What is Claude Duet, and how do its approvals work?
Claude Duet is Anthropic's proactive agent app in research preview: it runs Opus 5.5 on its own cloud computer and asks before it sends, pays or deletes.
Key takeaways
- Anthropic opened a research preview of Claude Duet, a proactive agent app, on October 21, 2026.
- It is waitlisted for US Pro and Max plans and always runs on Claude Opus 5.5.
- Claude Duet checks connected accounts every few hours and works on its own virtual machine.
- It waits for approval before it sends, pays, signs or deletes, and refuses some financial actions.
On this page
Claude Duet is a new Anthropic app, opened as a research preview on October 21, 2026, in which Claude works as a proactive agent: it sends a morning brief, watches your connected apps, keeps working on its own cloud computer when you step away, and asks for approval before it acts on your behalf [1][4]. Access is by waitlist for US Pro and Max subscribers, and the preview runs on Claude Opus 5.5 [2].
What is Claude Duet?
Claude Duet is a separate app, not a mode inside the main Claude app [1]. Anthropic built it for "professionals and small business owners," and it ships as a standalone app on iOS and Android, while on a computer it runs on the web at claude.ai [1][3]. You talk to it in one ongoing thread, by text or voice, and it reports back when a job is done or when it needs a decision [3].
The difference from a chat assistant is who starts the conversation. Claude Duet sends a short brief each morning on important items across your connected apps, monitors those apps during the day, and messages you only when something needs your attention [1]. You can also hand it work directly, from scheduling meetings to building dashboards, forecasts, prototypes and web apps [1].
It starts with what your Claude account already knows. The memory, skills and connected apps from your Claude account carry over to Claude Duet [1], and it can search your past chats if the "Search and reference chats" setting is on [2].
How does Claude Duet work?
Claude Duet runs on its own virtual machine with its own browser, so tasks continue in the background even when your laptop or phone is off [1]. Work enters the loop from three directions: the morning brief, a scheduled check of your accounts, or a message from you. From there the agent works through connectors, or through its cloud browser for sites without one, and stops at an approval gate before any sensitive action.
The model is fixed. During the preview you cannot pick a model: Claude Duet always runs on Claude Opus 5.5 and decides by itself how much effort a task needs [2].
Monitoring is periodic, not continuous. Claude Duet "checks your connected accounts every few hours," a choice Anthropic describes as a way to conserve usage [1]. The support article states the consequence plainly: something urgent can arrive between two checks [2].
Connectors, browser and purchases
Claude Duet can use the more than 6,000 connectors and plugins in the Claude Marketplace, with examples such as Gmail, Slack, QuickBooks, Stripe, HubSpot, Docusign and Shopify [1]. You start each connection yourself and can disconnect any app at any time; disconnecting stops future access, but Claude Duet keeps its memory of information it saw before [2].
For approved purchases, Claude Duet can pay through Stripe's Link wallet with a virtual card and can check out with Shop Pay [1]. The support article adds that each purchase uses a one-time card [2].
What does Claude Duet ask approval for?
Claude Duet shows you the exact action and waits for your approval before it sends a message, makes a payment, signs a document or deletes anything [1]. If you cannot answer right away, it finishes other work and brings the request back later [2].
Some actions are refused even when you approve them. The announcement names trading securities and moving money between accounts [1], and the support article adds accessing someone else's account [2].
| Action class | What Claude Duet does |
|---|---|
| Reading connected apps, drafting, research | Works on its own, reports back |
| Sending a message, paying, signing, deleting | Shows the action and waits for approval |
| Trading securities, moving money between accounts, using someone else's account | Refuses, even with approval |
| Entering a password | You type it in a separate form on your device [2] |
The protections go beyond the approval prompt. Anthropic says the credential handling means Claude Duet "never directly sees your passwords or sign-in tokens," and a new classifier checks each message to guard against leaks of sensitive information [1]. The most sensitive data, such as credit card numbers and government ID, is blocked from sharing, while health or financial information is shared only when you explicitly instruct it [1]. Anthropic also says the app has been red-teamed and penetration tested and is covered by a public bug bounty [1].
