Anthropic Claude Duet

From PRIMO.ai
Jump to navigation Jump to search

YouTube ... Quora ...Google search ...Google News ...Bing News


Claude Duet is a standalone app from Anthropic in which Claude acts as a proactive agent: instead of waiting for someone to open a chat and type a request, it watches the apps a person has connected, surfaces what needs their attention, takes on assigned work, and keeps going after the app is closed. Anthropic opened Duet as a waitlisted research preview on October 21, 2026, for Claude Pro and Max subscribers in the United States, with dedicated apps for iOS and Android and access through claude.ai on the web. The product runs on Claude Opus 5.5, Anthropic's top-tier large language model at launch, and it is aimed at professionals and small business owners who are juggling more obligations than they can comfortably monitor. During the preview it costs nothing beyond the existing subscription, but everything it does, including its background checks, draws on the same usage limits as the rest of Claude.

Duet's defining change is who starts the conversation. Each morning it sends a short brief on the most important items across a person's email, calendar, and other connected tools, then revisits those tools every few hours and messages the user only when something needs a decision. People hand it work by text or voice, from scheduling a meeting to building a dashboard, a sales forecast, a prototype, or a web app, and it carries out that work on its own cloud computer with a built-in browser. Before it sends a message, makes a payment, signs a document, or deletes anything, it shows the user exactly what it intends to do and waits for approval, and a few actions, such as trading securities or moving money between accounts, are off-limits even when the user approves.

Duet is the newest step in a lineage that began with Claude Code, Anthropic's developer agent, and continued through Claude Cowork, which brought the same agent loop to everyday office work in January 2026 and was folded into the main Claude experience in September 2026. Duet inherits the memory, skills, and connected apps a person has already set up in Claude, so setup takes little effort, but it lives in its own app for now, and Anthropic says early feedback will decide how the two products fit together. It also arrives in a crowded field of always-on personal AI agents, including Google Gemini Spark, Meta Muse, and OpenAI dots, and Anthropic has positioned it as a work tool with an unusually explicit safety architecture rather than a general-purpose personal companion.


Claude Code taught Claude to do the work when asked, and Cowork carried that agent loop to everyone's files and inboxes; Claude Duet turns the conversation around, so the agent watches the work, comes to you with what matters, and waits for your approval before anything consequential happens.


The Mechanism: How Claude Duet Works

Duet combines three ideas that appeared separately in earlier Claude products: a persistent agent that can run long tasks in the cloud (from Cowork), a large library of connectors and skills that give it reach into business software (from the Claude plugin ecosystem), and a scheduler that wakes the agent without a human prompt. Practitioners call this pattern an ambient or proactive agent, a term championed in 2025 by Harrison Chase of LangChain to describe systems that respond to events in the background while people review their work through an inbox of pending decisions. Anthropic's bet is that judgment, more than tool access, is what makes such an agent useful: deciding what deserves a person's attention, what can wait, and what should be prepared in advance. Mike Krieger, the Instagram co-founder who now builds products at Anthropic, credited Opus 5.5 as the company's first model with "the judgment to be proactive in the right ways."

The Proactive Loop: Briefs, Check-ins, and Tasks

The day begins with the morning brief. Duet reviews the user's email and calendar, highlights priorities, and may start on first steps, such as drafting replies, so that items arrive ready for review rather than merely flagged. This is automated summarization combined with triage: the agent must decide which of dozens of messages represent real obligations, which are informational, and which can safely be ignored. Anthropic's launch examples include catching a misdated property showing for a real estate broker and flagging a client call that conflicted with the user's flight.

Through the rest of the day, Duet checks connected accounts at set intervals of every few hours rather than continuously. Anthropic explains the choice in economic terms, since constant polling would burn through a subscriber's plan limits far faster. The trade-off is that Duet operates under partial observability: an urgent message that lands just after a check may sit unseen until the next one, a gap the help center acknowledges directly. Users can tell Duet what they want to hear about and how often, which lets them tune the balance between responsiveness and usage cost.

The interface centers on a single main thread, which stays quieter than a typical chat log because Duet posts there mainly when a task finishes or needs a decision. Users can open additional channels for separate topics, and every channel shares the same memory, skills, and connectors, while requests can be typed or sent as voice notes. A Tasks tab tracks everything Duet is working on and highlights items awaiting input, and only the user can mark a task complete, even when Duet believes the job is done. Larger deliverables, such as briefs, financial models, slide decks, and dashboards, appear in a Make tab for review, and whenever Duet reports numbers or summaries it names the email, file, or spreadsheet they came from.

Cloud Computer, Browser, and Model

Duet runs on its own virtual machine with a browser in Anthropic's cloud, so the user's laptop or phone does not need to stay on. When a service has a connector, Duet uses it; when it does not, Duet opens the site in its cloud browser and works through it the way a person would. That browser runs on a separate, dedicated machine isolated from both the model and the agent's working computer, and the agent can drive it only through a fixed set of commands such as opening a page, clicking, or typing. Site code, cookies, and downloads stay on the browser machine, while page text flows back to the agent so it can use the content.

Duet identifies itself to websites with a distinct User-Agent header and publishes the IP addresses it browses from, and Anthropic says it contacted several large websites before launch, some of which chose to block the agent. This openness matters for web automation etiquette, because sites can recognize and govern agent traffic instead of mistaking it for a human visitor or a scraper. During the preview, however, users cannot watch the browser work or take control of it, which sets Duet apart from OpenAI's dots, whose users can open the agent's computer to inspect its work.

