Claude Duet Messages You First. That Changes Who Is in Control.

On October 21, 2026, Anthropic opened a research preview of Claude Duet, an app where Claude works as a proactive agent: it watches your connected accounts, prepares work while you are away, and messages you when something needs you.

The interesting part is not that Claude can now start the conversation. It is how Anthropic moved the most important controls outside the model, and what still depends on a human tapping "approve."

Here is how Duet works, what its safety design gets right, where the real risks are, and how I would use it today. Research and product status checked November 14, 2026.

Twelve Approvals Before Lunch

Imagine it is Monday, 7:40 a.m. Before you open your laptop, a message is waiting on your phone. Claude has already read your inbox and calendar. Three things need you today: a contract is waiting for signature, a client invoice is overdue, and four emails have draft replies ready to send.

You approve the drafts on the train. By lunch, Claude has asked for approval twelve times. Send this follow-up. Pay this software renewal with a one-time card. Share the Q3 summary with the finance contact who asked for it. Each request shows exactly what will happen, where it will go, and who will receive it.

By the eighth request, you are no longer reading. You are tapping.

The finance contact who asked for the Q3 summary wrote from a domain that differs from your client's by one letter. The approval card showed the full recipient address, exactly as designed. You just did not look.

This is a hypothetical scenario, not a reported Duet incident. It is also not a story about a careless model. Every safeguard did its job. The agent prepared the work, an independent check judged that sharing a report requested by email matched your intent, and the approval card displayed the destination. The control that failed was attention.

Anthropic is unusually direct about this risk. In describing Duet's safeguards, the company acknowledged that "approval fatigue is a serious issue, because too many requests teach people to tap through them."

That sentence is the right place to start, because it identifies what really changes when an AI agent messages you first. A chat assistant waits. You decide when to ask, what to share, and what to do with the answer. A proactive agent decides when something needs you. It reads content you did not choose to show it, prepares actions you did not explicitly request, and asks for decisions on its schedule, not yours.

When an AI agent starts the conversation, consent moves from approving each request to granting standing authority. Claude Duet puts its most important controls outside the model, which is the right architecture. But the final control is still a human approval, and human attention is the scarcest resource in the system.

TL;DR

• Claude Duet is a proactive agent app, not a new model. It runs on Claude Opus 5.5 in a standalone app on iOS, Android, and claude.ai, and launched as a research preview on October 21, 2026.
• Access is limited. The preview is for US Claude Pro and Max subscribers through a waitlist. Team and Enterprise plans are not supported yet.
• It works while you are away. Duet runs on its own cloud virtual machine with its own browser, checks connected accounts every few hours, prepares a morning briefing, drafts replies, and delivers larger work as files.
• It inherits your Claude context. Duet uses the memory, skills, and connectors from your Claude account and can reach more than 6,000 connectors and plugins in the Claude Marketplace.
• Consequential actions need approval. Sending potentially sensitive messages, paying, and deleting require you to approve a request showing the action, destination, and content, including every recipient.
• The intent check runs outside the model. Anthropic says a separate check, extended from Claude Code's auto mode classifier, judges whether each action matches your intent, so instructions hidden in a page cannot answer it.
• Credentials never reach the model. Passwords go through an encrypted form, and sign-in tokens are inserted by a proxy outside the agent's machine. This is the right pattern for any agent.
• Some actions are blocked even with approval. Trading securities, moving money between bank accounts, and accessing someone else's account are prohibited.
• Proactive means the inbox becomes an input channel. Anyone who can email you can now place text in front of an agent that acts on your behalf. Prompt injection stops being an edge case and becomes the default threat model.
• Memory outlives connections. Disconnecting an app stops new access, but what Duet has already learned stays until you reset its memory.
• Background work is not free. Duet's periodic checks and tasks draw from the same usage limits as your regular Claude chats.
• Approval quality is the real bottleneck. The best use of Duet is to keep approvals rare, meaningful, and carefully read, not to approve faster.

What Claude Duet Actually Is

Most coverage has focused on the headline: Claude now messages you first. The details matter more.

• Claude Duet research preview: Launched October 21, 2026
• Model: Claude Opus 5.5
• Where: Standalone app on iOS and Android, plus claude.ai
• Who: US accounts on Pro and Max plans, via waitlist
• Not yet: Team and Enterprise plans
• Price: No extra charge during preview; uses your regular Claude usage limits, including session and weekly caps
• Runs on: Its own cloud virtual machine and browser
• Context: Your Claude memory, skills, and connectors
• Integrations: 6,000+ connectors and plugins, including Gmail, Slack, QuickBooks, HubSpot, Docusign, and Gusto
• Purchases: Through Stripe's Link wallet or Shopify's Shop Pay, using one-time cards

Anthropic describes the target user as professionals and small business owners with more tasks than they can track.

The company has also been clear about what Duet is not for. According to TechCrunch, Anthropic said Duet "isn't good at handling errands or booking tickets, and it can't show you its browser use as it happens."

Other preview limitations reported at launch: you cannot choose the model, watch Duet work, or take over its browser; it cannot make phone calls or send text messages; it does not monitor accounts continuously, only every few hours; it does not yet work with Microsoft 365; and some connectors, such as Slack, have limitations.

Anthropic's framing of why Duet exists now is about model judgment. Mike Krieger said, "We've found Opus 5.5 was our first model with the judgment to be proactive in the right ways."

Anthropic's launch materials say the model's judgment helps it "decide what needs you, what can wait and when to check with you first." That is a reasonable claim for a product team to make. It is also exactly the kind of claim that should never be the only control. The rest of Duet's design suggests Anthropic agrees.

