Claude Duet Explained: Anthropic's Proactive AI Agent for Small Businesses and Professionals

*Last updated: November 2, 2026*

On October 21, 2026, Anthropic opened a research preview of Claude Duet, a standalone app in which Claude works as a proactive agent. Duet does more than wait for a prompt. It checks the apps you have connected, writes you a morning brief, prepares work in the background on its own cloud computer, and messages you when something needs a decision. It drafts and prepares on its own, but it asks first before it sends a message, makes a payment, signs a document or deletes anything.

The pitch is aimed at a specific person: the small business owner or professional whose day is spread across an inbox, a calendar, an accounting tool, a CRM and a payment processor, and who has nobody to keep track of all of it. Anthropic's examples are deliberately unglamorous. Duet finds unpaid invoices and drafts the reminders. It prepares payroll and contracts for review. It tracks permits and vendor timelines, catches calendar conflicts, and builds the dashboard you keep meaning to make.

This article covers what is publicly known about two weeks after launch: what Duet does, how the app is organized, what it can and cannot connect to, where Anthropic draws the line between acting and asking, how it keeps your passwords away from the model, who can get it and what it costs, what the first hands-on reviewers found, and how it compares with Meta's Muse and OpenAI's Dots. We build AI agents for a living, and we have read Anthropic's announcement, product page, help-center guide and safety write-up, plus the early reviews. Where something is undocumented, we say so rather than guess.

What Anthropic launched on October 21

Claude Duet is a new app, separate from the main Claude app, with Claude working as an agent that takes the first step. In Anthropic's words, it "keeps working even when you step away, and checks with you before it acts on your behalf." The launch has a few defining parts:

• A proactive agent. Duet sends a morning brief on what needs your attention across your connected apps, checks those apps again every few hours, and contacts you only when something needs you.
• Its own cloud computer. Duet runs on its own virtual machine with its own browser, so a long job keeps going after you close the app or switch your phone off.
• Your existing Claude context. It uses the memory, skills and connectors from your Claude account, so it does not start from zero.
• A clear approval line. Duet prepares work independently but shows you the action and waits before sending, paying, signing or deleting. Some actions are not allowed even if you approve them.
• Claude Opus 5.5 underneath. Duet runs on Anthropic's top model and decides for itself how much effort each job needs. There is no model picker in the preview.

It is available as a standalone app on iOS and Android, and on the web at claude.ai. Access is by waitlist, US only, for Claude Pro, Max and Ultra subscribers. Team and Enterprise plans are not included yet.

Anthropic is unusually direct about the rough edges. Its announcement says Duet "might misread a thread or miscalibrate what's urgent," and that because it is built for work, personal errands such as booking tickets are not "quite as strong." That candor is worth noting, because it tells you what Anthropic thinks the product is for: running the admin side of a business, not booking your weekend.

How Claude Duet works: the brief, the tasks and the Make tab

The app has a simple structure, and it is worth understanding before you hand it anything.

The main thread. You talk to Duet in one conversation, by typing or by voice. You can also open separate channels for different topics (a client, a product launch, the monthly close), and every channel shares the same memory. So what Duet learns in one channel is available in the others.

The morning brief. Each morning, Duet reviews your email and calendar, summarizes what needs your attention, and may take the first step on its own, such as drafting replies for you to look at. Through the day, it checks your connected accounts at intervals. Anthropic describes those intervals as every few hours, a choice made to avoid burning through your usage limits. The trade-off is that something urgent can arrive between checks.

The Tasks tab. This is where ongoing work lives, along with anything waiting on you. Duet can suggest that a task is finished, but only you can mark it complete. That is a small design decision with a big effect. The agent cannot quietly close the loop on work you have not checked.

The Make tab. Larger outputs land here as editable files: research briefs, financial models, slide decks and dashboards. Anthropic's examples include preparing for an investor meeting (assembling the data room and editing the deck), building a daily metrics page, and pulling business health together across point-of-sale, CRM, support and bank data.

Background work. Once a task is handed over, Duet works on its own machine and reports back when the job is done or needs a decision. If it needs your approval and you are busy, Anthropic says it finishes the rest of the task and brings the approval back to you later, so you do not come back to a job stalled on step one.

The shape here is the important part. Most assistants are reactive: nothing happens until you ask. Duet reverses that. It comes to you with a short list of what matters and a draft of what to do about it. Getting that right depends on the agent's memory of your work, which is why we think how agents remember across sessions is the quiet engineering problem behind every proactive product.

