On October 21, 2026, Anthropic opened a research preview of Claude Duet, an app where Claude works as a proactive agent: it watches your connected accounts, prepares work while you are away, and messages you when something needs you. The interesting part is not that Claude can now start the conversation. It is how Anthropic moved the most important controls outside the model, and what still depends on a human tapping "approve." Here is how Duet works, what its safety design gets right, where the real risks are, and how I would use it today.
Research and product status checked November 14, 2026.
Imagine it is Monday, 7:40 a.m.
Before you open your laptop, a message is waiting on your phone. Claude has already read your inbox and calendar. Three things need you today: a contract is waiting for signature, a client invoice is overdue, and four emails have draft replies ready to send.
You approve the drafts on the train.
By lunch, Claude has asked for approval twelve times. Send this follow-up. Pay this software renewal with a one-time card. Share the Q3 summary with the finance contact who asked for it. Each request shows exactly what will happen, where it will go, and who will receive it.
By the eighth request, you are no longer reading. You are tapping.
The finance contact who asked for the Q3 summary wrote from a domain that differs from your client's by one letter. The approval card showed the full recipient address, exactly as designed. You just did not look.
This is a hypothetical scenario, not a reported Duet incident. It is also not a story about a careless model. Every safeguard did its job. The agent prepared the work, an independent check judged that sharing a report requested by email matched your intent, and the approval card displayed the destination.
The control that failed was attention.
Anthropic is unusually direct about this risk. In describing Duet's safeguards, the company acknowledged that "approval fatigue is a serious issue, because too many requests teach people to tap through them."
That sentence is the right place to start, because it identifies what really changes when an AI agent messages you first.
A chat assistant waits. You decide when to ask, what to share, and what to do with the answer.
A proactive agent decides when something needs you. It reads content you did not choose to show it, prepares actions you did not explicitly request, and asks for decisions on its schedule, not yours.
When an AI agent starts the conversation, consent moves from approving each request to granting standing authority. Claude Duet puts its most important controls outside the model, which is the right architecture. But the final control is still a human approval, and human attention is the scarcest resource in the system.
Most coverage has focused on the headline: Claude now messages you first. The details matter more.
| Claude Duet research preview | |
|---|---|
| Launched | October 21, 2026 |
| Model | Claude Opus 5.5 |
| Where | Standalone app on iOS and Android, plus claude.ai |
| Who | US accounts on Pro and Max plans, via waitlist |
| Not yet | Team and Enterprise plans |
| Price | No extra charge during preview; uses your regular Claude usage limits, including session and weekly caps |
| Runs on | Its own cloud virtual machine and browser |
| Context | Your Claude memory, skills, and connectors |
| Integrations | 6,000+ connectors and plugins, including Gmail, Slack, QuickBooks, HubSpot, Docusign, and Gusto |
| Purchases | Through Stripe's Link wallet or Shopify's Shop Pay, using one-time cards |
Anthropic describes the target user as professionals and small business owners with more tasks than they can track. The company has also been clear about what Duet is not for. According to TechCrunch, Anthropic said Duet "isn't good at handling errands or booking tickets, and it can't show you its browser use as it happens."
Other preview limitations reported at launch:
Anthropic's framing of why Duet exists now is about model judgment. Mike Krieger said, "We've found Opus 5.5 was our first model with the judgment to be proactive in the right ways." Anthropic's launch materials say the model's judgment helps it "decide what needs you, what can wait and when to check with you first."
That is a reasonable claim for a product team to make. It is also exactly the kind of claim that should never be the only control. The rest of Duet's design suggests Anthropic agrees.
"Proactive agent" is easy to blur with features that already exist. They are different things, and the differences determine the risk.
| Mode | Who decides when it acts? | What it reads | Consent model | Main risk |
|---|---|---|---|---|
| Reactive chat | You, every time | What you choose to share | Per request | Wrong answer |
| Scheduled routine | You, by defining a trigger | What the routine is scoped to | Per routine | Wrong action on a schedule |
| Proactive agent | The agent, based on what it observes | Everything its connectors can see | Standing authority plus approvals | Wrong judgment about what matters, acting on untrusted input |
The distinction matters.
In reactive chat, the user is the filter. You decide which email to paste, which document to upload, and which answer to act on.
In a proactive agent, the agent is the filter. It reads the inbox, the calendar, the CRM, and the shared drive, decides what deserves your attention, and prepares an action.
That shifts three things at once:
Approvals are how you take some of that control back. That is why their design, and their volume, matter so much.
