On October 21, 2026, Anthropic began a research preview of Claude Duet, an AI agent that autonomously monitors the state of your work and contacts you when needed. It is available through a waitlist to subscribers on the US Pro and Max plans. While the standard Claude acts on instructions from the user, Duet keeps working on a dedicated virtual machine and proactively delivers things like a morning work briefing and important notifications during the day. It can keep work moving while you are away from your computer or smartphone, but actions such as sending messages to outside parties or making payments require your approval. The aim is a new kind of AI agent that combines autonomous work with actions that still require human judgment.
Works even when your devices are off, but checks information only every few hours
Claude Duet runs on a dedicated virtual machine equipped with a browser, so it can keep working even when your computer or smartphone is turned off. It is built on Claude Opus 5.5 and carries over the memory, skills, and connected apps saved in your existing Claude account. Interactions are consolidated into a single continuous thread that supports both text and voice, so you can give instructions through the same thread whether the request is a quick everyday task or long-running work.
However, running in the background does not mean Duet monitors your connected sources in real time. According to Anthropic's official announcement, Duet checks connected information roughly once every few hours. Checking constantly would quickly use up the usage allowance assigned to your plan. The product FAQ also explains that information arriving between checks may be missed. Being able to keep working without depending on your devices is therefore not the same as detecting new information instantly.
The table below summarizes how Duet behaves, as described in the announcement, in terms of executing work, checking information, and user approval.
| Type of action | Research preview specification | Points to note |
|---|---|---|
| Continuing requested work | Runs on a dedicated virtual machine and browser | Your devices don't need to stay on |
| Checking connected information | Checks every few hours and notifies you of content it judges necessary | Instant detection of new information is not guaranteed |
| Actions on external services | Shows you the content and waits for approval before sending, paying, signing, or deleting | Preparing work and the final decision to execute can be separated |
This difference matters when choosing what to hand over to Duet. For example, an environment independent of your devices is useful for drafting materials by the next morning or gathering information from multiple services into a report. On the other hand, the interval between periodic checks could be a constraint for work that demands decisions within minutes, such as responding immediately to important messages. Users can specify what they want to be notified about and how often, but Duet's ability to judge the importance and urgency of information is still being improved.
From chasing invoices to payroll processing, key actions require approval
Claude Duet can use a range of business services through more than 6,000 connectors and plugins offered in the Claude Marketplace. Use cases Anthropic highlights include checking important messages missed in Gmail or Slack, investigating unpaid invoices and drafting reminder emails with QuickBooks and Stripe, and preparing payroll processing with Gusto. It also supports reviewing and signing contracts with Docusign, and following up with prospects using contacts and deal history stored in HubSpot. Its strength is gathering information scattered across multiple apps and moving forward on the preparation that work requires.
Still, collecting information and drafting documents are clearly distinguished from carrying out actions on the user's behalf outside the system. Duet can autonomously check email and draft documents, but when sending a message or making a payment, it presents the specific content to the user and asks for approval. Signing documents and deleting data are also among the actions that require approval. In addition, trading securities and transferring money between bank accounts are restricted and cannot be performed even if the user grants permission.
For online shopping, Duet also supports purchases using Link, the digital wallet from Stripe. After confirming the item to be purchased with the user, Duet requests spending approval through Link and pays with a virtual card. The system is designed so that payment can be made without handing the merchant your actual card number. Shopify's Shop Pay can also be used for checkout at online stores.
Not every announced feature is available at the start of the research preview, however. For example, signing in to websites using login credentials stored in 1Password is planned for a future update. Duet also has features for designing and managing Shopify stores, but an advanced visual editor that lets users fine-tune details while previewing the look before publishing is planned for later. It is important to distinguish between features available now and those still in development.
This design means that, for example, you can leave everything from checking unpaid invoices to drafting reminder emails to Duet while still deciding yourself whether to actually send them to customers. The division of roles is that AI takes over the work of opening multiple services and gathering information, while humans handle external communication and decisions involving money. The goal is to advance automation while keeping the user in control of important actions.