What Claude Duet can connect to, and what it can't

Duet reaches your work in two ways: through connectors, and through its own cloud browser for sites that do not have one.

Connectors. Anthropic says Duet can use more than 6,000 connectors and plugins in the Claude Marketplace. The ones it names include Gmail, Google Calendar, Google Drive, Slack, QuickBooks, Stripe, Gusto, HubSpot, DocuSign, Calendly, LinkedIn, Canva, Shopify and Notion. Duet uses the connectors you have already set up in Claude, you start every connection yourself, and you can connect more than one account to the same connector, such as a work and a personal Gmail.

A connector being listed does not guarantee that every operation you need is supported. The help center notes that Slack has limits and that Microsoft 365 is not available yet. If your business runs on Outlook and Teams, Duet is not ready for you.

The cloud browser. For sites without a connector, Duet uses a browser on its own virtual machine. It identifies itself with a distinct User-Agent header, and Anthropic publishes its IP addresses. That is the honest way to run a browsing agent, and it has a cost: Anthropic says some large websites have chosen to block it. We have written about why agentic commerce keeps running into blocked sites, and Duet will run into the same walls.

Payments. Duet can buy things through Link (Stripe's wallet) and Shop Pay, which you set up inside Duet rather than in the connectors directory. You approve each purchase, and Duet pays with a one-time card that works only for that merchant and that amount. Your real card number is never shared. Link needs a US payment method, recurring payments are not supported, and a merchant can still block the checkout.

What it cannot do in the preview. According to the help center, Duet cannot make phone calls or send texts, cannot see your local files or all of your Claude projects, and cannot change work you have done in Claude. You also cannot watch its browser or take it over while it works. Anthropic lists a Shopify visual editor and 1Password sign-in as coming soon.

The approval line: what Duet does alone and what it asks first

The most carefully designed part of Duet is where it stops. Anthropic splits actions into three groups.

Things Duet does on its own. Reading, researching, drafting, analyzing, building files and preparing work. This is the bulk of what it does, and it is why it is useful while you are not looking.

Things Duet asks about first. Before it sends a message, makes a payment, signs a document or deletes anything, Duet shows you the action, where it is going and what it contains (including every recipient) and waits for your approval. For some of these, you cannot tick "don't ask again." Paying, sending money, deleting orders and creating accounts always come back to you.

Things Duet will not do even if you approve. Trading securities, moving money between accounts and accessing someone else's account are off-limits entirely.

There is also a check that does not rely on the model's own judgment. Anthropic says a separate automated classifier, adapted from the auto mode classifier in Claude Code, tests whether each action matches what you actually asked for. It runs outside the model, so hidden instructions on a web page or in an email should not be able to talk it into approving something you did not intend. This is the right architecture. An agent that reads strangers' email will eventually read a malicious one, and the defense has to sit outside the thing being attacked. Manus learned this the hard way a month earlier, as we covered in our Manus Cue explainer.

Anthropic also names the opposite risk: approval fatigue. If an agent asks about everything, people start tapping "approve" without reading, and the approval gate stops protecting anyone. Anthropic says it will keep tuning how often Duet asks. Getting that balance right is the whole game for proactive agents, and it is the part of the design we would watch most closely.

How Duet keeps your passwords and data away from the agent

Anthropic's safety write-up for Duet is built on three principles: handle information with discretion, keep you in control, and keep credentials away from the agent. The credential part is the most technically interesting.

The model never sees your passwords. When Duet needs to sign in somewhere, a form appears inside the Claude app. You type the password there, it is encrypted, and it is passed to the browser unopened. Duet cannot read it and cannot store it in memory. Anthropic adds a useful rule of thumb: the sign-in form only appears inside the app during a sign-in you asked for, so anything else asking for your password is not legitimate.

Sign-in tokens stay off the agent's machine. The agent's environment holds a placeholder, and an outside proxy swaps in the real value when a request is made. So even if something on the agent's machine were compromised, the real tokens are not sitting there to be stolen.

The browser is isolated. It runs in its own cloud virtual machine, separate from the model. The agent controls it through a fixed set of commands, and site code and cookies stay on the browser machine. Page text and downloads do flow back to the agent, which is why the prompt-injection checks still matter.