Anthropic published an unusually detailed safety, privacy, and security description for Duet on October 23, 2026. Reading it as an architecture, it looks like this:
Connected accounts You
(email, calendar, CRM, (phone or claude.ai)
accounting, docs, web) ^
| | approval card:
v | action, destination,
+-----------------------+ | content, recipients
| Claude Duet agent | |
| Opus 5.5 on a cloud |-------------------+
| VM + isolated browser | proposed action
| memory, skills |
+-----------+-----------+
|
v
+-----------------------+ +-------------------------+ +---------------------+
| Intent check | | Outbound sensitive-info | | Hard blocks |
| outside the model | | classifier | | securities, moving |
| (from Claude Code | | never share / needs | | money between |
| auto mode classifier)| | consent / allowed | | accounts, others' |
+-----------+-----------+ +------------+------------+ | accounts |
| | +---------------------+
v v
+-------------------------------------------------------------+
| Credential layer outside the agent |
| password form encrypted to browser | token proxy injects |
| sign-in tokens at request time | one-time payment cards|
+-------------------------------------------------------------+
Each layer controls something specific. Each also leaves something uncontrolled.
Duet uses the memory, skills, and connectors from your Claude account. It checks connected accounts every few hours and prepares work.
This layer controls what Duet can see. It does not control what Duet should trust. An email from a stranger arrives through the same connector as an email from your manager.
Before Duet sends a potentially sensitive message, pays, or deletes something, Anthropic says it "shows you the action, the destination, and the content, including every recipient," and waits.
Some steps cannot be covered by a "don't ask again" rule, including paying or sending money, deleting an order, and creating an account. Routines that run while you are away follow the same safeguards.
This layer controls which actions require a human decision. It does not control whether the human actually reads the request.
This is the most important design choice in Duet.
Anthropic says a separate automated check, extended from Claude Code's auto mode classifier, assesses whether each action matches your intent. In Anthropic's words: "The check runs outside the model doing the work so instructions hidden in a page cannot affect the outcome."
That is the right boundary. If a malicious email convinces the agent that forwarding a document is part of your task, the agent's own reasoning is compromised. A check that does not read the agent's reasoning, and is not reachable by the injected text in the same way, is far more robust.
This layer controls whether the action plausibly matches your request. It does not make the decision deterministic. It is still a classifier, and Anthropic says the safeguards "will occasionally miss something or flag a harmless message."
Anthropic says, "Claude Duet never sees your passwords, browser cookies, sign-in tokens, or other credentials."
This is the credential pattern I recommended in my article on agent identity, now shipped in a consumer product. A prompt-injected agent cannot leak a password it never saw.
This layer controls credential exposure. It does not control what the agent does with the access those credentials grant.
A separate classifier checks every outgoing message, including files uploaded through the browser, against three tiers:
If a message is blocked, Duet can rewrite it without the sensitive content and present the revised version for approval.
This layer controls specific categories of data leaving. It does not control ordinary business content, such as a quarterly report, going to the wrong recipient.
Some actions remain prohibited even with approval: trading securities, banking actions such as moving money between accounts, and accessing someone else's account.
These are deterministic boundaries, and they are the strongest controls in the system. No judgment, classifier, or tired human can override them.
Purchases use a one-time card from a wallet such as Link, limited to one merchant and one amount, and you approve in the Link app. Your real card number is not shared.
That is the task-bound spend pattern from my article on agent payments: scope the credential to the transaction, and put the approval on a surface the agent does not control.
Duet identifies itself with a distinct User-Agent header and publishes its IP addresses. Anthropic notes that some websites have opted out of being visited.
That is a small detail with a large implication. Sites can recognize and govern agent traffic instead of guessing whether a browser session belongs to a person.
From a production architecture perspective, several of Duet's choices are worth copying, whether or not you ever use Duet.
It moves enforcement outside the model. The intent check, credential handling, outbound classifier, and hard blocks all sit outside the model doing the work. That is the single most important principle for any agent that reads untrusted content.
It treats credentials as infrastructure, not context. Token injection through a proxy, and encrypted password handoff, mean the model never holds secrets.
It uses non-agentic approval surfaces for money. Payment approval happens in the wallet app, not in a screen the agent renders.
It makes some actions unapprovable. A short list of hard blocks is more trustworthy than any amount of judgment.
It applies the same rules to background routines. Many systems relax controls for scheduled work. Duet does not, according to Anthropic.
It tested against temptation, not just attacks. Anthropic says its safeguards evaluations used innocent, injected, and "temptation" variants of tasks, alongside shadow traffic, plus red teaming, an external penetration test with source code access, and bug bounty coverage through HackerOne.
