Anthropic opened a research preview of Claude Duet on 21 October 2026, an app where Claude works as a proactive agent. Built around Claude Opus 5.5, it ships on iOS, Android and claude.ai, for now only to Pro and Max subscribers in the US.
Key takeaways
- Research preview behind a waitlist, Pro and Max plans in the US only
- The agent runs on Claude Opus 5.5, with no separate usage limit
- Integration with more than 6,000 Claude connectors and plugins
- A new classifier and safety system prompt check each message
What the agent does
Each morning Claude Duet sends a short brief on the most important items across connected apps, then monitors them and speaks up only when something needs a decision. Tasks range from booking a meeting to building a dashboard from dozens of tools, producing financial forecasts and prototyping web apps.
It inherits memory, skills and connected apps from the Claude app, in one thread, and runs on its own virtual machine with a browser. Before a consequential step, such as sending a payment or deleting data, it asks for approval.
The diagram follows the working loop described by Anthropic. It does not show how the agent judges urgency or how the classifier layer operates.
Security as a precondition
Anthropic describes the security stack in more detail than the features. Credential handling comes from Claude Managed Agents, so the agent never sees passwords or sign-in tokens. Actions are approved by the auto mode classifier?classifier: a separate model that judges a single action or message and blocks it when rules are broken, the same safeguard that already protects Claude and Claude Code. Prompt-injection defences came from the company's browser-use research.
What is new is a dedicated classifier and safety system prompt that inspects every message for leaks of sensitive data, such as payment card numbers. Red teams and an external penetration-testing firm tested Duet, and it falls under the public bug bounty?bug bounty: a programme in which a company pays outside researchers for the flaws they report.
| Layer | Where it comes from |
|---|---|
| Credential handling | Claude Managed Agents, the agent never sees passwords |
| Action approval | the auto mode classifier, the same one as in Claude Code |
| Prompt-injection defences | the company's browser-use research |
| Sensitive-data leak control | a new classifier and safety system prompt |
| Testing | red teams, a penetration-testing firm, public bug bounty |
A third player in the same market
Duet enters a market where Meta has Muse and OpenAI has Dots. The difference is the audience: not the consumer, but professionals and small business owners. Anthropic notes this early version may misread a thread or miscalibrate urgency, and is weaker at personal errands like booking tickets.
Why it matters
The shift is subtle but real: the agent does not wait for a prompt, it decides what deserves attention. That moves the point of trust: instead of judging a single answer, the queue of priorities has to be trusted. Hence the space Anthropic gives to classifiers over features. One country and one price tier mark an experiment, not a launch.
What's next
- Access stays behind the waitlist, Pro and Max plans in the US only
- Anthropic names miscalibrated urgency as a known limitation of this version
- Duet joins the product line alongside Claude Code, Claude Cowork and Claude Tag
Sources
- Claude by Anthropic — Introducing Claude Duet
- Claude by Anthropic — Claude Duet — product page
- The Verge — Anthropic takes on Muse with Claude Duet, its new AI agent
