On October 21 Anthropic opened a research preview of Claude Duet, an app where Claude works as a proactive agent: it brings you what needs your attention, completes the tasks you give it, keeps working when you step away and checks with you before it acts on your behalf. It is aimed at professionals and small business owners. The useful question for a business owner is not whether Duet is nice. It is what to check before you let an agent, this one or any other, do things on your behalf. Read carefully, the announcement answers a good part of that question.
What the announcement says
Only what is written on the official page of October 21, 2026:
- it is an app for iOS and Android, and it is also on claude.ai; for now access is through a waitlist, for Pro and Max subscribers in the US only;
- every morning it sends a short brief on the important items in your connected apps, then checks your accounts every few hours and messages you only when something needs you;
- it has a virtual machine with its own browser, so it works with your phone and laptop off;
- it reads, drafts and prepares work on its own, but before it sends a message, makes a payment, signs a document or deletes anything it shows you what it is about to do and waits for your approval;
- some things are off-limits even with your approval, such as trading securities or moving money between accounts;
- credentials follow the design of Claude Managed Agents: it never directly sees your passwords or sign-in tokens.
Anthropic itself says this is an early version that may misread a thread or miscalibrate what is urgent, and that it cannot yet show you its browser.
The right line: what can be undone
Look at the list of actions where Duet stops: send, pay, sign, delete. They are not the "important" actions. They are the ones you cannot undo. A bad draft goes in the bin, a sent email does not; a sloppy quote can be fixed, a wire transfer cannot be called back.
That is the right criterion, and it applies to any agent, bought or built. If a vendor pitches you an AI automation, the first question to ask is: which actions does it take on its own, and which ones stop and wait for me? If the answer is vague, the model is not the problem.
Three Duet choices to demand everywhere
Credentials never reach the agent. In Duet the agent never sees passwords or tokens. A rule like "do not reveal the password" is something the model has to follow; an architecture where the password never reaches the model does not depend on the model at all. The second is sturdier.
Some things are simply forbidden. Duet has actions it will not take even with your yes. It sounds excessive until you think about how approvals happen in real life: quickly, at the tenth notification of the day, maybe away from the office. For actions where a mistake costs too much, it is better if the button does not exist.
A check on sensitive data going out. Duet ships with a dedicated classifier that checks each message: it refuses to share card numbers and government ID, and lets health or financial information through only when you have explicitly told it to. An agent that reads your mail and writes on your behalf is constantly deciding where information goes, and that is exactly where this check belongs.
Two things the announcement does not make clear
Who writes the summary you approve. An agent that has read an email with hidden instructions could describe a harmful action in harmless words. So it matters whether the confirmation screen is written by the agent in its own words or by the system from the real data of the action. The announcement says Duet shows you exactly what it is about to do, but not how; Anthropic promises more details on safety in the coming days. Before connecting my accounting to it, I would wait for them.
Where the data goes. The agent runs on an Anthropic virtual machine, on the apps you connect. For a business in the EU, the question of where mail and invoices pass through, and in what data protection role for the vendor, is the first one to ask, not the last. The announcement does not answer it, and I am not going to guess.
Proactivity has a cost
An honest detail in the announcement: Duet checks your accounts every few hours instead of nonstop, because checking nonstop would use up the plan's limits much faster. Background checks count toward those limits, and larger tasks, like a financial model or a deck, use more. An agent that keeps an eye on things costs something even when it finds nothing: pick a few things to watch, and watch them well.
How I set up mine. I use an assistant built on Claude Code every day, and its principles are very close to Duet's. It runs in an isolated sandbox. Actions that cannot be undone (merging to the main branch, deploys, messages to third parties, payments) go through a separate approver, which sends me a summary on Telegram with two buttons, Approve and Reject. It keeps a git-based memory that is consolidated every night and that I approve. Credentials never pass through the chat, and it treats emails and web pages as data, never as instructions. On its own it runs scheduled jobs: audits of my sites and a morning check. It is not infallible: now and then it misreads a request or sticks to the wrong approach and needs correcting. That is exactly why the confirmation button sits where it does.
When you need it and when you do not
Duet makes sense if your day is mail, calendar, invoices and widely used SaaS tools, and you are fine with the agent running on a managed service. Two practical limits, though. The examples in the announcement are mostly US tools (QuickBooks, Gusto, Docusign, HubSpot): whether there are connectors for your own management software or e-invoicing has to be checked one by one in the marketplace. And for now you cannot try it outside the US.
A custom agent makes sense when it has to work on your servers, your code or your business software, when the approval rules have to be yours, or when you need to know exactly where the data goes.
You need neither if the process is not defined yet. An agent that automates a mess produces the mess faster, and asks you to confirm it every time.
I also wrote about the line between approving an action and protecting data in the context of the Laravel AI SDK. If you want to figure out which steps in your business can be handed to an agent, and where the confirmation button belongs, that is what I do in my AI automation consulting.