Isolating credentials and verifying actions to ensure safety
For AI agents like Claude Duet that read emails and web pages from outside sources and operate other services based on their content, security measures are especially important. One example is prompt injection, in which an attacker embeds malicious instructions in an email or web page to get the AI to carry out actions different from what was originally requested. In an ordinary chat AI, this might cause inaccurate answers, but in an agent that can operate external services, it could lead directly to information leaks or unintended actions. Anthropic says it combines multiple defenses to address these risks.
First, Duet is designed not to directly access users' passwords or sign-in tokens. Anthropic says credential management uses the mechanism adopted in its Claude Managed Agents. According to the technical explanation of Managed Agents, authentication tokens are isolated from the environment where AI-generated code is executed, and the OAuth tokens needed to operate external tools are managed in a secure storage area. When accessing external services, a dedicated proxy retrieves the necessary credentials and calls APIs and the like. This lets the system use connected services without handing credentials to the AI itself.
However, hiding credentials alone does not prevent the risk of the AI performing actions it is not permitted to. Duet therefore determines whether an action may be executed using a classifier also adopted in Claude Code's "auto mode." Anthropic's explanation of auto mode describes a mechanism that limits the information used for the decision to the user's messages and the action to be executed, and does not pass the AI's own explanations or information returned by tools to the classifier. The aim is to prevent statements the AI generates itself, such as "this action is safe," or instructions embedded in externally retrieved web pages, from being treated as grounds for permitting an action.
That said, these are descriptions of existing technologies that Duet draws on; the full internal configuration of Duet and the defensive performance specific to the product have not been disclosed. In its explanation of auto mode, Anthropic itself acknowledges that errors remain in judging whether an action falls within the scope the user has approved. Introducing classifier-based decisions does not mean inappropriate actions can be prevented completely.
Duet additionally includes a dedicated classifier that inspects message content, along with a system prompt intended to ensure safety. For information that requires especially strict protection, such as credit card numbers and government-issued ID numbers, it is designed to refuse to share them even if asked. Health information and personal financial information may be shared only when the user explicitly instructs it to be sent.
In this way, Duet's safety measures consist of multiple layers: a mechanism that isolates credentials from the AI, one that assesses the validity of actions to be executed, and one that inspects information sent externally. Each addresses a different risk, but there is no guarantee that they can stop every threat. Anthropic itself explains in its article on trustworthy AI agents that layering defenses does not guarantee complete protection. The more external services become available, the more important it becomes for users to decide which information to allow access to and which actions to delegate.
Usage limits shared with standard Claude; practicality depends on what you delegate
During the research preview, Claude Duet shares the usage allowance of Pro and Max plans with standard Claude. Because the periodic background checks also consume the allowance, the amount of processing available in standard Claude may decrease while Duet is running. Complex work such as building financial models or creating slide decks in particular increases interactions with the model and internal processing, and consumes more of the allowance. Being able to use it on an existing plan is not the same as being able to keep working without limits.
For the time being, it is offered as an app independent of standard Claude. Dedicated apps are available for iOS and Android, and it can be used on a computer through claude.ai. However, the research preview is limited to US Pro and Max subscribers and does not include Team and Enterprise plans. No launch timing in Japan has been announced at this point.
Anthropic also acknowledges that Duet is still an early-stage product and may misunderstand conversations or fail to judge the urgency of information appropriately. Because it is designed mainly for work-related uses, it is also not necessarily good at personal errands such as booking tickets. At this stage, users cannot directly view the browser screen Duet is operating. Beyond being able to work autonomously, how much of the intermediate processing users can follow also affects whether they feel comfortable entrusting work to it.
In judging Duet's practicality, what matters more than the number of available connectors is how much work can be delegated and how little effort it takes to verify the results. Choosing tasks that can tolerate checks every few hours, and keeping key decisions such as external sending and payments in the user's hands, could improve work efficiency. On the other hand, if the usage allowance consumed by periodic checks or the burden of verifying what the AI compiled is large, the benefits of automation will fade. Whether an autonomously operating AI agent can do more than simply stand in for people, reducing the time spent on gathering information and preparing so users can focus on more important decisions, is what this research preview will put to the test.