- Anthropic opened a research preview of Claude Duet, an agent that watches connected apps and acts in the background, pausing for approval before sending, paying, signing or deleting.
- Anthropic lists several safeguards, including classifiers and credential isolation. The approval prompt is the main safeguard that depends on human attention, so its value rests on people reading it.
- Before connecting any agent, ask which apps it can reach, who approves its actions, and whether approvers can see enough detail to refuse.
An assistant that works while you are away is useful because you stop watching it. That same quality changes where safety has to come from. Anthropic's new app, Claude Duet, is built around this trade. It shows how the company expects people to share work with software.
Anthropic opened a research preview of Duet on October 21. It runs on iOS, Android and claude.ai. Anthropic aims it at people in demanding professional jobs and at small business owners who struggle to keep track of everything they are responsible for. It is designed around the company's Opus 5.5 model.
What Duet does without being asked
Every morning, a short summary of the top items from the user's linked apps arrives. Through the day, Duet watches those apps and sends a message only when something needs a person. Users can also hand it larger jobs, such as building dashboards or financial and sales forecasts.
Anthropic shares accounts from early testers. Jess said Duet caught a property showing placed on the wrong day in her calendar. She had not asked it to look. In her words, it was "exactly the kind of thing I want caught without having to ask."
Mya had a call with a potential client. Duet prepared a brief for it. It also spotted a clash with her flight and offered to reschedule. Both stories are about the same thing: software that decides what deserves a human's attention.
How it works under the hood
Duet runs in a virtual machine with its own browser. Anthropic says this means the user's laptop or phone does not need to be on. The user writes a short request. Duet works out which apps and steps it needs, then sends a notification when the job is done or needs review.
Its reach comes from the Claude Marketplace, which Anthropic says holds over 6,000 connectors and plugins. The company's examples include chasing unpaid invoices in QuickBooks or Stripe, running payroll in Gusto and drafting HubSpot follow-ups. Duet can also buy items through Link, Stripe's digital wallet. Link pays with a virtual card, so the real card number is not shared.
Duet is not a live monitor. Anthropic says it checks connected accounts every few hours, because constant checking would drain a plan's usage limits much faster. VentureBeat points out that this matters for time-sensitive work.
Several safeguards, and one that depends on attention
Anthropic describes layers. A new classifier, paired with a safety prompt, checks each message. It is designed to refuse sharing the strictest tier of data, such as card numbers and government ID. Health and personal finance details leave only when the user explicitly says so. Duet's handling of credentials follows the design of Claude Managed Agents, so Anthropic says it does not directly see passwords or sign-in tokens.
Anthropic also says actions are approved by its auto mode classifier. It describes this as the safeguard that stops Claude and Claude Code from taking steps the user did not ask for. The announcement does not explain how that classifier and the user's own approval share the work.
Then comes the human step. Duet can read, draft and prepare work freely. Sending a message, making a payment, signing a document or deleting anything pauses for a yes, and the user sees exactly what is about to happen. A few actions stay off-limits even with approval, such as trading securities or moving money between accounts. Users can also disconnect any app Duet has access to.
Anthropic adds adversarial testing: internal red teams, an outside penetration test, and coverage under its public bug bounty program.
This is the lesson for leaders. The automated layers work without anyone paying attention. Across sends, payments, signatures and deletions, the approval prompt is the one safeguard that depends on a busy person reading carefully. A product sold on saving attention relies, at its decisive moment, on a request for attention. Anthropic does not say how often Duet will ask. If prompts come in a steady stream, approving them can become a reflex. That is a fair question to put to any agent vendor.
What Anthropic says is unfinished
Anthropic is direct about limits. Duet may misread a thread or misjudge what is urgent. Personal errands such as booking tickets are weaker than work tasks. It cannot yet show the user its browser, so a person sees the proposed action but not the path that led to it. Anthropic says it will share more on the safety design in the coming days.
Access is narrow. Anthropic says the preview begins with Pro and Max subscribers in the US, entered through a waitlist. VentureBeat reports that the announcement does not extend Duet to Team or Enterprise plans, announce an API or give an enterprise rollout date.
Questions to put to your team
First, ask which apps staff would connect, and what each connection lets an agent read, draft and send. Second, ask who approves actions and whether they see enough detail to say no. Third, ask what happens if an email or web page carries hidden instructions. Anthropic says its defenses draw on its browser-use research, but details are still to come.
Fourth, ask where payments sit. Anthropic says Link asks the user to approve the spend. Check that your finance rules treat that approval as a real control, with a named owner.
An agent that works unasked changes the question from "what can it do?" to "what will it put in front of me, and will I read it?"
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Anthropic.