A classifier checks everything that goes out. Every outgoing message, including files uploaded through the browser, passes a sensitive-information check. Sign-in credentials, full card and bank account numbers, and government ID numbers are never shared, even if you ask. Other private data, such as health or financial details, needs your consent, and your own request counts as consent. If a message is blocked, Duet may rewrite it without the sensitive details and ask you to approve the new version. Anthropic admits the classifier will sometimes miss things and sometimes flag harmless messages, which is why it sits alongside approvals rather than replacing them.

Memory outlives a disconnect. Duet keeps conversation history and memory across tasks until you delete them or reset. Disconnecting an app stops new access, but what Duet already learned from it stays until you reset memory. Deleting your account wipes everything. If you connect a sensitive inbox to try Duet out, plan to reset memory if you decide against it.

On testing, Anthropic says it ran evaluations with innocent, injected and temptation variants of routine tasks, used red teams to probe for data leaks and unapproved actions, and had an external penetration-testing firm review Duet with access to the source code, with a follow-up test of the browser and sign-in form under way. Duet is also in scope for Anthropic's public bug bounty on HackerOne. That is more security documentation on day one than any competing personal agent has published.

Who can get Claude Duet, and what it costs

Eligibility. Duet is a US-only research preview for Claude Pro, Max and Ultra subscribers, by waitlist. Team and Enterprise plans are not included yet. You join from the Duet product page with your name, email, plan and phone type. Invitations go out in waves, and joining does not guarantee a date.

One setup gotcha. Access is tied to the email address you give on the waitlist. If it does not match your Claude account, or the Apple or Google account on your phone, you may not get in. Use the same address everywhere.

Price. Duet costs nothing extra during the preview. It is included in your Claude plan. Pro is $20 a month billed monthly, and Max starts at $100 a month. Anthropic has not said what Duet will cost once the preview ends.

Usage limits are the real cost. Duet draws from your plan's five-hour and weekly limits at the same rate as chat, and its background work, the morning brief and the regular check-ins, counts too. Larger jobs such as financial models and decks use more model turns. That means an agent that checks your accounts while you sleep is spending the same allowance you use during the day. Anthropic gives admitted users one full limit reset, available until November 30, 2026. If you run Duet on a Pro plan alongside heavy Claude use, expect to hit limits. Anyone who has watched an agent quietly burn through a budget will recognize the problem, and our guide to token efficiency in AI agents explains where that spend goes.

What early reviewers found

A handful of people had early access, and their reviews agree on more than they disagree.

Dan Shipper at Every, after two weeks of early access (Anthropic had no input on the review), called Duet the first personal agent he would describe as a "professional tool." He liked how it organizes recurring work into channels, keeps track of what it needs from him, and makes suggestions he actually wants. His complaints were specific: scheduled runs could not use custom connectors, its email drafts were weaker than OpenAI's, it could see the Claude sessions on his computers but not direct them, and voice input was transcription rather than a real voice mode.

Claire Vo on How I AI, writing on October 26, called it beautifully designed and praised the onboarding, which explained clearly what Duet could do and what it could access. Its best result was a sales pipeline analysis that pulled from Slack, email and her CRM quickly, with no manual input. Inbox and Slack triage was "okay, rather than exceptional," with weak prioritization. A ticket purchase she started never completed. Some background jobs took more than ten minutes to finish or come back for permission, and Duet did not reliably bring her back when work was ready. Her summary: "Claude Duet kept track of the work I gave it. I still forgot about the work." She also missed a desktop workflow, found that her local Claude skills did not carry over, and noted that Duet is single-player, with no shared agents for a team.

Taken together, a pattern shows up. Duet is strongest at structured analysis over data it can reach through good connectors, and weakest at the things that need tight follow-through and fast turnaround: triage, errands, nudging you at the right moment. That fits Anthropic's own warning that it might misread a thread or misjudge urgency. It also says something about agent design generally. The hard part of a proactive agent is not doing the work. It is the attention interface: deciding what to bring to the human, when, and in what form.

Claude Duet vs Meta Muse vs OpenAI Dots

Duet arrived third in a crowded autumn for personal agents.

Meta's Muse launched in September 2026 and is aimed mainly at consumers. It rose to the top of Apple's App Store, and on Meta's third-quarter earnings call on October 21, the same day Duet was announced, Mark Zuckerberg said more than 10 million people in the US and Canada had set up Muse personal agents in about a month and a half. Muse's advantage is distribution. Meta has since added a version for small businesses with connections to other apps.

