Anthropic has released a research preview of Claude Duet, a standalone app in which an AI agent keeps working on a user’s tasks in the background and asks for approval before doing anything sensitive. According to The Decoder, the app runs on iOS, Android and the web at claude.ai, is built on Claude Opus 5.5, and is available through a waitlist to Pro and Max subscribers in the US. Team and Enterprise plans are not included yet. It is Anthropic’s entry in a category that has filled up in recent months with personal agents that act on their own initiative.

What Duet does

Anthropic pitches Duet at professionals and small-business owners who have “more on their plates than they can track.” The key difference from the regular Claude app is the direction of flow. In Claude, a person opens a chat and asks for something. Duet comes to the person: each morning it sends a short summary of the most important items from connected apps, and after that it reaches out only when something needs attention.

Users assign work by text or voice message in a single ongoing thread. According to Anthropic, the tasks range from scheduling and preparing dashboards to financial forecasts, prototypes and web apps. Examples cited include tracking down unpaid invoices and drafting payment reminders, and getting payroll ready. The agent works on its own virtual machine, a cloud computer with a browser, so the user’s laptop or phone does not have to stay on. Memory, skills and app connections carry over from the user’s existing Claude account.

Connectors and purchases

Duet connects to services such as Gmail, Slack, Stripe, Docusign and Shopify through more than 6,000 connectors and plugins from the Claude Marketplace. For purchases it uses Stripe Link with a virtual card, so the user’s real card number is never shared with the agent.

The approval model

The safety design is the most distinctive part of the announcement. Anthropic says Duet can only read, draft and prepare on its own. Before it sends a message, makes a payment, signs a document or deletes anything, it shows exactly what it plans to do and waits for approval. Trading securities and moving money between accounts are blocked entirely, even with the user’s approval; bank transfers are not possible.

Technical safeguards add layers:

  • The agent never sees passwords or login tokens directly, because credential handling follows the design of Claude Managed Agents.
  • To resist prompt injection, where hidden instructions in a web page or email try to steer the agent, Anthropic uses defenses from its browser-use research.
  • Red teams and an outside firm ran attack tests against Duet.
  • A new classifier, working with special instructions in the system prompt, checks every message for leaks of sensitive data.

Anthropic has not published independent test results for these defenses, so how well they hold up under real use remains to be seen.

A crowded field

The Decoder lists three rivals that launched similar products in recent months: SpaceXAI opened the Grok Bot beta in August, and Meta and OpenAI followed in September with Muse and Dots. All four bet that people will hand routine work to an agent that acts proactively. The competitive question is less about raw capability than about trust: how much an agent is allowed to do unattended, and how clearly it shows its plans. We recently reported that Meta paused Muse sharing after exposed chat links, a reminder that privacy design is a live issue for products in this category.

Why it matters

An agent that works while you are away needs persistent access to email, chat, calendars and payment tools. That is useful and risky at the same time. Duet’s approach, which is to let the agent prepare but require a person to approve the final action, is a conservative answer. It trades some convenience for control, and it keeps the most damaging actions off the table. For readers new to the topic, our explainer on what AI agents are covers the building blocks.

What to watch next

  • When Duet opens beyond the waitlist and whether Team and Enterprise customers get access.
  • Pricing, usage limits and whether the agent’s cloud computer time is metered.
  • Independent security tests, especially against prompt injection through email and web pages.
  • How often users approve actions without reading them, which determines whether approval prompts protect anyone.
  • Regional availability outside the US.

Key takeaways

  • Claude Duet is a research preview of an always-on agent that runs on a cloud virtual machine.
  • It is built on Claude Opus 5.5 and offered by waitlist to US Pro and Max subscribers.
  • It connects to apps like Gmail, Slack, Stripe, Docusign and Shopify via more than 6,000 connectors.
  • It asks approval before sending, paying, signing or deleting; securities trades and money transfers are blocked.
  • Grok Bot, Meta’s Muse and OpenAI’s Dots are direct competitors launched since August.

Frequently asked questions

Is Claude Duet generally available?

No. It is a research preview with a waitlist, open to Pro and Max subscribers in the US. Team and Enterprise plans are not included yet.

Can Duet move my money?

Not directly. Anthropic says bank transfers and trading securities are blocked even with approval. Purchases go through a Stripe Link virtual card, and payments require your approval.

How is it different from the Claude app?

In the Claude app you start a chat. Duet runs in the background on its own cloud computer, sends a morning summary and contacts you only when something needs attention.