The model is fixed as well. Duet always runs on Claude Opus 5.5 and decides for itself how much reasoning effort each job needs, so a quick reply and a week-long project both start in the same thread. Choosing Anthropic's most capable model rather than a cheaper one signals that the company treats proactive work as a judgment problem: misreading the urgency of an email or the intent of a thread costs more when an agent acts unprompted than when a chatbot simply answers a question. Anthropic nonetheless warns that Duet can misread threads or misjudge urgency, and it recommends reviewing drafts and approval requests before confirming them.

Memory, Connectors, Skills, and Payments

Duet carries over the user's memory, skills, and connected apps from their Claude account, which is why Anthropic describes setup as requiring minimal work. Claude's memory has worked across chat and Cowork since August 25, 2026, organized into editable Topics, and Duet can also search past conversations, including its own chats and Claude chats outside projects, to pick up context from earlier work. This past-chat search is a form of retrieval over the user's own history, and it follows the same chat search setting as Claude, so switching it off under Settings also stops Duet from using it.

Through the Claude Marketplace, Duet can draw on more than 6,000 connectors and plugins. Anthropic's launch materials describe work across Gmail and Slack (finding missed messages and drafting replies), QuickBooks and Stripe (checking for unpaid invoices), Gusto (preparing payroll for review), LinkedIn (posting a job listing once approved), Docusign (sending agreements for signature), HubSpot (drafting follow-ups from deal history), Canva (turning a product launch into a social campaign), and Shopify (setting up and running a store). Plugins such as a small business plugin bundle related skills for a role, and Duet can suggest plugins that suit a user's work. Connections are shared between Claude and Duet, so turning an app off in one place turns it off in both.

Duet can also make purchases. It pays through Link, Stripe's digital wallet, or Shop Pay, Shopify's wallet, and every purchase uses a one-time virtual card restricted to a single merchant and amount, so the user's real card number is never exposed to Duet or to the merchant. The user sees the item and total and confirms the purchase in the wallet app, and Link and Shop Pay are set up inside Duet rather than through Claude's connector directory. Anthropic lists sign-in through 1Password as coming soon, which would let Duet use saved logins without any credential passing through the model.

Building Blocks

Component What It Does Preview Notes
Morning brief Reviews email and calendar each morning, highlights priorities, and may start drafting replies. Users can change what Duet reports and how often.
Check-ins Revisits connected accounts at set intervals and messages the user only when something needs attention. Every few hours rather than continuous; urgent items can arrive between checks.
Main thread and channels One ongoing conversation by text or voice, plus optional topic channels. Channels share memory, skills, and connectors.
Tasks tab Tracks work in progress and flags items that need input. Only the user can mark a task complete.
Make tab Holds finished deliverables such as briefs, financial models, decks, and dashboards. Duet names the source email, file, or spreadsheet behind figures it reports.
Cloud computer and browser Runs tasks on Anthropic's servers and browses sites that lack connectors. Users cannot yet watch or take over the browser.
Connectors and plugins More than 6,000 integrations from the Claude Marketplace. Slack works with limitations; Microsoft 365 is not yet available.
Memory and chat search Inherits Claude memory and searches past chats for context. Governed by the same settings as Claude.
Payments Buys approved items through Link or Shop Pay. One-time card per purchase; 1Password sign-in coming soon.
Approvals Shows the exact action, destination, and content before sending, paying, signing, or deleting. Some actions remain off-limits even with approval.

The Physics: Safety, Privacy, and Security

Giving an autonomous agent standing access to email, calendars, payments, and business software trades convenience against real security risk. Security researcher Simon Willison has named the most dangerous combination the "lethal trifecta": access to private data, exposure to untrusted content, and the ability to communicate externally. A proactive agent like Duet has all three by design, since its job is to read a person's inbox and the open web and then send messages and make purchases on their behalf. Anthropic's response, laid out in a safety, privacy, and security article published October 23, 2026, is defense in depth: safety training in the Claude model itself, safeguards inherited from Claude Code and Claude Managed Agents, and new protections built specifically for an agent that works across accounts.

Anthropic organizes Duet around three principles. The first is discretion, meaning that information about the user, and information other people share in the user's connected apps, should be handled with care. The second is control, meaning that the user decides what Duet does on their behalf, and the third is credential isolation, meaning that Duet never sees passwords, browser cookies, sign-in tokens, or other credentials. These principles extend a framework for safe and trustworthy agents that Anthropic published in 2025, which treats human control, privacy, and secure interactions as baseline requirements, and they sit on top of the training methods, such as Constitutional AI and reinforcement learning from human feedback, that teach Claude to refuse harmful instructions in the first place.

Approvals and the Out-of-Model Action Check

Before Duet sends a potentially sensitive message, makes a payment, signs a document, or deletes anything, it displays the action, the destination, and the complete content, including every recipient, and then waits. If the user cannot respond right away, Duet finishes the rest of the job and returns to the approval later, so one pending decision does not stall unrelated work. Scheduled routines that run while the user is away follow the same rules, and certain actions, including payments, sending money, deleting an order, and creating an account, can never be placed under a "don't ask again" rule. This is a human-in-the-loop design applied to individual actions rather than to model training.

Alongside each action, a separate automated check judges whether the action matches what the user actually asked for. It is derived from the auto mode classifier Anthropic built for Claude Code and extended for Duet, and because it runs outside the model, instructions hidden in a web page or email cannot answer an approval prompt or sway its verdict. A short list of actions is prohibited no matter what the user says: trading securities, moving money between accounts, and accessing someone else's account. Anthropic also acknowledges the problem of approval fatigue, in which frequent prompts train people to click through without reading, and says it is still calibrating how often Duet asks.