OpenAI's Dots were introduced at OpenAI's developer conference in late September as "always-on agents" that run on dedicated cloud computers and take on ongoing work, aimed at both businesses and consumers. Dan Shipper, who has used both, rated OpenAI's email drafts above Duet's.

Manus Cue, launched on September 28, takes a different approach. Each Cue agent gets its own email address, phone number, wallet and computer, and several agents can work as a team in a group chat.

Where does that leave Duet? It is the most work-focused of the group, and the one with the most explicit trust architecture: a published approval line, a hard list of things it will never do, credentials kept out of the model's reach, and a security write-up with external testing behind it. Its weaknesses are just as clear. It is US-only, waitlisted, Pro-and-above, single-player, cannot call or text, and draws on the same usage limits as the rest of your Claude work. If your business already lives in Claude, with its connectors, memory and skills, Duet is the natural agent to try. If you want an agent that phones the plumber, it is not that.

What Claude Duet still can't do

It is a research preview, so the gaps are expected, but they are worth listing in one place before you decide what to hand it:

• No phone calls or texts. Anything that runs on a phone line is out.
• No Microsoft 365. Outlook and Teams users have to wait.
• No watching or taking over the browser. You see the results and the approvals, not the clicks.
• No local files, and no full view of your Claude projects.
• No team use. Team and Enterprise plans are not included, and there is no shared agent for a team.
• Gaps between checks. Duet checks every few hours, so time-critical alerts still belong in a conventional notification.
• Weaker at personal errands. Anthropic says so itself, and reviewers' ticket-buying attempts bear it out.
• Shared limits. Background work spends the same allowance as your chats.

What Claude Duet means for small businesses

If you run a small business and you get in, the useful question is not "what can Duet do?" but "which responsibility can I safely hand it first?" A sensible way to start:

1. Pick one recurring responsibility. Chasing unpaid invoices, preparing tomorrow's meetings or a weekly metrics summary. Something with a clear right answer you can check.
2. Connect only what that job needs. Every connection widens what the agent can read, and what it remembers after you disconnect.
3. Check the first briefs against the source. Open the real email thread and the real invoice list. Find out where it misreads before you rely on it.
4. Keep urgent things on a real alarm. A check every few hours is not an on-call system.
5. Watch your limits for the first week. Background checks are the cost you do not see.

The opportunity is real. Most small businesses do not need a general-purpose AI. They need someone to notice the overdue invoice, the double-booked Thursday and the contract still waiting for a signature. A proactive agent with a strict approval line is a reasonable shape for that job. We have written about where AI agents actually add value and where they only add noise, and Duet's sweet spot sits squarely in the first group.

What Claude Duet means if you build agents

For anyone building agents, Duet is a useful reference design, regardless of whether it wins. A few patterns are worth borrowing directly:

Draw the action line explicitly. Act alone on reads and drafts. Ask before sending, paying, signing or deleting. Refuse a short list of things outright. Make some approvals impossible to waive. Write this down as a policy, not as a prompt.

Keep credentials out of the model's environment. Password entry in a separate form the model never reads, and tokens swapped in by a proxy at request time. If your agent can see a secret, assume an attacker can eventually get the agent to repeat it.

Put the safety check outside the model. An intent classifier that sits outside the model cannot be persuaded by the email it is reading. Pair it with an outbound sensitive-data check on everything leaving the system.

Let the human close tasks. "Only you can mark it complete" is a small rule that stops an agent from declaring victory on unchecked work.

Budget the background. Every proactive check costs tokens. Duet's every-few-hours rhythm is an explicit trade between freshness and cost, and your agent needs the same decision made deliberately rather than by default.

None of these are new ideas, but Duet is the first mass-market product to ship all of them together and document them publicly. That raises the bar for every agent that touches a customer's inbox or wallet, including the ones we build in our AI agent development work.

Claude Duet is two weeks old, waitlisted, US-only and still rough at the things a proactive agent most needs to get right: triage, follow-through and knowing what is urgent. Anthropic says as much itself. But the architecture underneath is the most carefully reasoned of this autumn's personal agents. It acts alone on reads and drafts, asks before anything that leaves the building, refuses a short list of things outright, and never lets the model hold your passwords.

For small businesses, that makes Duet worth trying on one narrow, checkable responsibility, such as invoices, meeting prep or a weekly metrics page, with only the connections that job needs. For agent builders, it is a reference design worth studying whether or not Duet itself wins the category.

Building an agent that needs to act on your customers' behalf? Talk to our team and we will help you design the approval line, credential handling and audit trail before the features.