Claude Duet: Anthropic's Proactive Agent, Explained

Claude Duet is Anthropic's first product built around the idea that an assistant should start the conversation. It launched as a research preview on 21 October 2026, restricted to Claude Pro and Max subscribers in the United States through a waitlist, and it is positioned for professionals and small business owners who have more on their plates than they can track.

The mechanics are straightforward. Each morning Duet sends a short brief on the most important items across your connected apps. During the day it checks those apps every few hours and notifies you only when something needs your attention. When you give it a job, it can range from scheduling meetings to building dashboards with dozens of tools, producing financial or sales forecasts, prototyping, and building web apps. Because it runs in the cloud on its own virtual machine with its own browser, work continues when your laptop is shut.

Three details matter more than the feature list. First, Duet runs on Claude Opus 5.5, so it inherits that model's strengths and its limits. Second, it is permissioned: sending a message, making a payment, signing a document or deleting a file all require your approval. Third, Anthropic is candid that it can get things wrong, misreading a thread, misjudging urgency or missing an update that lands between checks.

The strategic context is a three-way race. Meta shipped Muse first, OpenAI followed with Dots roughly three weeks before Duet, and Anthropic arrived with its own take. If you read our coverage of OpenAI Dots and the Meta Muse agent, Duet will feel familiar in shape and different in emphasis. This article explains where.

To understand why Duet exists, it helps to trace how Claude's job description has widened. Claude began as a chat interface, a place where you asked questions and received answers. Tool use and connectors then let it read your documents and calendars. Agentic coding tools let it work for long stretches inside a repository. More recently, Anthropic gave Claude the ability to operate a computer, which we covered in Claude's background computer use, and a wider set of work-focused products arrived around it.

Each step moved Claude closer to the work and further from the chat box, but every one of them shared a limitation: the human still had to initiate. You had to remember to ask, you had to know what to ask, and you had to know that something needed attention in the first place. Duet attacks that last gap. The scarce resource for a busy professional is rarely the ability to draft an email; it is noticing that the email needs sending, and noticing it before the deadline.

That is why the proactive framing matters commercially. A tool you must remember to open competes with every other tool you must remember to open. A tool that messages you at 07:30 with the three things that matter today competes with nothing. It occupies a slot in your day. Meta recognised this with Muse, OpenAI with Dots, and the launch coverage is explicit that Anthropic is reacting to both: CNBC and others noted that Duet followed Muse by less than two months and Dots by barely three weeks.

There is also a lineage inside Anthropic's own product. Duet reuses the memory, skills and connected apps from your Claude account. That is not a small implementation detail. It means the same context that makes Claude useful in chat is what makes Duet's morning brief relevant, and it explains why setup is described as minimal. It also means Duet is, in effect, a new front end and a new execution environment on top of an existing account graph rather than a separate product with its own data silo.

Anthropic's own description is that Claude Duet is a new app where Claude works as a proactive agent. Breaking the announcement into behaviours gives four distinct modes.

• The morning brief. A short message summarising the most important items across your connected apps. The example artwork Anthropic published shows a phone message addressed to a user named Nicole, listing a health permit, hiring decisions and a renewal, with the first item noting that a location opens on 14 November and that a permit needs her approval and a payment.
• Background monitoring. Duet checks your connected apps every few hours and alerts you when something needs attention. The design intent is selective interruption: it should stay quiet unless it has something worth your time.
• Delegated tasks. You can hand it work. The launch examples include scheduling meetings, building dashboards, preparing financial or sales forecasts, drafting follow-up emails, prototyping, and building web apps.
• Persistent execution. Duet runs in the cloud with its own virtual machine and browser, so tasks continue when your computer is off. Like Muse and Dots, it does not need access to your local machine.

The artwork is worth a closer look because it shows the intended tone: short, specific, and action-oriented, with a clear ask attached to each item (needs your OK, and a stated cost). That is a deliberate design choice. A proactive agent that sends vague summaries trains you to ignore it within a week; one that surfaces a decision with the numbers attached keeps its place in your day.

One point of care: the example is marketing material. It shows the best case, a brief with three crisp priorities. Real inboxes, calendars and shared drives are messier, and how Duet performs there is exactly what a research preview is meant to find out.

The launch coverage gives a clear but partial picture of how Duet is built. Here is what is reported and what is not.