Credentials, Passwords, and Tokens

Duet borrows its credential design from Claude Managed Agents, Anthropic's hosted agent platform for developers. In an April 2026 engineering post, Anthropic described splitting an agent into a "brain" (the model plus the harness loop that calls it) and "hands" (sandboxes and tools), with credentials kept in a vault outside the sandbox and injected by a proxy only when an external call is made. The goal is that a prompt injection, which can influence what the model writes, can never reach a secret, because the secret never exists anywhere the model's output can touch. The same post reports that decoupling the harness from containers cut median time-to-first-token by roughly 60 percent and the 95th-percentile figure by more than 90 percent.

Duet applies this pattern at several points. Real sign-in tokens never enter the agent's working machine, which holds only placeholders, and a proxy outside that machine swaps in the real value when a request goes out. When a website asks for a password, the user types it into a form inside the Claude app that encrypts it with a single-use key held only by the secure browser machine, so the password travels through the model sealed and only the browser can open it and enter it on the site. To blunt phishing, that sign-in form appears only inside the app, during a sign-in the user requested, and never arrives through a link, a text message, an email, or another website.

Sensitive-Information Classifier

Because Duet reads messages that contain other people's private details, Anthropic built a new classifier that runs separately from the main model and screens every message Duet is about to send, along with files it uploads through its browser. The classifier sorts sensitive content into two tiers. The strictest tier, covering sign-in credentials, full card and bank account numbers, and government ID numbers, is never shared even when the user asks, while the second tier, which includes health and financial details, is shared only with explicit consent. A user's own request counts as consent, so a note to a dentist describing tooth pain generally needs no extra approval.

When a message is blocked, Duet can rewrite it without the sensitive material and ask the user to approve the new version. Anthropic is candid that the classifier will sometimes miss things and sometimes flag harmless messages, which is why it works alongside the approval system rather than replacing it. This reflects a broader lesson of privacy engineering: probabilistic filters reduce risk but cannot eliminate it, so they work best as one layer among several.

Prompt Injection and Browser Isolation

Prompt injection, in which malicious instructions are hidden inside content an agent reads, remains unsolved across the industry, and Anthropic states plainly that Duet can still be targeted. Duet is designed to treat email and web content as information rather than instructions, its injection defenses draw on Anthropic's browser-use research, and it follows the same trustworthy-agent framework as Claude Code and Claude in Chrome. The structural protections arguably matter more than any single filter: the out-of-model action check cannot be argued with by page text, the fixed browser command set limits what a hijacked agent could attempt, cookies never leave the isolated browser machine, and every consequential action still requires a human decision. Willison has argued since 2023 that a filter that catches most attacks is still a failing grade in security, and Duet's layered design is an attempt to limit the damage when a filter does fail.

Testing and Assurance

Anthropic's safeguards team built evaluations from routine-style tasks, each in three versions (an innocent one, one carrying injected instructions, and one that tempts the agent to overstep), and runs them alongside shadow traffic drawn from real use. Red teams probed for information leaks, actions taken without approval, and responses to malicious prompts, simulating the adversarial attacks a real attacker might attempt, and built a threat model covering the whole system. An outside penetration-testing firm examined Duet with access to its source code, a follow-on engagement is covering the cloud browser and sign-in form, and Duet falls within Anthropic's public bug bounty program on HackerOne. These practices align with AI verification and validation and adversarial defense methods used for other high-stakes systems, although Anthropic has not published quantitative results such as attack success rates.

Safeguard Threat Addressed Residual Risk
Human approval gates Unwanted sends, payments, signatures, and deletions Approval fatigue; users confirming without reading
Out-of-model action check Actions the user never requested, including those triggered by injected instructions Classifier errors; novel attack patterns
Prohibited actions list Securities trades, transfers between accounts, and access to other people's accounts Narrow scope; other harmful actions remain possible with approval
Credential vault, proxy, and encrypted password form Theft of passwords and tokens through prompt injection Phishing outside the app; compromise of the user's own accounts
Sensitive-information classifier Leaks of IDs, card numbers, and health or financial details False negatives and false positives
Isolated browser machine Cookie theft and malicious site code Page text still reaches the agent
One-time virtual cards Card number exposure and overcharging Wrong product, store, or option selected
Red teams, penetration testing, and bug bounty Unknown vulnerabilities No published metrics yet

Why This Matters

Duet represents a shift in the basic contract between people and AI assistants. For most of the history of conversational AI, the human noticed a problem, gathered context, opened a chat, and asked for help, whereas Duet moves the starting point to the agent, which notices the problem first. When it works, the value lies less in any single task than in the mental load it removes, because the user no longer has to remember to check a dozen tools when something trustworthy is checking for them. When it fails, the costs are equally distinctive: missed urgent items, noisy alerts, and usage limits drained by check-ins nobody needed.

Anthropic aimed Duet squarely at professionals and small businesses, a segment that usually lacks IT staff, operations teams, and integration budgets. One early tester, the owner of the South Florida restaurant group Shahs of Kabob, uses it for accounting, customer support, and marketing, and worked through his invoices one location at a time, summing up the benefit as "I don't need to open up 100 tabs." These jobs closely resemble what Cowork users were already doing: Anthropic's analysis of 1.2 million Cowork sessions from May 2026 found that business process and operations work accounted for 33.4 percent of usage, more than any other category. Duet extends that back-office role by removing the need for the user to remember to ask.

