Claude Duet opens as a waitlisted US research preview for Pro and Max: Anthropic's proactive agent briefs you each morning, works from its own virtual machine, and must show you before it sends, pays, signs, or deletes

3 sources

On Wednesday, October 21, 2026 (calendar-verified; the page's own date label), Anthropic published 'Introducing Claude Duet' on claude.com. Per the announcement: 'Today, we're opening a research preview of Claude Duet, a new app where Claude works as a proactive agent. It comes to you with what needs your attention, completes tasks you ask of it, keeps working even when you step away, and checks with you before it acts on your behalf. We built Claude Duet for professionals and small business owners with more on their plates than they can track.' Platforms and plan: 'It's available as a standalone app on iOS and Android, and on claude.ai. For this research preview, Claude Duet is included in Pro and Max plans and uses the same usage limits as the rest of Claude.' Scope: 'We're starting today with Pro and Max users in the US.' — access is by waitlist. Model: 'We designed it around Claude Opus 5.5 and built it to be resourceful and to decide what needs you, what can wait, and when to check with you first.' (the product page's wording is 'Powered by Opus 5.5. Available in Pro and Max plans in the US.'). The loop: 'Each morning, it sends you a short brief on the most important items across your connected apps. Throughout the day, it keeps tabs on those apps and messages you only when something needs your attention.' and 'Claude Duet checks your connected accounts every few hours, because checking nonstop would use up your plan's limits much faster.' Infrastructure: 'Claude Duet has a virtual machine with its own browser, so it doesn't require your laptop or phone to be on.' Approvals: 'Claude Duet reads, drafts, and prepares work on its own. But before it sends a message, makes a payment, signs a document, or deletes anything, it shows you exactly what it's about to do and waits for your approval. A few things are off-limits even with your approval, like trading securities or moving money between accounts.' Connectors: 'Claude Duet can use the over 6,000 connectors and plugins in the Claude Marketplace to:' an eight-item list naming Gmail and Slack, Intuit QuickBooks or Stripe, Gusto, LinkedIn, Docusign, HubSpot, Canva ('Turn your product launch into a social campaign in Canva.') and Shopify; purchases run through Stripe's Link wallet with a virtual card, or Shop Pay; and 'Coming soon, with your permission, it will be able to sign in to sites with logins you've saved in 1Password.' Safety, per the announcement: credentials follow the Claude Managed Agents design 'so it never directly sees your passwords or sign-in tokens'; 'Red teams and an external firm penetration tested Claude Duet, and it's covered by our public bug bounty program.'; and the new classifier and safety system prompt: 'This new classifier and prompt are designed to reject requests to share the strictest tier of information, including credit card numbers and government identification. Other sensitive information, such as health or personal finances, are let through only when you've explicitly instructed Claude Duet to send it.' The vendor's own limits: 'This is an early version of Claude Duet, and it still might misread a thread or miscalibrate what's urgent. We built its core functionality around work, so personal errands, such as booking tickets, aren't quite as strong, and it can't yet show you its browser.' and 'Its background checks count toward those limits, and larger tasks, like building a financial model or a deck, require more model turns and background work.' Per TechCrunch (Ivan Mehta, 6:53 AM PDT October 22): the app is 'aimed at rivaling Meta Muse, OpenAI Dots, Hark, Instinct, Grok Bot, and Fo' — TechCrunch's list, absent from the announcement; and 'It said that, by default, the agent would turn down requests asking for credit card numbers and government identification.' — 'by default' is TechCrunch's rendering where the announcement reads 'designed to reject requests to share the strictest tier of information'.

Why now

Anthropic's agent for professionals and small business owners is this cycle's clearest pro-workflow entrant, and the details your audience needs are the ones that separate a trustworthy write-up from a hype post. Layer one, the access reality: it is a research preview, waitlist-gated, included in Pro and Max plans, and scoped to US users — TechCrunch's availability sentence drops the US, both official pages carry it, and the card keeps it everywhere. Layer two, the approval map: Duet reads, drafts, and prepares on its own, but gates exactly four actions on your approval — sending a message, making a payment, signing a document, deleting anything — and two categories are off-limits even with approval (trading securities, moving money between accounts); 'it asks before everything' is wrong in both directions. Layer three, the money-and-credentials layer your audience will ask about first: it never directly sees passwords or sign-in tokens per Anthropic's Managed Agents design, purchases run through Stripe's Link with a virtual card, the strictest-tier classifier rejects credit-card and government-ID sharing by design, and the 1Password sign-in is 'Coming soon' — every one of those is Anthropic's own description of its own safeguards, and the card says so. Layer four, the honest cadence: it checks connected accounts 'every few hours, because checking nonstop would use up your plan's limits much faster' — not real-time — and Anthropic itself warns it 'might misread a thread or miscalibrate what's urgent'.

Why it is worth publishing

The clearest worked example yet of the shift from chat assistants to agents that act — with a permission model your audience can learn from even if they never get off the waitlist. Productivity and small-business creators get a concrete explainer with an unusual amount of official detail to work from (the approval map, the virtual-machine setup, the usage-limits math); AI-safety creators get a case study in reading a vendor's own safeguards critically, because the announcement pairs each protection claim with its own admission of what the agent still gets wrong. The differentiation play is precision about scope: preview, waitlist, US-scoped, Pro/Max, four approval-gated actions — none of which survives flattened coverage.