Opus 5.5. Choosing Anthropic's top-tier model for a background agent is a notable decision, because background work is exactly where cost discipline tends to push vendors towards smaller models. Our Claude Opus 5.5 review covers the benchmarks, pricing and safety findings for that model. The practical implication is that Duet's judgement, how it decides what is urgent and how it reads a thread, is bounded by that model's judgement, and Anthropic's admission that Duet can misread a thread is a reminder that frontier models still err on ambiguous human context.

The cloud VM. Giving the agent its own machine and browser is the architectural choice shared by Muse and Dots, and it has two consequences. It makes persistence possible, since the agent is not tied to your device being awake. And it creates a cleaner security boundary than an agent that drives your own desktop: the VM is not your laptop. Our write-up of the Meta Muse agent's secure VM discusses the same pattern from Meta's side.

One thread. MacRumors reports that all interactions happen in a single ongoing thread. That is a significant product decision. Chat apps organise work into conversations; Duet behaves more like a colleague you message, with continuity and history. It reduces friction and increases the importance of memory quality, since the thread is the product.

What is not stated. The coverage does not say how alerts are delivered beyond the app, whether Duet will arrive on Android or desktop, or how the proactive checks are scheduled and metered. Treat anything beyond web and iOS as unconfirmed.

For an agent that reads your email and acts on your behalf, the permission model is the product. Anthropic's stated approach has three layers.

• Approval gates. Duet asks before sending messages, making payments, signing documents or deleting files. These are the irreversible or outward-facing actions, where a mistake lands on a real person or a real bank account.
• Credential isolation. According to MacRumors, Duet does not see passwords or logins when given account access. The connection happens through authorised connections rather than by handing the agent your credentials.
• Content screening. A dedicated classifier and safety system prompt check each message to guard against sensitive-information leaks.

This is a sensible baseline, and it follows the pattern Anthropic described for computer use: gate the actions that cannot be undone, keep secrets away from the model, and screen outputs. It is worth being clear about what it does not claim. It does not claim that Duet is immune to prompt injection, the attack in which a malicious email or web page contains instructions the agent mistakenly obeys. An agent that reads your inbox and browses the web on your behalf is exposed to that class of attack by construction, and the launch coverage offers no assurance beyond the classifier. Our explainer on background computer use sets out why Anthropic calls such mitigations partial rather than solved, and the same caution applies here.

There is a second, subtler risk: approval fatigue. If Duet asks permission for every minor action, users learn to click through. If it asks for too few, it acts on its own mistakes. The design question is where to set the threshold, and a research preview is the right place to tune it. Watch how the approvals evolve: whether Anthropic lets users pre-authorise categories of action, for example allowing replies to scheduling requests but not to anything involving money, will say a lot about how the product matures.

Finally, consider the wider safety context. Frontier labs have recently disclosed agent failures in long-running settings, and our coverage of OpenAI's long-horizon sandbox escapes and the multiagent safety research from Anthropic shows why persistence and autonomy raise the stakes. None of that is a claim about Duet specifically. It is a reason to treat persistent agents as a category that deserves scrutiny.

Anthropic has been unusually direct about Duet's weaknesses, which makes this section easier to write than most.

• Misreading threads. Duet can misinterpret a conversation, for instance missing that a later reply cancelled an earlier request.
• Misjudging urgency. It may flag something unimportant or fail to flag something that matters. This is the failure that defines a proactive agent, because the whole product is a bet on its sense of priority.
• Gaps between checks. Because it checks every few hours, an update that arrives and expires between checks can be missed. It is not a real-time monitor.
• Usage limits. Background work counts towards your plan limits, and larger jobs such as a financial model or a presentation consume them faster because they need more model turns. A proactive agent that quietly drains your allowance is a real cost for heavy users.

Beyond what Anthropic states, there are structural caveats worth naming. It is a research preview, so behaviour, limits and availability can change without notice. It is US-only and waitlisted, so most readers cannot try it yet. And the launch material does not publish independent evaluations of how often the morning brief is right, which is the metric that matters most. Until someone measures precision and recall of the alerts on real accounts, claims of time saved are anecdotal.

A fair reading of the creator coverage supports this. Julian Goldie's walkthrough, embedded above, is an enthusiastic launch-day tour, as most launch-day coverage is. It is useful for seeing the interface and the pitch, but a launch-day demo is not a stress test.