For software vendors, Duet hints at a structural change in how customers reach their products. One small-studio founder argued that agents like Duet turn a user's apps into a back office that the agent polls on a schedule, so the person may stop visiting the app at all. That shift rewards products with strong connectors, concise "what changed since" interfaces, and write operations split into draft and confirm steps, and it echoes the investor anxiety that followed Cowork, whose January launch and open-source plugins were widely cited as a trigger for a selloff in software and data stocks in early February 2026 estimated at about $285 billion.

Competitive Landscape

By the time Duet launched, the always-on personal agent had become one of the most contested categories in AI. Google announced Gemini Spark at I/O on May 19, 2026, as a 24/7 agent built on Gemini 3.5 Flash and the Google Antigravity agent harness, running on Google Cloud virtual machines. Grok Bot entered beta on August 11 as a team of always-on agents that sign in to apps and operate them the way a person would, Meta's Muse launched in the United States on September 8 and climbed to the top of the U.S. App Store within about ten days, and OpenAI introduced dots at DevDay on September 29. TechCrunch observed that many of these rivals, like Duet, increasingly target business work, and general-purpose cloud agents such as Perplexity Computer and Manus compete for overlapping tasks, as does Microsoft's Copilot Cowork, an enterprise agent built in close collaboration with Anthropic and announced on March 9, 2026 (see Microsoft Copilot Autopilot).

Agent Developer Announced Model Access at Launch Notable Traits
Gemini Spark Google May 19, 2026 Gemini 3.5 Flash Google AI Ultra subscribers, starting in the U.S. Runs on Google Cloud virtual machines; deep Gmail and Workspace integration; MCP for third-party apps
Muse Meta September 8, 2026 Muse Spark Free in the U.S. Private virtual machine; payments through Stripe, Shop Pay, and PayPal
dots OpenAI September 29, 2026 GPT-6 Astra ChatGPT Pro and Business Premium Each dot has its own cloud computer that users can inspect; chatting with a dot does not count toward ChatGPT limits
Claude Duet Anthropic October 21, 2026 Claude Opus 5.5 U.S. Pro and Max subscribers by waitlist Interval check-ins; approval gates; credential isolation; shares Claude usage limits

Compared with some rivals, Duet launched with tighter limits, such as interval checks instead of continuous monitoring, no live browser view, and a U.S.-only waitlist, paired with a detailed public account of its safeguards. Its price position is also distinctive, since it is included in the $20 Pro plan during the preview, while OpenAI's dots launched on plans starting at $100 a month. For side-by-side comparisons of agents that are ready to use without development work, see Ready-to-Use AI Agent Comparison.

Anthropic's Family of Agents

Duet is one of several agent surfaces Anthropic now offers, and each gives a different answer to two questions: who starts the work, and where it runs. Claude Tag, launched on June 23, 2026, as a research preview for Team and Enterprise customers, is Duet's closest sibling. Anthropic describes Tag as an evolution of Claude Code that is more proactive and built for teams: it joins Slack as a member, takes tasks when someone tags @Claude, follows up on threads that have gone quiet, and flags relevant updates unprompted. Duet applies a similar kind of initiative to one person's working life rather than a shared channel, which suggests Anthropic is pursuing proactivity on both the team and the personal front.

Product Primary User Where It Runs Who Initiates Work
Claude Code Developers Terminal, IDE, desktop, and cloud The developer, on request
Claude (with Cowork capabilities) Knowledge workers Desktop, web, and mobile; new Pro and Max tasks run in the cloud since October 6, 2026 The user, plus scheduled tasks
Claude Tag Teams on Team and Enterprise plans Slack channels Team members who tag @Claude, plus proactive follow-ups
Claude Managed Agents Developers building products Anthropic-hosted runtime accessed through APIs The developer's application
Claude Duet Individual professionals and small business owners Standalone iOS, Android, and web app backed by a cloud computer Duet itself, with user approval for consequential actions

Development History

From Claude Code to Cowork

Duet's foundations were laid by Claude Code, Anthropic's terminal-based coding agent (see AI Coding Agent Comparison), whose loop of gathering context, acting with tools, and checking results proved useful far beyond programming. In January 2026, Anthropic wrapped that loop in a graphical interface for non-developers and called it Claude Cowork: users granted access to folders and connected apps, described an outcome, and came back to finished documents, spreadsheets, and research. Anthropic reportedly built Cowork in about a week and a half, largely with Claude Code itself. The launch, and especially the 11 role-based plugins released as open source on January 30, rattled investors who feared AI agents would erode demand for existing business software.

Date (2026) Milestone
January 12 Cowork research preview for Max subscribers in the macOS desktop app, running locally in an isolated virtual machine
January 16 Preview expands to Pro subscribers
January 30 11 open-source plugins for functions such as legal, sales, marketing, and data analysis
February 12 Self-serve Enterprise plans bundle Claude, Claude Code, and Cowork
February 24 Plugin marketplace and admin controls for Team and Enterprise
February 25 Recurring and on-demand scheduled tasks, plus a Customize section for skills, plugins, and connectors
March 9 Microsoft announces Copilot Cowork, built in close collaboration with Anthropic
March 17 Dispatch, a persistent thread for assigning Cowork tasks from a phone
March 23 Computer use research preview for Pro and Max
April 9 General availability on macOS and Windows, with usage analytics, OpenTelemetry support, and role-based access controls
June 12 Inline editing of Claude's drafts in chat and Cowork
June 23 Claude Tag brings a proactive Claude teammate to Slack for Team and Enterprise
July 7 Cowork on web and mobile; sessions run in the cloud, and scheduled tasks no longer need a device online
August 6 Optional security scanning of third-party skills and plugins for Enterprise
August 25 Memory works across chat and Cowork in the cloud, with editable Topics