First, Separate Reactive, Scheduled, and Proactive Agents

"Proactive agent" is easy to blur with features that already exist. They are different things, and the differences determine the risk.

• Mode: Reactive chat
  • Who decides when it acts? You, every time
  • What it reads: What you choose to share
  • Consent model: Per request
  • Main risk: Wrong answer
• Mode: Scheduled routine
  • Who decides when it acts? You, by defining a trigger
  • What it reads: What the routine is scoped to
  • Consent model: Per routine
  • Main risk: Wrong action on a schedule
• Mode: Proactive agent
  • Who decides when it acts? The agent, based on what it observes
  • What it reads: Everything its connectors can see
  • Consent model: Standing authority plus approvals
  • Main risk: Wrong judgment about what matters, acting on untrusted input

The distinction matters. In reactive chat, the user is the filter. You decide which email to paste, which document to upload, and which answer to act on. In a proactive agent, the agent is the filter. It reads the inbox, the calendar, the CRM, and the shared drive, decides what deserves your attention, and prepares an action.

That shifts three things at once:

• Input selection moves to the agent. It reads content you never chose to show it, including content written by strangers.
• Timing moves to the agent. It interrupts you when it decides something matters.
• Consent becomes standing. You granted access once. The agent uses it continuously.

Approvals are how you take some of that control back. That is why their design, and their volume, matter so much.

How Duet's Control Architecture Works

Anthropic published an unusually detailed safety, privacy, and security description for Duet on October 23, 2026. Reading it as an architecture, it looks like this:

Connected accounts (email, calendar, CRM, accounting, docs, web) → Claude Duet agent - Opus 5.5 on a cloud VM + isolated browser - memory, skills → proposed action → approval card: action, destination, content, recipients → You (phone or claude.ai)

Supporting checks:

• Intent check outside the model (from Claude Code auto mode classifier)
• Outbound sensitive-info classifier: never share / needs consent / allowed
• Hard blocks: securities, moving money between accounts, others' accounts
• Credential layer outside the agent: password form encrypted to browser, token proxy injects sign-in tokens at request time, one-time payment cards

Each layer controls something specific. Each also leaves something uncontrolled.

Layer 1: Standing access through connectors and memory

Duet uses the memory, skills, and connectors from your Claude account. It checks connected accounts every few hours and prepares work.

This layer controls what Duet can see. It does not control what Duet should trust. An email from a stranger arrives through the same connector as an email from your manager.

Layer 2: The approval tier

Before Duet sends a potentially sensitive message, pays, or deletes something, Anthropic says it "shows you the action, the destination, and the content, including every recipient," and waits.

Some steps cannot be covered by a "don't ask again" rule, including paying or sending money, deleting an order, and creating an account. Routines that run while you are away follow the same safeguards.

This layer controls which actions require a human decision. It does not control whether the human actually reads the request.

Layer 3: An intent check outside the model

This is the most important design choice in Duet. Anthropic says a separate automated check, extended from Claude Code's auto mode classifier, assesses whether each action matches your intent. In Anthropic's words: "The check runs outside the model doing the work so instructions hidden in a page cannot affect the outcome."

That is the right boundary. If a malicious email convinces the agent that forwarding a document is part of your task, the agent's own reasoning is compromised. A check that does not read the agent's reasoning, and is not reachable by the injected text in the same way, is far more robust.

This layer controls whether the action plausibly matches your request. It does not make the decision deterministic. It is still a classifier, and Anthropic says the safeguards "will occasionally miss something or flag a harmless message."

Layer 4: Credentials never enter the model

Anthropic says, "Claude Duet never sees your passwords, browser cookies, sign-in tokens, or other credentials." Passwords are typed into a form in the Claude app, encrypted with a single-use key, and passed to the browser without being opened. Sign-in tokens stay off the agent's machine. A placeholder sits there, and a proxy outside the machine inserts the real value during a request. 1Password sign-in is planned, so you can approve credential use there.

This is the credential pattern I recommended in my article on agent identity, now shipped in a consumer product. A prompt-injected agent cannot leak a password it never saw.

This layer controls credential exposure. It does not control what the agent does with the access those credentials grant.

Layer 5: An outbound sensitive-information classifier

A separate classifier checks every outgoing message, including files uploaded through the browser, against three tiers:

• Never share: sign-in credentials, full card and bank account numbers, and government ID numbers. Anthropic says Duet "is instructed never to share these with anyone, even if you ask."
• Needs consent: other private information, such as health or financial details, requires your explicit approval. Your own request counts as consent.
• Allowed: everything else.

If a message is blocked, Duet can rewrite it without the sensitive content and present the revised version for approval.

This layer controls specific categories of data leaving. It does not control ordinary business content, such as a quarterly report, going to the wrong recipient.

Layer 6: Hard blocks

Some actions remain prohibited even with approval: trading securities, banking actions such as moving money between accounts, and accessing someone else's account. These are deterministic boundaries, and they are the strongest controls in the system. No judgment, classifier, or tired human can override them.

Layer 7: Scoped payments

Purchases use a one-time card from a wallet such as Link, limited to one merchant and one amount, and you approve in the Link app. Your real card number is not shared. That is the task-bound spend pattern from my article on agent payments: scope the credential to the transaction, and put the approval on a surface the agent does not control.

Layer 8: Identifying itself on the web

Duet identifies itself with a distinct User-Agent header and publishes its IP addresses. Anthropic notes that some websites have opted out of being visited. That is a small detail with a large implication. Sites can recognize and govern agent traffic in