Claude Duet: Anthropic’s proactive agent for professionals, with approval still in the loop

Introduction

Most coding agents still wait for a prompt. Claude Duet is Anthropic’s attempt to invert that: the agent comes to the user with a morning brief, watches connected apps during the day, and keeps a VM busy in the background. That is a different product category from Claude Code’s repo loop. It is closer to a supervised operations partner for professionals and small businesses.

Primary source: Introducing Claude Duet. Adjacent Bacancy reading: Claude Code 2.1.302 fork subagents, Claude API browser and computer use, Claude August enterprise stack, and MCP EMA.

What shipped

Anthropic is explicit about gaps. Duet may misread a thread or misjudge urgency. Personal errands such as booking tickets are weaker than work tasks. It cannot yet show the user its browser. It lives in its own app, separate from the main Claude app, while Anthropic learns how the two should combine.

How the agent actually works

Proactive loop

• Each morning Duet sends a short brief on the most important items across connected apps.
• Through the day it checks those apps on a few-hour cadence, not continuously, because continuous polling would burn plan limits faster.
• Users can hand it tasks from scheduling to dashboards, forecasts, prototypes, and web apps, in one ongoing thread that also supports voice.
• Work continues when the laptop or phone is off, because the VM is Anthropic-hosted.

Approval and hard stops

• Duet reads, drafts, and prepares on its own.
• Before it sends a message, makes a payment, signs a document, or deletes anything, it shows the action and waits.
• Trading securities and moving money between accounts stay blocked even with approval.
• Users can disconnect any connected app.

Safety stack Anthropic cites

• Trustworthy-agents framework already used for Claude Code and Claude in Chrome.
• Credential handling aligned with Claude Managed Agents: Duet is not supposed to see passwords or sign-in tokens directly.
• Auto mode classifier for action approval, the same class of safeguard used with Claude and Claude Code.
• Prompt-injection defenses from Anthropic’s browser-use research.
• A dedicated classifier and safety system prompt that rejects sharing the strictest tier of data (credit cards, government ID) and only sends health or personal-finance data when the user explicitly instructs it.
• Internal red teams, an external penetration test, and coverage under Anthropic’s public bug bounty.

Connectors and spend paths

Anthropic lists Marketplace plugins for Gmail, Slack, QuickBooks, Stripe, Gusto, LinkedIn, Docusign, HubSpot, Canva, and Shopify, among others. Payments can go through Stripe Link with a virtual card so the real card number is not shared, and through Shop Pay. 1Password sign-in is listed as coming soon, with user permission.

That combination (inbox + ledger + payroll + payments) is exactly where a helpful agent becomes an incident. The product design puts a human on send, pay, sign, and delete. Operations still need to decide who is allowed to approve those prompts, on which devices, and with which audit trail.

How Duet compares with Claude Code and Cowork

Duet is not a replacement for Claude Code 2.1.x fork-subagent workflows. Engineering orgs should keep Code for repositories and evaluate Duet for inbox-and-ops load, if the waitlist and US-only preview even apply.

What it means for developers

• There is no public Duet API in the launch post. Do not plan a production integration on an unpublished SDK.
• Skills, memory, and Marketplace connectors carry over from the Claude account. A messy Claude connector graph becomes a messy Duet graph.
• Background checks consume the same Pro/Max quota as chat. Budget for polling, not only for visible turns.
• Larger tasks (financial models, decks) use more model turns. Load tests should include overnight jobs, not just a morning brief.
• Prompt-injection risk is first-class because Duet reads mail and the web. Assume untrusted content in every connected inbox.

What it means for businesses

• US Pro/Max waitlist means this is not a global enterprise SKU yet. Procurement should track region, identity, and data-processing terms before a department-wide rollout.
• Small-business examples in the post (calendar correction, invoice triage, pre-call briefs) are the right first pilots: high annoyance, reversible actions, human approval on send.
• Payroll, payments, and DocuSign are later-phase connectors. Keep them disconnected until legal and finance sign a written approval matrix.
• Duet sharing usage with the rest of Claude can starve coding or support agents on the same seat. Split seats if both workloads matter.

A conservative 14-day preview plan

1. 01
   Join the waitlist on a dedicated seat

   Use a US Pro or Max account that is not the org’s only Claude Code seat.
2. 02
   Connect two apps only

   Calendar plus one mailbox, or calendar plus Slack. Leave Stripe, Gusto, and DocuSign off.
3. 03
   Write an approval policy

   Name who may tap approve on send and delete. Screenshot every gated action into the ticket for the first week.
4. 04
   Measure quota

   Record morning-brief tokens, background-check tokens, and task tokens separately if the product UI exposes them.
5. 05
   Decide keep, wait, or skip

   Keep only if briefs are accurate and gated actions stay gated. Wait if the US-only preview or quota collision is the blocker. Skip if inbox risk exceeds the time saved.

Conclusion

Claude Duet is Anthropic packaging Opus 5.5 as a proactive, hosted operations agent with a VM, Marketplace plugins, and explicit approval on irreversible steps. The research preview is limited, quota-shared, and US-only. The pattern worth copying even before access lands is the split: autonomous draft, human gate on send, pay, sign, and delete.

Sources: Claude blog ; Anthropic