The July expansion came with the first large look at how people actually used Cowork. Anthropic sampled 1.2 million anonymized sessions from more than 600,000 organizations between May 11 and May 31, 2026, and sorted them into 20 categories of work. Business process and operations tasks, such as pulling scattered updates into one report, building onboarding checklists, and reconciling spreadsheets, led at 33.4 percent, followed by content creation and copywriting at 16.4 percent, while software development made up just 8.7 percent. Anthropic cautioned that the taxonomy has no separate categories for marketing, finance, or HR, which likely inflates the operations share, and that about 5 percent of sessions involved personal use such as hobbies or companionship-style conversation. Those results described an operations agent rather than a coding agent, and they foreshadowed Duet's focus on small business back-office work.

One Claude and the Move to the Cloud

On September 16, 2026, Anthropic began merging Cowork and chat into a single Claude experience, starting with Pro and Max, after users said it was frustrating to decide where a task belonged and that work begun in one mode did not carry into the other. Claude now decides whether a request needs a quick answer or a longer agentic job, and the same update introduced Claude Docs and Claude Slides in beta and moved Claude Design into conversations. A Salesforce plugin with 37 sales skills arrived on September 15, and a developer portal for submitting plugins to the Claude directory opened on September 25. On October 8, Docs, Slides, and Design left beta on every plan, including Free, and new Dashboards and Motion features entered beta.

The execution model shifted at the same time. On October 6, new Cowork tasks on Pro and Max plans began running in the cloud, and the "Only on your computer" option disappeared, although tasks already started locally could finish there and Anthropic pointed people who need strictly local execution to Claude Code. On October 23, the unified experience became generally available for Enterprise, with new usage controls that include an Efficient mode keeping work on Sonnet and Haiku models, per-role model entitlements, spend limits, and pooled group budgets. Duet sits on top of this cloud-first foundation, since the shared memory, connector, and skill layers, along with the expectation that agents keep working while devices are off, were all in place before it launched.

Recent Developments

Anthropic announced Claude Duet on October 21, 2026, as a research preview with a U.S. waitlist for Pro and Max subscribers, published a getting-started help article the following day, and released a detailed safety, privacy, and security article on October 23. The product is led by Karan Ahuja, a former product leader at Meta Superintelligence Labs who joined Anthropic in August 2026. Krieger said he had used Duet at home and at work for several weeks, during which it drafted questions for a fireside chat, monitored Slack, and recommended and ordered a book, and the early testers named in Anthropic's announcement included a real estate broker, a restaurant group owner, and a brand strategist.

Rollout has proceeded in waves. On October 28, Ahuja reported that many invitations had gone out, with U.S. Max subscribers first and Pro subscribers next, and said Anthropic was working to expand access internationally but did not yet have a date. Admitted users receive one full reset of their five-hour and weekly usage limits, usable until November 30, 2026, which partly offsets the extra usage that background check-ins generate. As of late October, Anthropic had not announced post-preview pricing, a timeline for Team and Enterprise plans, or support for Microsoft 365.

What Remains Under Investigation

Several open questions will determine whether proactive agents like Duet become everyday tools. The first is judgment under uncertainty: Anthropic acknowledges that Duet can misread threads and misjudge urgency, and no public benchmark yet measures how well an agent triages a real inbox, so both precision (avoiding noisy alerts) and recall (not missing what matters) remain unmeasured in public. The second is the cadence trade-off, because interval checks protect usage limits but leave windows in which urgent items wait, and the right interval probably varies by role and industry. A third concerns long-running work, where expired or revoked authorizations and gradual drift from the user's intent can derail tasks that span days.

Security is the largest uncertainty. Prompt injection has no complete solution, classifiers produce both false positives and false negatives, and approval systems depend on people who may tire of reviewing prompts, a problem Anthropic says it is still calibrating. Anthropic states that Duet keeps conversation history and memory until the user deletes them, and that information learned from a disconnected app persists until memory is reset, but independent reviewers noted that, as of late October, the company had not published a retention period, a statement on whether Duet data is used for training, or the audit and admin controls organizations would need for data governance. Finally, Anthropic has said the relationship between Duet and the main Claude app will depend on early feedback, leaving open whether Duet remains a separate product or is eventually absorbed into Claude, as Cowork was.

Technical Architecture

From Claude Code to Cowork to Duet

All three products share one core pattern: a model in a loop that reads its context, chooses a tool call, executes it in an environment, observes the result, and repeats until the goal is met. Claude Code exposes that loop through a terminal and developer tools, where the agent works on the user's own machine with the user's permissions, and the Claude Agent SDK packages the same harness for developers building their own agents. Cowork placed the loop behind a graphical interface for non-developers, first inside a local isolated virtual machine with folder-level permissions and later in per-session cloud sandboxes that are created for one session, kept off the user's home and corporate networks, and destroyed when the session ends. Since October 6, 2026, such cloud sessions reach back to a user's computer only when a task needs a file from a connected folder and the desktop app is open.

Duet changes this architecture in two ways. It replaces the per-task sandbox with a persistent cloud computer that keeps state across days, and it adds an initiative layer, a scheduler that wakes the agent for the morning brief and periodic check-ins without any human prompt. Around that core, Anthropic placed components that run beyond the model's reach: a credential proxy, an encrypted password channel, an isolated browser machine, a classifier for outgoing messages, and an action checker that compares proposed actions with the user's intent. Anthropic has not published a full architecture diagram for Duet, so the component view below combines its documentation with general agent-engineering practice.

