Anthropic previews Claude Duet, an agent app that acts without being asked

Anthropic announced Claude Duet, a separate app in which Claude acts as a proactive agent, as a research preview. It is built on Claude Opus 5.5 and runs as standalone iOS and Android apps and on claude.ai. Access is by waitlist, starting with US Pro and Max subscribers, and it draws on those plans’ usage limits. Anthropic describes the audience as professionals and small-business owners.

Duet differs from a chat assistant in who starts the work. It sends a daily summary each morning, checks connected accounts every few hours, and messages the user only when something needs attention. It runs on its own virtual machine and browser, so it can keep working when the user’s devices are off. Anthropic listed more than 6,000 connectors in its marketplace, including Gmail, Slack, QuickBooks, Stripe, HubSpot and Shopify.

Anthropic’s answer to the obvious risk is an approval step. Duet can read and draft on its own, but needs sign-off before any action that sends, pays, signs or deletes, and shows the action first. The company acknowledged limits: it may misread a thread or misjudge urgency, personal errands are weaker than work tasks, and users cannot yet watch its browser.

A second document, published on 23 October, set out the security design. Anthropic said an automated check, built on the auto-mode classifier from Claude Code, runs outside the model and tests each action against the user’s intent. Some actions, such as trading securities or moving money between accounts, remain barred even with approval. Purchases use a one-time card from a wallet such as Link, limited to one merchant and amount. Passwords are typed into a form in the Claude app and, Anthropic said, are not visible to the model; sign-in tokens never enter the agent’s machine. The agent’s browser requests carry a distinct User-Agent header from published IP addresses, and Anthropic said it offered large websites the option to block Duet before launch, and that some did. An external firm reviewed the source code, and a further review of the cloud browser and sign-in form is under way.

These are Anthropic’s own descriptions, and the documents do not report evaluation results. A proactive agent that holds credentials and acts across a user’s accounts raises the risk of prompt injection, and the published design is largely an attempt to keep secrets and irreversible actions away from the model.