Three companies have now shipped persistent, proactive agents within weeks of each other. The differences are in emphasis rather than in kind.

The positioning difference is the most interesting. By aiming at professionals and small business owners, Anthropic is choosing the segment where the cost of a missed email or a late permit is concrete and where users are used to paying for software. Our guide to Meta Muse for small business shows that Meta is also courting that audience through connectors, so the segments overlap more than the marketing suggests. For deeper detail on each rival, see our reviews of OpenAI Dots and the Muse agent.

Open-source alternatives are also emerging for people who want persistence without a vendor, for example the approach we examined in OpenMuse, an open-source personal agent, and the always-on desktop approach described in Hermes Agent explained. Those trade convenience for control. The big three trade control for polish.

Based on the stated capabilities, the strongest use cases are the ones where information is scattered and the action is routine.

• A founder or owner-operator with a shared inbox, a calendar, a payments dashboard and a handful of suppliers. The morning brief collapses a dozen tabs into one message, and the approval gates keep money movement under human control.
• A consultant or agency lead juggling client threads. Drafting follow-ups and flagging stalled conversations are well-matched to a model that can read context and write competent prose.
• A manager preparing recurring reports. Dashboards and forecasts from connected data are the kind of task the launch material highlights, and the cloud VM means the report can be built while you are elsewhere.

The weak spots are equally predictable. Anything that depends on tacit context, for example knowing that a particular client always says urgent when they mean soon, is where an agent will misjudge priority. Anything adversarial, such as inboxes full of cold outreach and phishing, tests the injection defences. And anything involving regulated data, legal commitments or other people's sensitive information deserves a human in the loop regardless of what the approval gates catch.

The right mental model is a very fast, well-read junior who never sleeps and occasionally misreads the room. That person is enormously valuable if you supervise them sensibly and expensive if you do not. The fact that Anthropic built in approvals and openly lists failure modes suggests the company wants users to adopt that mindset.

There is no separate price for Duet. It is a research preview for Pro and Max subscribers in the United States, joined through a waitlist, and it uses your existing plan limits. That has two consequences for budgeting. First, you cannot buy more Duet; you consume the allowance you already have. Second, the proactive checks run whether or not you ask for anything, so the baseline consumption of an always-on agent is a new line item in how you use your plan.

For UK and other non-US readers the practical answer today is to wait. Anthropic has not announced international availability or a timeline, and we will not guess one. When pricing or regional access is confirmed, we will convert to pounds first and keep dollars in brackets, as we do throughout this site.

Join if you are a US-based Pro or Max subscriber who spends real time triaging email, calendars and recurring reports, you are comfortable reviewing an agent's proposed actions, and you want to be early on a product category that is likely to matter.

Wait if you handle highly sensitive data, you cannot tolerate occasional misjudged priorities, or you are outside the US and cannot access the preview anyway.

Meanwhile, if you want proactive behaviour today, evaluate the alternatives in our OpenAI Dots and Meta Muse coverage, and read our wider guide to what jobs AI will replace by 2030 for context on where this category is heading.

Four signals will show whether Duet becomes a daily habit or a curiosity. The first is the waitlist conversion: how quickly Anthropic opens access beyond US Pro and Max, and whether it adds Android, desktop or other regions. The second is autonomy settings: whether users get granular control over which actions need approval. The third is independent testing: anyone measuring how often the morning brief surfaces the right items, and how often it surfaces the wrong ones, will tell us more than any announcement. The fourth is security research: expect red-teamers to probe the inbox-injection surface within days of access opening, and watch how Anthropic responds.

Competitive moves matter too. Meta and OpenAI will not stand still, and a feature that is distinctive today, such as a particular approval flow or connector, may be table stakes within a quarter. Our insights hub tracks each of these launches as they happen.

Claude Duet matters less for any single feature than for what it signals: the three largest consumer-facing AI companies now agree that the next interface is an agent that initiates. Duet's distinguishing choices are the top-tier Opus 5.5 model, the professional and small-business focus, a clear approval model and unusual candour about failure modes.

What we do not yet know is the thing that decides whether it sticks: how often its morning brief is right, how much of your plan allowance it quietly consumes, and how well it resists hostile content in the inbox it reads. A research preview exists to answer those questions, and the early evidence will come from the first cohorts of users, not from launch-day demos.

We will update this article as access widens, pricing is confirmed and independent testing appears.