System Components and Failure Modes

Component Responsibility Known Failure Modes to Test
Initiative Scheduler Triggers the morning brief and interval check-ins, and decides when to message the user. Urgent items arriving between checks; over-notification and alert fatigue; usage limits consumed by low-value checks.
Agent Harness and Model (Claude Opus 5.5) Plans tasks, chooses tools and effort level, drafts outputs, and reports results with their sources. Misread threads or misjudged urgency; errors compounding over long tasks; figures that do not match cited sources.
Memory and Chat Search Supplies preferences and history from Claude memory, Topics, and past chats. Stale or incorrect memories; retained information from disconnected apps; context pulled from unrelated chats.
Connectors and Plugins Provide read and write access to business apps through the Claude Marketplace. Partial connector support (for example, Slack limitations); expired or revoked authorizations mid-task; unsupported apps such as Microsoft 365.
Isolated Cloud Browser Navigates sites without connectors through a fixed command set. Sites blocking agent traffic; sign-in failures; no live view for the user to diagnose problems.
Credential Proxy and Password Form Insert real tokens and passwords outside the model's reach. Phishing pages imitating the sign-in form; placeholder tokens not resolved; compromise of the underlying third-party account.
Action Checker (Extended Auto Mode Classifier) Compares each proposed action with user intent, independently of the model. False blocks of legitimate work; missed misaligned actions; approval fatigue.
Sensitive-Information Classifier Screens outgoing messages and uploads against two sensitivity tiers. False positives on harmless content; false negatives on unusual formats of sensitive data.

Technologies Implemented

Agent Skills and Plugins Ecosystem

Much of Duet's breadth comes from the extensibility layer Anthropic built for Claude and Cowork. Skills use the Agent Skills format, which Anthropic originally developed and released as an open standard: each skill is a folder containing a SKILL.md file with a name, a description, and instructions, optionally bundled with scripts, reference documents, and templates. Agents load skills through progressive disclosure, reading only names and descriptions at startup, pulling in full instructions when a task matches, and running bundled code or opening references only when needed, which keeps many skills available without crowding the model's context window. The format has since been adopted by a growing number of agent products beyond Anthropic's own.

Plugins bundle skills with connectors, slash commands, and sub-agents for a particular role or team, while connectors link Claude to business apps, many of them through the Model Context Protocol (MCP), an open standard for connecting AI applications to external tools and data. Anthropic released Cowork's first plugins as open source, added a plugin marketplace with admin controls in February 2026, opened a developer portal for third-party submissions in September, and counted more than 6,000 connectors and plugins in the Claude Marketplace by Duet's launch. Because Duet inherits a person's existing skills and connections, the effort individuals and organizations invested in Cowork workflows carries forward.

Duet Workflow Matrix:

Connector or Plugin Example Duet Workflow (per Anthropic) Gated Step Status
Gmail and Slack Find missed messages and draft replies Sending replies Available; Slack has limitations
Google Calendar Surface priorities in the morning brief and flag conflicts, such as a call that overlaps a flight Messages sent to others Available
QuickBooks and Stripe Check for unpaid invoices and draft reminder emails Sending reminders Available
Gusto Prepare payroll with hours, bonuses, and reimbursements for review Running payroll (a payment) Available
LinkedIn Draft a job posting Posting after the user edits and approves Available
Docusign Prepare agreements and send them for signature Sending and signing Available
HubSpot Draft follow-up emails from contact and deal history Sending follow-ups Available
Canva Turn a product launch into a social campaign Anything sent or shared on the user's behalf Available
Shopify, Link, and Shop Pay Set up and manage a store; buy approved items Every purchase, each with a one-time card Link and Shop Pay available only in Duet
1Password Sign in with saved logins without exposing credentials Approval inside 1Password Coming soon
Microsoft 365 Outlook, calendar, and file workflows Not applicable Not yet available

The Claude Agent SDK and Managed Agents

The Claude Agent SDK is the developer-facing form of the harness behind Claude Code, standardizing how the model requests a tool, how the system executes it, and how results flow back into the model, with the error handling that multi-step work requires. Claude Managed Agents, introduced in April 2026, goes further by hosting the entire runtime on Anthropic's infrastructure. Its design separates three virtualized components: a durable, append-only session log that records everything that happened; a stateless harness that calls Claude, routes tool calls, and can be restarted from the log after a crash; and disposable sandboxes, often containers, where code runs. Every tool sits behind one generic execute interface, so the harness does not need to know whether a "hand" is a container, a browser, or a phone, and credentials stay in a vault the sandbox cannot reach, which is the property Duet relies on when Anthropic says the agent never sees the secrets it uses.

Enterprise Controls and Security

Duet itself is not yet available on Team or Enterprise plans, and Anthropic has not published Duet-specific admin controls, audit logging, or organizational retention settings. Organizations evaluating it should therefore look at the controls that already exist across the broader Claude platform, which indicate what an enterprise version would likely need. During 2026, Anthropic gave Team and Enterprise admins private plugin marketplaces with approval controls (February), role-based access to agentic features and monitoring through an Analytics API and OpenTelemetry, which security teams can route into existing monitoring tools (April), and optional security scanning of third-party skills and plugins (August).

