Anthropic announced a research-preview waitlist for Claude Duet on 2026-10-21, with a follow-on safety, privacy, and security brief on 2026-10-23. Claude Duet is framed as a proactive agent: it surfaces what needs attention, completes assigned tasks, keeps working when the user steps away, and checks before acting on the user’s behalf. Access starts with US Pro and Max subscribers; Duet is included in those plans and shares the same usage limits as the rest of Claude. It is available as a standalone iOS/Android app and on claude.ai.
Built around Claude Opus 5.5: morning brief and periodic checks
Claude Duet is built around Claude Opus 5.5. Each morning it sends a short brief on the most important items across connected apps; during the day it checks those accounts (Anthropic says about every few hours, because constant checking would burn plan limits faster) and messages only when something needs attention. Users can also hand it tasks ranging from scheduling to multi-tool dashboards, financial or sales forecasts, prototyping, and building web apps—by typing or voice in one ongoing thread.
When the user steps away, Duet can keep working via a cloud virtual machine with its own browser, notifying when a task is done or needs review. Setup carries over memory, skills, and connected apps from the Claude account.
6,000+ Marketplace connectors
Claude Duet can use the over 6,000 connectors and plugins in the Claude Marketplace. Official examples include finding and helping reply to Gmail/Slack messages; checking Intuit QuickBooks or Stripe for unpaid invoices and drafting reminders; preparing payroll in Gusto; drafting a job posting and, after edit and approval, posting to LinkedIn; preparing agreements and sending them through DocuSign; drafting HubSpot follow-ups; turning a product launch into a Canva social campaign; and setting up and managing a Shopify store. For business purchases it can use Stripe’s Link digital wallet (confirm the item, approve spend in Link; pay with a virtual card so the real card number is not shared) and Shopify’s Shop Pay.
Approval gates; some actions stay off-limits even with approval
Approval-gate and credential-isolation metaphor: an action card waiting outside a sealed agent workspace, with a gold checkpoint as the approval boundary (editorial illustration; no text or logos).
Claude Duet can read, draft, and prepare work on its own, but before it sends a message, makes a payment, signs a document, or deletes anything, it shows exactly what it is about to do and waits for approval. The safety post adds that the approval card shows the action, destination, and content—including every recipient. Even with approval, actions such as trading securities, moving money between accounts, and accessing someone else’s account stay off-limits; steps like paying or sending money, deleting an order, or creating an account are also not covered by a “don’t ask me again” rule. Users can disconnect any connected app at any time.
Credential isolation and sensitive-information classifier
Credential handling follows the Claude Managed Agents design: the model never directly sees passwords, browser cookies, or sign-in tokens; those credentials pass only through separate machines and proxy paths the model cannot access. The browser runs in its own dedicated cloud VM, separate from the model’s work environment; the agent drives it only through a fixed set of commands.
A dedicated sensitive-information classifier (separate from the main model) uses two tiers:
- Never share: sign-in credentials, full card and bank account numbers, and government ID numbers—even if the user asks.
- Needs consent to share: other private information such as health or personal finances—only when the user has explicitly instructed Duet to send it.
Extra testing and agent identification
Actions are also checked by an auto mode classifier that runs outside the model doing the work, so hidden page instructions cannot decide the outcome. Anthropic says red teams and an external penetration-testing firm tested Claude Duet, and it is in scope for the public bug-bounty program. Browser requests include a distinct User-Agent, and Anthropic publishes the public IP addresses Duet browses from so sites can recognize the agent.
Research-preview limits
Anthropic states this is an early version: it may misread a thread or miscalibrate urgency; core functionality is built around work, so personal errands (such as booking tickets) are weaker; it cannot yet show the user its browser; and for now it lives in its own app, separate from the main Claude app. During the research preview, background checks and larger tasks consume the shared Claude usage limits.
Primary sources:
- Anthropic / Claude, “Introducing Claude Duet,” 2026-10-21, https://claude.com/resources/articles/claude-duet
- Anthropic / Claude, “Claude Duet Safety, Privacy, and Security,” 2026-10-23, https://claude.com/resources/articles/claude-duet-safety-privacy-and-security