Prompt injection remains the open risk. Claude Duet treats content from e-mails and web pages as information rather than instructions, but the support article says no defense against prompt injection is perfect [2]. That matches Anthropic's April 9, 2026 framework, which describes an agent as a model, a harness, tools and an environment, and argues that safeguards have to cover all four [5].
What does this mean for teams running AI agents?
For now, Claude Duet is a personal agent, not a team one. It is not available on Team or Enterprise plans yet, although Anthropic plans to add them later [2]. A team lead who uses it on a Pro or Max plan is connecting their own accounts, so the approvals, memory and connected apps belong to one person.
The design is still worth studying if you run agents for a team. Claude Duet combines four choices that many teams make by hand: a fixed check schedule instead of constant polling, an approval gate on actions that leave the system, a hard block list that approval cannot override, and credentials that the model never sees. Anthropic's framework describes the same control as permissions for each action Claude takes: always allow, needs approval, or block [5]. If your team's agents lack one of those layers, that is the gap to close first.
Two details matter for planning. Memory outlives a disconnected app [2], so decide what to connect before the first run, not after. And the periodic check means Claude Duet is not an alerting system; keep your existing paging for anything that cannot wait a few hours.
How do you get access to Claude Duet?
You join the waitlist on the Claude Duet product page, and Anthropic sends invitations in waves without a guaranteed date [2][3].
- Check that you have a Pro or Max plan on a US Claude account [2].
- Join the waitlist with the e-mail address of your Claude account. Access is tied to that address, and it must also match the Apple or Google account on your phone [2].
- When invited, install the iOS or Android app, or open it on the web at claude.ai [3].
- Connect the apps you want it to watch. You start each connection yourself and can disconnect any app at any time [2].
- Review every draft and approval request before you confirm, since the app can misjudge urgency [2].
Claude Duet costs nothing extra during the preview, but it is not free of usage. It draws on your plan's five-hour session and weekly limits at the same rate as regular chats, and background work such as the morning brief and check-ins counts too [2]. Larger tasks need more model turns [1]. To offset this, admitted users get one full reset of both limits, usable until November 30, 2026 [2].
What are the limits and open questions?
The preview has clear gaps, and Anthropic lists most of them. You cannot watch or take over Claude Duet's cloud browser, it cannot see all your projects or the files on your computer, and it can read your work in Claude but not change it [2]. It does not make phone calls or send texts, Slack works with limits, and Microsoft 365 is not available yet [2].
Quality is uneven by task type. Anthropic says Claude Duet "still might misread a thread or miscalibrate what's urgent," and that personal tasks such as booking tickets are weaker than work tasks [1].
Several questions are not answered in the sources. The pages do not give the exact check interval beyond "every few hours," a price after the preview, a date for Team and Enterprise plans, or any audit export of what the agent did. Until they do, treat Claude Duet as a supervised assistant for one person's accounts, and keep the approval step on.
Frequently asked questions
Who can use Claude Duet?
Claude Duet is a research preview for Pro and Max subscribers with US Claude accounts, admitted from a waitlist in waves. Team and Enterprise plans are not included yet, though Anthropic plans to add them later.
Does Claude Duet cost extra?
No. During the preview it is included in Pro and Max at no extra cost, but it uses the same five-hour and weekly usage limits as regular Claude chats, and its background checks count toward them.
Can Claude Duet act without asking me?
It reads, drafts and researches on its own, but it shows you the action and waits for approval before it sends a message, makes a payment, signs a document or deletes anything. Trading securities and moving money between accounts are refused even with approval.
Which model does Claude Duet use?
Claude Duet always runs on Claude Opus 5.5 during the preview. You cannot choose the model, and the app decides how much effort each task needs.
How often does Claude Duet check my apps?
Anthropic says it checks connected accounts every few hours rather than continuously, to conserve usage. Something urgent can therefore arrive between two checks.