The unified Claude experience for Enterprise, generally available since October 23, 2026, adds Efficient mode, per-role model entitlements, spend limits at the organization, group, and member levels, and pooled group budgets, on top of single sign-on and the Compliance API, while organizations using zero data retention for Claude Code, HIPAA-ready configurations, or customer-managed encryption keys stay on their current setup. For individuals who might connect work accounts to Duet on a personal plan, independent security reviewers recommend checking employer AI policies first, since such an agent operates outside these organizational controls. These considerations connect directly to AI governance and broader risk and compliance planning.

Ecosystem Fit

Duet occupies a middle ground among automation approaches. Deterministic tools such as Zapier and traditional robotic process automation execute predefined triggers and steps reliably but break when inputs change or a step requires judgment, while developer frameworks such as LangChain and the Claude Agent SDK can produce flexible agents but demand engineering time and hosting. Some engineers had already improvised their own versions of Duet by pairing scheduled Claude Code runs with MCP servers and push notifications to their phones. Duet packages that pattern as a consumer-grade app with no setup beyond connecting accounts, adds safeguards a do-it-yourself build would rarely include, and gives up control over models, check intervals, and visibility in return. For no-code users and small businesses, that trade is the point.

Getting Started

  • Eligibility: A Claude Pro or Max plan, a U.S. Claude account, and an invitation from the waitlist. Team and Enterprise plans are not yet supported.
  • Join the waitlist: Select "Join the waitlist" on the Claude Duet product page and use the email tied to the Claude account. Access is linked to that email, which must also match the Apple or Google account on the phone.
  • Install: When invited, install the iOS or Android app or open Duet on claude.ai, and sign in with the same Claude account.
  • Review connections: Duet inherits memory, skills, and connected apps from Claude. Manage access in Claude settings and disconnect anything Duet should not see.
  • Set expectations: Tell Duet what it should report and how often, then hand it tasks by text or voice in the main thread or a topic channel.
  • Approve carefully: Read every approval request, including recipients, amounts, and full content, before confirming.
  • Watch usage: Duet shares the plan's five-hour and weekly limits with the rest of Claude, and background work counts. Admitted users get one full limit reset, usable until November 30, 2026.
  • Report problems: Tell Duet about issues in the chat and it passes them to Anthropic. Store and delivery problems go to the merchant, wallet charges to Link or Shop Pay support, and wrong product choices by Duet to Anthropic support.

Known Limitations

  • Research preview: Duet is early software and can misread threads, misjudge urgency, or report inaccurate information.
  • Interval checks: Accounts are checked every few hours rather than continuously, so urgent items can arrive between checks.
  • No model choice or browser view: Duet always runs on Claude Opus 5.5, and users cannot watch or take over its browser.
  • Limited reach: It cannot see all of a user's projects or the files on their computer, and it can read but not change work in Claude.
  • Communication limits: It cannot make phone calls or send texts, although it can send email from connected accounts with approval.
  • Prohibited actions: Trading securities, moving money between accounts, and accessing someone else's account are blocked even with approval.
  • Connector gaps: Slack works with limitations, and Microsoft 365 is not yet available.
  • Work focus: Personal errands such as booking tickets are weaker than work tasks.
  • Availability: U.S. only, Pro and Max only, by waitlist, and in a separate app from the main Claude app.
  • Usage: Background checks and large jobs such as financial models or decks consume shared plan limits.

Practical Workflow Examples

The following workflows illustrate where Duet fits in daily work. Each pairs an input with acceptance criteria, so that a person or team can test the agent against observable outcomes rather than impressions. They adapt Anthropic's published examples to realistic small business scenarios.

  • Invoice follow-up:
    • Input: "Every Monday, check Stripe and QuickBooks for invoices more than 30 days overdue and draft polite reminder emails for my approval."
    • Acceptance criteria: Duet lists every overdue invoice with amounts that match the source systems, cites the invoice records, drafts one reminder per customer, and sends nothing until each draft is approved.
  • Morning triage:
    • Input: "In my morning brief, flag anything from clients or my accountant, and warn me about calendar conflicts with travel."
    • Acceptance criteria: The brief arrives every morning, surfaces client and accountant messages ahead of newsletters, detects overlaps between meetings and flight times, and proposes reschedule messages without sending them.
  • Quarterly business review:
    • Input: "Pull Q3 deal data from HubSpot, combine it with marketing spend in the Google Sheet 'Q3 Budget,' and build a 10-slide deck summarizing return on investment."
    • Acceptance criteria: The deck appears in the Make tab, every figure traces to a cited source, the ROI calculations can be reproduced from the sheet, and no numbers are invented.
  • Approved purchase:
    • Input: "Reorder the same printer toner we bought last month and ask me before paying."
    • Acceptance criteria: Duet identifies the earlier order, finds the matching item, presents the merchant, item, and total for approval in the Link or Shop Pay app, and completes the purchase with a one-time card.

How to Evaluate a Deployment

Because Duet acts without being asked, evaluating it takes more than spot-checking a few answers. Individuals and teams should structure testing around the dimensions below and collect evidence over several weeks, so that rare failures have a chance to appear. Many of these methods adapt standard model evaluation practice to an agent that takes actions, and ...evaluate and trust AI offers broader guidance.

