Anthropic Launches Claude Duet: AI Agent Proactively Manages Work Tasks

Anthropic has launched the Claude Duet research preview, an proactive AI agent built on Claude Opus 5.5. It can periodically check the user’s authorized email, calendar, and business software, generating daily priority briefings and continuously performing tasks such as scheduling meetings, following up on invoices, analyzing data, creating marketing assets, and building web prototypes within its own cloud virtual machine—even when the user’s phone or computer is turned off. Duet can access over 6,000 connectors from the Claude Marketplace, but requires user approval before sending messages, making payments, signing documents, or deleting content; securities trading and fund transfers between accounts are fully prohibited. The product is currently available only via a waitlist to U.S.-based Pro and Max subscribers and shares usage quotas with standard Claude. Anthropic also acknowledges that early versions may misinterpret emails, misprioritize tasks, struggle with personal bookings, and currently do not allow users to view the agent’s browser. What truly matters is not another chat assistant, but the fact that leading model companies are beginning to compete for control over the entry point to continuously maintain work context and perform software operations on behalf of users.

Article author, source: Anthropic

Traditional chatbots only begin working after the user opens the window and types a question. Claude Duet reverses this relationship: it first checks the apps the user has granted access to, identifies what matters most, and then proactively sends briefings or reminders.

Every morning, Duet summarizes the most important content from connected apps. Throughout the day, it continues monitoring these accounts and only notifies users when it identifies an email, meeting change, overdue payment, or other item requiring human attention. Users can also specify exactly what to monitor and how often to receive updates.

This “continuous monitoring” does not involve constantly reading all applications. Anthropic explains that Duet currently checks accounts approximately every few hours, as constant checking would quickly exhaust the subscription quota. In other words, it functions more like a cloud-based assistant that periodically wakes up, checks for changes, and then goes back to work, rather than a millisecond-level real-time monitoring system.

Duet retains the memories, skills, and connected apps from the user's Claude account. Users assign tasks through a persistent conversation thread, using text or voice—whether it’s a brief reply or a project spanning a week, everything remains within the same context.

What truly sets it apart from a regular Claude conversation is a cloud-based virtual machine with a dedicated browser. Once a task begins, users can close their phones and computers—Duet continues running in the background, determining which apps to invoke and which steps to execute, and sends notifications when the task is complete or requires review.

Anthropic has set its initial target users as professionals and small business owners. Officially listed tasks include scheduling meetings, reading missed Gmail and Slack messages, drafting responses, as well as invoking dozens of tools to create dashboards, sales forecasts, financial models, product prototypes, and web applications.

Claude Duet can use over 6,000 connectors and plugins available on the Claude Marketplace. For example, it can check for unpaid invoices in QuickBooks or Stripe and draft reminder emails; fill in hours, bonuses, and expense reports in Gusto to prepare for payroll; review customer and transaction history in HubSpot to draft follow-up emails; transform product launch materials into social media content in Canva; and assist with configuring and managing a Shopify store.

It can also use Stripe's Link digital wallet to purchase business supplies. Duet first confirms the item with the user, then Link requests payment authorization and completes the purchase using a virtual card, avoiding the need to share the actual card number with the merchant. Shopify’s Shop Pay is also supported. Connecting to 1Password and using saved login credentials to access websites remains a future feature not yet available.

Early use cases also demonstrate that the product aims to replace not a single software application, but the manual coordination between applications. According to the official report, a real estate agent received a Duet-generated morning brief that revealed a property viewing had been scheduled on the wrong date; a user running a food service business with approximately 110 employees used it to manage invoices, customer service, and marketing across multiple locations; and another brand consultant received a background brief before client calls and was alerted that a meeting time was too close to a flight departure.

These cases are drawn from internal employees and early testers selected by Anthropic and are not an independent evaluation of success rates across a large user base; they cannot be used to infer that Duet can reliably handle all enterprise workflows.

Claude Duet is permitted to read materials, draft content, and prepare tasks on its own, but it must display the upcoming action to the user and await approval before sending messages, making payments, signing documents, or deleting content. Users can also disconnect any application at any time.

Certain actions cannot be performed even if the user consents, including securities trading and transferring funds between accounts. This distinction is important: Duet’s use of the term “active” primarily refers to identifying tasks, planning steps, and preparing outcomes—it does not imply that it has unconditional authority to act on the user’s behalf.

Credential handling follows the design of Claude Managed Agents. According to Anthropic, the model does not directly see passwords or login tokens. The system also employs an action classifier to determine whether an action exceeds user requests, alongside defense mechanisms developed in its browser agent research against hidden instructions and prompt injection. Anthropic states that the product has undergone internal red teaming and penetration testing by an external company, and is also included in a public bug bounty program.

Because Duet needs to simultaneously read emails and business data and draft outgoing content on behalf of users, defining information boundaries is particularly challenging. Anthropic has addressed this by implementing dedicated classifiers and safety system prompts: information of the highest sensitivity—such as credit card numbers and government identification documents—must not be sent externally by Duet; health or personal financial information may only be sent if the user explicitly requests it.

However, the official launch article did not disclose the success rate of prompt injection tests, the classifier’s false positive rate, the identity of the external penetration testing firm, or the full test report, nor did it demonstrate that these mechanisms can prevent all indirect injections or malicious connectors. A more accurate current conclusion is: Anthropic has implemented multiple layers of boundaries for high-privilege agents, but the actual reliability of these boundaries still requires validation through real-world use and independent assessment.

Claude Duet's core strength is judgment: it must decide what is important enough to act on, what can wait, and when to interrupt the user. But this is precisely the hardest ability to evaluate using traditional benchmarks.

Anthropic explicitly acknowledges that the current version may misinterpret email threads, classify routine matters as urgent, or overlook truly important changes. Although users can specify what to monitor and the frequency of alerts, the system may still struggle to balance between sending too many notifications and missing critical items.

Personal tasks are also a current weakness. Duet is primarily designed for work scenarios, and tasks such as booking flights or event tickets are not yet reliable; users also cannot currently open a cloud-based browser to directly view which pages the Agent accessed or what it clicked. This reduces the auditability of the process, especially when results do not meet expectations.

The Research Preview is a standalone iOS, Android, and web application separate from the main Claude app, currently available only to U.S.-based Pro and Max subscribers on a waitlist. It does not receive a separate unlimited quota: background checks, long-running tasks, and multiple model calls required for creating financial models or presentations share the existing plan limits with regular Claude conversations.

Claude Duet is not the first continuously operating individual agent. Reuters noted that OpenAI previously launched Dots, which works across applications like Slack and Microsoft Teams, and Meta has been promoting Muse. Duet’s differentiating approach is to directly leverage the flagship Opus 5.5 model and integrate Claude’s existing memory, skills, connectors, and browser execution environment into a single continuous conversation.

The focus of this competition is no longer just on whether models answer questions accurately, but on who can obtain sufficiently complete context: what happened in the emails, what’s scheduled in the calendar, whether the client has paid, whether the project is delayed, and which actions require immediate human decision.

Once an agent can retain this information long-term and continue operating while the user is offline, it could become a new entry point above email, financial software, CRM, e-commerce backends, and browsers. However, the same capabilities also concentrate privacy and security risks: whereas attackers previously needed to compromise multiple accounts individually, in the future, a single high-privilege agent or its connection layer being breached could expose multiple systems simultaneously.

Therefore, Claude Duet’s value ultimately depends not only on how intelligent Opus 5.5 is, but also on its ability to consistently assess urgency, correctly execute cross-app steps, maintain clear audit trails, and uphold permission boundaries in the face of malicious websites, erroneous emails, and ambiguous instructions.