Claude Duet: Anthropic's Proactive Agent Preview and the Design Choices Builders Can Learn From

Anthropic opened a research preview of Claude Duet on October 21, an app where Claude acts as a proactive agent. It reads your connected apps, sends a morning brief, works in the background on a virtual machine, and asks for approval before it sends a message, makes a payment, signs a document or deletes anything. Access is by waitlist, starting with US Pro and Max subscribers.

I read Anthropic's launch post, Introducing Claude Duet. I found it through the TLDR AI newsletter of October 22. I have not used the product, and everything below is Anthropic's description. The post also says more safety details are coming "in the coming days," so some of this may change.

What Anthropic says it is

• A standalone app on iOS and Android and on claude.ai, built around Claude Opus 5.5.
• Included in Pro and Max plans for the preview, sharing the same usage limits as the rest of Claude. Background checks count toward those limits.
• Aimed at professionals and small business owners.
• It carries over your memory, skills and connected apps from your Claude account.
• It has its own virtual machine with a browser, so work continues when your laptop or phone is off.
• It checks connected accounts "every few hours," which the post says is a deliberate choice because constant checking would burn through plan limits.
• It can use more than 6,000 connectors and plugins from the Claude Marketplace.

The design choices worth studying

These are the parts of the post I think matter for anyone building an agent. The claims are Anthropic's.

Approval before side effects. The post says Duet reads, drafts and prepares on its own, but shows you exactly what it is about to do and waits before it sends a message, makes a payment, signs a document or deletes anything. Some actions are off-limits even with approval, such as trading securities or moving money between accounts.

Credentials it never sees. Handling follows the design Anthropic uses for Claude Managed Agents, so the agent "never directly sees" passwords or sign-in tokens. For purchases, it says Duet confirms the item, then Link (Stripe's wallet) asks you to approve and pays with a virtual card, so your real card number is not shared. It can also use Shop Pay. Signing in with logins saved in 1Password is described as coming soon.

A separate check on outgoing information. The post describes a new classifier and safety system prompt that checks each message and is designed to reject requests to share the strictest tier of information, including card numbers and government IDs. Other sensitive information, such as health or finances, goes through only when you explicitly instruct it. The post says this is still being strengthened.

Layered security. It cites an action-approval classifier (auto mode), prompt-injection defenses from browser-use research, red-team and external penetration testing, and coverage by the public bug bounty program. These are listed as claims. The post does not give test results.

Notification judgment as a tunable. Anthropic says it is still testing when the agent should message you, and you can tell it what to report and how often.

What Anthropic admits

The post says Duet "still might misread a thread or miscalibrate what's urgent," is weaker at personal errands such as booking tickets, cannot yet show you its browser, and lives in its own app, separate from the main Claude app.

Testimonials

The post includes quotes from internal users and early small business owners. These are vendor-selected examples, not measurements. I would not treat them as evidence of reliability.

What I would take from it

These are my own suggestions for builders, not tested advice.

1. Gate irreversible actions by category, as the post describes: sending, paying, signing, deleting. Show the exact action before it runs.

2. Keep secrets out of the model's view where you can, using tokens or virtual cards that limit damage if something goes wrong.

3. Treat outgoing data as its own risk. An agent that reads mail and sends messages decides where information goes all day. A separate check on outputs is worth considering.

4. Set the polling rate on purpose. Checking every few hours is a cost and quality tradeoff, and Anthropic names it as one.

5. Tell users what the agent cannot do yet, as the post does.

What I would not conclude

• That the safeguards work as described. Anthropic has not published results in the post I read.
• That the product is available to you. It is a US waitlist for Pro and Max.
• That usage costs are small. The post says background checks and big tasks use plan limits.

Frequently asked questions

What is Claude Duet?

A proactive agent app from Anthropic, in research preview, according to its launch post.

Who can use it?

Pro and Max subscribers in the US, by waitlist, to start.

What will it ask me about?

Per the post, before it sends a message, makes a payment, signs a document or deletes anything.

How often does it check my apps?

Every few hours, according to Anthropic.

Can it spend money?

The post says it can purchase things through Link or Shop Pay, with your approval. Trading securities and moving money between accounts are off-limits.

Does it see my passwords?

Anthropic says it never directly sees passwords or sign-in tokens.

What are the known limits?

It may misread threads or urgency, is weaker on personal errands, and cannot yet show its browser, per Anthropic.

Sources

• Anthropic, Introducing Claude Duet (October 21, 2026): all claims above. Linked safety pages not opened.
• TLDR AI newsletter, October 22, 2026: discovery pointer only.