useful as a published reference design than as a competitor. These are the five points I take from it, from most to least transferable.
Ask-before-acting is a policy, not a modal
Approvals · announcement + safety post
Duet reads, drafts and prepares on its own, but before it sends a message, pays, signs or deletes, it shows the action, the destination, the content and every recipient. Some steps never accept a “don’t ask me again” rule, and some are off-limits even with approval. That is several tiers, not one confirm button.
The judge sits outside the worker
Auto mode classifier · outbound classifier
An action check adapted from Claude Code decides whether a step matches your intent, and Anthropic says it “runs outside the model doing the work so instructions hidden in a page cannot affect the outcome.” A second classifier screens each drafted message for sensitive data, and credentials stay off the agent’s machine behind a proxy.
Background work spends your quota
Usage · five-hour and weekly limits
The morning brief and every check-in count against the same limits as chat, and big jobs such as a financial model or a deck need more model turns. Anthropic checks accounts every few hours precisely so it doesn’t drain plans. If you price an always-on product, idle vigilance is a cost line.
Same category, different trust surfaces
vs OpenAI dots · Sep 29 (press coverage)
SiliconANGLE and The Next Web report that dots let you open the agent’s cloud computer at any time, keep app connections read-only during proactive research, and run risky actions through an auto-review check. Duet can’t show you its browser yet, but publishes a tiered approval and credential design. They expose different controls.
Outside the US, you are watching, not using
Availability · US accounts only
Duet needs a US Claude account, a Pro or Max plan and a waitlist invite, and Anthropic gives no date for other countries. Press coverage says dots also launched without Pro users in the EEA, Switzerland and the UK. For LATAM teams, the practical move is to study the design and build narrower agents on tools you can access.
Approval fatigue is the real failure mode
Anthropic says how often Duet asks for approval is “still changing,” and that its safeguards “will occasionally miss something or flag a harmless message.” Ask too often and people approve on reflex; ask too rarely and one poisoned email does damage. Calibrating that line is product work, not a model setting.
The reason the checks live outside the model is prompt injection. Duet reads email, Slack and web pages, which is untrusted input, and it can send and pay, which is the dangerous half. I walked through that combination, the lethal trifecta, and how approval gates and egress limits break it in my prompt injection deep dive. Duet’s safety post follows the same logic: page text and downloads still reach the agent, and Anthropic says that is exactly why the other checks exist.
3. What Builders Can Copy: Duet’s Permission Tiers
This is how I read Anthropic’s published rules, sorted by how much human attention each tier costs. It works as a template for any agent that touches money or messages.
Works alone: read, check, draft, prepare
Checks connected accounts every few hours, sends the morning brief and returns finished work such as a doc, sheet or deck for review. If you can’t approve right away, it finishes the rest of the task and brings the approval back to you later.
Asks first: send, pay, sign, delete
Shows the action, destination, content and every recipient, then waits. A “don’t ask me again” rule exists, but not for paying or sending money, deleting an order or creating an account: those ask every time.
Needs explicit consent: health and finances
Messages carrying health or personal-finance details go out only if you approved sharing them, and your own request counts as consent. A blocked message can be rewritten without the sensitive part and shown to you for approval.
Never, even with approval
Trading securities, moving money between accounts and accessing someone else’s account. Duet is also instructed not to share sign-in credentials, full card and bank account numbers or government ID numbers, even if you ask.
Money and secrets, handled by design
Purchases use a one-time card, for example from Stripe Link, limited to that merchant and amount. Passwords go into a separate form on your device, encrypted with a single-use key; sign-in tokens are inserted by a proxy outside the agent’s machine, so the model never sees them.
What I could not confirm
OpenAI’s pages blocked my fetches, so the dots details come from SiliconANGLE and The Next Web, and GPT-6 Pro’s parallel agents (Oct 16) only from secondary sites citing OpenAI’s release notes. Reports disagree on how dots usage counts against plan limits. Anthropic publishes no attack-success or classifier-accuracy numbers for Duet, says nothing about what happens to an approval nobody answers, and I found no Duet API or SDK.
Golden rule for agent builders
Let the agent read and draft freely, make it ask before anything leaves the building, hard-block what no approval should unlock, and put the judge outside the model that reads untrusted text.
4. What to Do This Week
Duet itself is a waitlist, and a US-only one. The design is free to study today. This is the week I would run:
☀️ Days 1–2: If you’re eligible
- 1. Join the waitlist with the same email as your Claude account and your phone’s Apple or Google account; the help article ties access to that address.
- 2. Decide which apps Duet may see before you connect anything. You start every connection and can disconnect at any time, but what it already learned stays in memory until you reset it.
- 3. Watch your usage meter for the first days, since background checks bill against the same five-hour and weekly limits as your chats, and use the one-time limit reset before November 30.
📅 Days 3–4: If you build agents
- Inventory: list every tool your agent can call and tag it read, draft, external send, money or irreversible. Anything in the last three needs a gate.
- Approval payload: make each approval show action, destination, content and every recipient, the four things Duet shows. A bare “Allow?” is not an approval.
- Hard blocks: write the short list of actions no approval unlocks and enforce it in code, outside the prompt.
📆 Day 5: Budget and positioning
- Cost: price your own background loop as checks per day × tokens per check × users. Duet’s every-few-hours cadence shows where one frontier lab drew that line.
- Credentials: if your agent signs in anywhere, copy the placeholder-plus-proxy pattern so the model never holds a real token.
- Market: if your users are outside the US, check each vendor’s country list before assuming they have an alternative. A narrow, local agent with clear approvals is a real opening, for now.
To prototype these gates this week, the PreToolUse hook and permission callback in my Claude Agent SDK tutorial are where I would start.
Conclusion
Claude Duet is a US-only waitlist today, and Anthropic is upfront that it can misread a thread, misjudge urgency and miss what arrives between check-ins. As a product, it is early.
As a design document, it is the most useful thing Anthropic published this month: tiered approvals, a judge outside the worker, credentials the model never sees, and a plain statement that background work costs quota. You don’t need an invite to copy any of that.
This week in one screen
Check
- • US account and Pro/Max
- • Usage meter after day 1
- • Limit reset by Nov 30
Copy
- • Four-field approvals
- • Hard-block list in code
- • Judge outside the model
Watch
- • Team, Enterprise, non-US dates
- • Duet safety post updates
- • OpenAI docs for dots
Sources
- Anthropic — Introducing Claude Duet (Oct 21, 2026)
- Anthropic — Claude Duet product page and FAQ
- Anthropic — Claude Duet Safety, Privacy, and Security (Oct 23, 2026)
- Claude Help Center — Get started with Claude Duet
- TestingCatalog — Claude Duet coverage
- Thurrott — Anthropic announces Claude Duet, a personal AI agent
- SiliconANGLE — OpenAI launches dots, always-on AI agents (Sep 29, 2026)
- Pasquale Pillitteri — Parallel agents arrive in GPT-6 Pro (secondary)