Evaluation Dimension Questions to Verify Evidence to Request
Triage Accuracy Does the morning brief surface what matters and leave out what does not? A log comparing flagged items with items the user later acted on (precision and recall).
Check-in Latency How long do urgent items wait between arrival and notification? Arrival timestamps compared with Duet's messages over several weeks.
Approval Integrity Does Duet ever send, pay, sign, or delete without approval, and do approvals show full recipients and content? Approval history; attempts to induce unapproved actions in test accounts.
Authentication and Authorization Are tokens and passwords kept out of the model, and does disconnecting an app stop access immediately? Disconnect tests; confirmation that a memory reset removes information learned from the app.
Prompt Injection Resistance Do hidden instructions in emails or web pages change Duet's behavior? Results from seeded test emails and pages in a sandbox account.
Sensitive-Data Handling Does the classifier block card numbers, IDs, and credentials while allowing legitimate messages? Counts of blocked and rewritten messages; any false negatives found.
Interruption Handling When the user steers a task midway, does Duet incorporate the correction? Task-page history showing mid-task steering and the resulting changes.
Source Fidelity Do reported numbers match their cited emails, files, and spreadsheets? Spot audits of figures in briefs, models, and decks.
Usage Cost How much of the plan's limits do background checks consume? Usage readings before and after enabling Duet.
Failure Classification When a task fails, is the cause a connector, a site block, a judgment error, or a usage limit? Task history annotated with failure causes.

Glossary

Agentic Architecture
A system design in which an AI model plans, uses tools, and executes multi-step workflows in a loop, rather than generating text in a single pass.
Ambient (Proactive) Agent
An agent that runs in the background and acts on events or schedules instead of waiting for a chat message, escalating decisions to a human when needed.
Approval Gate
A checkpoint where the agent shows a proposed action and waits for human confirmation; in Duet, required before sending, paying, signing, or deleting.
Auto Mode Classifier
An automated check, originally built for Claude Code and extended for Duet, that runs outside the model and judges whether each action matches the user's intent.
Dispatch
A Cowork feature introduced in March 2026 that provides a persistent thread for assigning Cowork tasks from a phone.
Model Context Protocol (MCP)
An open standard for connecting AI applications to external tools, data sources, and services; many Claude connectors use it.
One-Time Virtual Card
A card number generated for a single purchase and limited to one merchant and amount, which Duet uses through wallets such as Link and Shop Pay.
Prompt Injection
A security vulnerability in which malicious instructions embedded in a file, email, or web page try to trick an AI agent into unauthorized actions.
Research Preview
Anthropic's label for an early release offered to a limited audience while the product is still being tuned.
SCIM (System for Cross-domain Identity Management)
An open standard for automating the exchange of user identity information between identity providers and applications, used in enterprise provisioning; Duet does not yet support Team or Enterprise plans.

Sources and Further Viewing

References

Additional Viewing

Load video
YouTube

Meet Claude Duet is Anthropic's official short introduction from the Claude YouTube channel, posted October 23, 2026. It shows the loop described in The Mechanism section: Claude messaging first only when something needs attention, a morning brief of top priorities, larger tasks handed off by voice note, and a request for approval before anything is sent, paid, or signed. It works as a quick visual companion to the Building Blocks table. Watch on YouTube

Load video
YouTube

In Anthropic Just Released Claude DUET (Full Breakdown), posted October 22, 2026, the Kev Builds Apps channel walks through Anthropic's documentation for Duet, including limitations the creator considers easy to overlook, the Stripe, Link, and Shop Pay payment integrations, and how Duet compares with Grok Bot, OpenAI's dots, and Meta's Muse. The video also contrasts Duet with the creator's own self-built always-on agents, which complements the Known Limitations, Competitive Landscape, and Ecosystem Fit sections.

Load video
YouTube

In Ambient Agents and the New Agent Inbox, published by Sequoia Capital in May 2025, LangChain CEO Harrison Chase introduces ambient agents, AI systems that run continuously in the background and respond to events rather than to chat prompts while people stay involved through an inbox of items awaiting review. The talk predates Duet but explains the design pattern behind its check-ins, Tasks tab, and approval requests, and it makes the case for why human oversight stays essential as these agents scale.

Load video
YouTube

What is Claude Managed Agents?, from Anthropic's Claude channel in April 2026, introduces the hosted agent runtime whose credential design Duet adopts. It explains how developers define tools, environments, and success criteria while Claude works until a task is complete, giving useful background for the brain-and-hands architecture and credential vault discussed in the Credentials and Technical Architecture sections.

Load video
YouTube

In Prompt Injection, explained, Simon Willison presents his roughly twelve-minute segment from a May 2023 LangChain webinar, using the example of an email assistant tricked into forwarding password-reset messages to an attacker. He argues that filters catching most attacks are not good enough in security and outlines the dual-model pattern for separating trusted and untrusted inputs. These ideas directly inform The Physics section's discussion of out-of-model checks, isolated browsers, and approval gates.

Load video
YouTube

Claude Cowork Tutorial (Exact Prompts I Use) by Jake Dawson is a hands-on Cowork tutorial organized around the creator's own prompts. Because Duet inherits the skills, connectors, and memory people build in Claude, habits formed in Cowork carry over directly, which makes this tutorial relevant to the From Claude Code to Cowork section and to the Getting Started steps.

Load video
YouTube

Claude Cowork Complete Tutorial 2026 (15 Features Tested on Real Work) by Maksims Sics tests a wide range of Cowork features against real tasks. It provides a practical view of the capabilities listed in the Development History timeline, many of which, including connectors, plugins, and scheduled work, form the foundation Duet builds on.

Load video
YouTube

What Claude Cowork Can Do for You: A Beginner's Guide by Amy Bruce of AI & Data for Nonprofits introduces Cowork for non-technical audiences. Small organizations weighing whether Duet's proactive model suits them can use it to understand the delegated-task foundation first, and it pairs well with the Ecosystem Fit and How to Evaluate a Deployment sections.

Retrieved from "https://primo.ai/w/index.php?title=Anthropic_Claude_Duet&oldid=51587"