It is honest about limits. Anthropic says approval frequency, sign-in methods, and classifier accuracy are still being adjusted, and that the safeguards will sometimes miss things.
That candor is more reassuring than a claim of perfect safety would be.
Approvals work when they are rare and meaningful. A proactive agent's value comes from doing many things, so approval volume naturally grows with usefulness.
Anthropic's own statement names the failure: too many requests teach people to tap through them. Showing every recipient is the right design. It only works if someone reads the recipient.
The fix is not faster approvals. It is fewer, higher-quality ones: grouping related actions, highlighting anomalies such as new recipients and lookalike domains, and reserving interruptions for decisions that actually need a human.
In chat, prompt injection usually requires you to paste or browse something malicious. A proactive agent reads whatever arrives.
Anyone who can send you an email, share a document, or post in a channel your agent monitors can place text in front of it. Anthropic says Duet uses prompt-injection defenses from its browser-use research, and the intent check is designed so that hidden instructions cannot answer it.
Those defenses reduce risk. They do not change the basic fact: a proactive agent's threat model starts at "attackers can write to my inputs."
Anthropic says disconnecting an app stops new access immediately, but "what Claude Duet already learned stays until you reset its memory." Duet also uses memory from your Claude account, so details from earlier chats are visible to it.
That is a reasonable product decision. It is also the exact surface I described in my memory poisoning article. Content read from an untrusted email can shape what the agent remembers, and that memory can outlive the connection that produced it.
If you disconnect an account because you are worried about it, reset memory too.
Duet checks connected accounts every few hours, not continuously. Anthropic has acknowledged that it can misunderstand conversations, misjudge priorities, or miss developments between checks.
Do not use a proactive agent as an alerting system for anything time-critical.
"Outside the model" is a major improvement. It is not the same as deterministic. A classifier deciding whether an action matches your intent will have false negatives and false positives, which Anthropic says directly.
That is why the hard blocks and the human approval remain essential. In my article on Jev and decision models, the principle was: a probability is evidence, not permission. The same applies here.
Duet's morning briefing, periodic account checks, and tasks draw from the same usage limits as your regular Claude chats, including session and weekly caps. An agent that works while you sleep also spends while you sleep. Anthropic gave each new user one full limit reset, available until November 30, 2026, which acknowledges the point.
An email Duet sends with your approval is your email. A purchase you approved is your purchase. A proactive agent does not move accountability. It moves the moment at which you exercise it, often to a phone screen between meetings.
Duet is not available on Team or Enterprise plans, and it does not support Microsoft 365. That means organizations do not yet have admin-level controls over it.
It also means some professionals will connect personal Pro or Max accounts to work email and Slack. For IT teams, that is a shadow-agent problem: an autonomous system with standing access to company data, outside company policy, created by an employee trying to be productive.
Duet launched into a crowded moment. Coverage at launch positioned it against OpenAI's Dots and Meta's Muse, and TechCrunch listed several other personal and business agents in the same space.
The details differ. The direction is the same: assistants are moving from answering questions to monitoring your accounts and acting on your behalf.
That makes Duet's safety design more important than its feature list. The patterns Anthropic published, including out-of-model intent checks, credential proxies, one-time payment cards, outbound classifiers, and hard blocks, are a reasonable baseline to compare any proactive agent against.
If you are in the preview, here is the setup I would start with.
Duet is aimed at professionals and small businesses. For a small team trialing it, I would use a short, deliberate plan.
At the end of four weeks, you will know whether Duet saves time without creating approval fatigue. That is the only metric that matters for a proactive agent.
If a product cannot answer the first three, it is asking for trust it has not earned.
For most of the history of AI assistants, the human started every conversation. That gave us an invisible control: we chose what the AI saw and when it acted.
Claude Duet changes that. It watches, prioritizes, prepares, and asks. That is genuinely useful, and Anthropic's published safeguards show a serious attempt to make it safe: checks outside the model, credentials outside the model, payments scoped to one merchant and amount, and a short list of actions no approval can unlock.
Those controls handle what machines can handle.
What remains is the moment when a human reads, or does not read, an approval card.
The most important design goal for proactive agents is not speed or autonomy. It is protecting that moment: fewer interruptions, clearer anomalies, and approvals that actually mean someone looked.
Duet speaks first.
Make sure you still have the last word.
Suraj Khaitan - Gen AI Architect | Building scalable platforms and secure cloud-native systems
Connect on LinkedIn | Follow for more engineering and architecture write-ups
Would you let an AI agent message you first and act on your accounts while you are away? If you are in the Duet preview, what was the first thing it got right, or wrong?