Evidence basis

Three opened sources: the claude.com announcement (official; page date label October 21, 2026; published_time and JSON-LD datePublished both 2026-10-21; opened and read in full via raw HTML), the claude.com product page (official; no date metadata; opened via raw HTML), and TechCrunch (Ivan Mehta; byline 6:53 AM PDT October 22; published_time 2026-10-22T13:53:26+00:00; opened and read in full via raw HTML). Calendar checks: October 21, 2026 = Wednesday; October 22 = Thursday; October 23 (card publish) = Friday. Per-outlet discipline, never blended: the model line exists in three renderings — 'designed it around Claude Opus 5.5' (announcement), 'Powered by Opus 5.5' (product page), 'Built on the Claude Opus 5.5 model' (TechCrunch); the classifier rule is 'designed to reject requests to share the strictest tier of information' (announcement) vs 'by default, the agent would turn down' (TechCrunch); the errand limitation is 'aren't quite as strong' (announcement) vs 'isn't good at' (TechCrunch); 'over 6,000 connectors and plugins' vs TechCrunch's hyphenated 'plug-ins'; the US scope is carried by both official pages and missing from TechCrunch's availability sentence. The announcement's raw HTML returns zero matches for 'Muse', 'Dots', 'Hark', 'Instinct', 'Grok' and 'OpenAI' — TechCrunch's six-product rivalry list is the outlet's framing. The 1Password sign-in is future-dated 'Coming soon' in the announcement and appears in no other opened source. The search quota was exhausted this run (resets 2026-10-27) — sources reached by direct fetches (09-08 fallback) with Google News RSS as the second-source finder (10-18 precedent).

“Anthropic's Claude Duet research preview — US waitlist, Pro and Max — checks your connected apps every few hours from its own virtual machine and briefs you each morning — but before it sends, pays, signs, or deletes, it has to ask you.”

Angle

Frame it as 'Anthropic's agent that acts on your behalf is real — here's the exact permission map, what it refuses to do, and who can actually get in' in four beats. Beat one, access: research preview, waitlist, US, Pro and Max only — say all four. Beat two, the daily loop: a morning brief across connected apps, background checks every few hours (Anthropic's own cost reason), and a virtual machine with its own browser so your laptop can be off. Beat three, the permission map: it works on its own for reading, drafting, and preparing, but shows you exactly what it's about to do before sending a message, making a payment, signing a document, or deleting anything — and trading securities or moving money between accounts is off-limits even with your approval. Beat four, the safety claims as claims: no direct password or token visibility, a strictest-tier classifier for card numbers and government IDs, penetration tests and a bug bounty — each one attributed to Anthropic, next to Anthropic's own admission that it 'might misread a thread or miscalibrate what's urgent'.

Format

Short talking-head video

Demo idea

A permission-map explainer using the announcement's own eight-item connector list: draw the four approval-gated actions (send, pay, sign, delete) as gates, add the two off-limits categories as walls, then walk the audience through what a morning brief looks like and what 'every few hours' means for their plan's usage limits.

Platform notes

Availability keeps all four qualifiers everywhere — research preview, waitlist, US, Pro and Max — never 'launched', never dropped to 'Pro and Max customers' without the US (TechCrunch's sentence omits it; the official pages govern). Every safety sentence names Anthropic as the claimant: 'Anthropic says it never directly sees your passwords or sign-in tokens', 'per Anthropic's own description' for the classifier and penetration tests — never render vendor safeguards as independently verified, and keep the vendor's own hedge ('might misread a thread or miscalibrate what's urgent') wherever the capability is praised. The approval map stays enumerated: four gated actions (send a message, make a payment, sign a document, delete anything), two off-limits categories (trading securities, moving money between accounts) — never 'asks before everything', because the same source sentence has it reading, drafting, and preparing on its own. The classifier wording stays per-outlet ('designed to reject requests to share the strictest tier of information' per the announcement; 'by default' only inside TechCrunch-attributed layers), with the two-tier structure intact (health and personal finances pass only when explicitly instructed). The 1Password sign-in stays 'Coming soon'; the safety-details writeup stays 'in the coming days'; the check cadence stays 'every few hours', never real-time. Testers stay vendor-selected ('Anthropic says early testers...'). No standalone price appears; usage limits stay shared with the plan. TechCrunch's rival list stays TechCrunch-attributed or out. zh scripts keep Claude Duet、Anthropic、Claude Opus 5.5、Claude Marketplace、Stripe Link、Shop Pay、1Password in English; 研究预览（research preview）never 正式发布; 候补名单 stays; 「主动型智能体」is Anthropic 的说法; 「每隔几小时」never 实时; 审批范围 keeps the four actions plus two off-limits categories, never 事事都先问; 1Password 登录写「即将推出」.

Usable claims

On Wednesday, October 21, 2026 (calendar-verified; the page's own date label), Anthropic published 'Introducing Claude Duet' on claude.com. Per the announcement: 'Today, we're opening a research preview of Claude Duet, a new app where Claude works as a proactive agent. It comes to you with what needs your attention, completes tasks you ask of it, keeps working even when you step away, and checks with you before it acts on your behalf. We built Claude Duet for professionals and small business owners with more on their plates than they can track.' Platforms and plan: 'It's available as a standalone app on iOS and Android, and on claude.ai. For this research preview, Claude Duet is included in Pro and Max plans and uses the same usage limits as the rest of Claude.' Scope: 'We're starting today with Pro and Max users in the US.' — access is by waitlist. Model, per the announcement: 'We designed it around Claude Opus 5.5 and built it to be resourceful and to decide what needs you, what can wait, and when to check with you first.' (the product page's wording is 'Powered by Opus 5.5. Available in Pro and Max plans in the US.'). The loop: 'Each morning, it sends you a short brief on the most important items across your connected apps. Throughout the day, it keeps tabs on those apps and messages you only when something needs your attention.' and 'Claude Duet checks your connected accounts every few hours, because checking nonstop would use up your plan's limits much faster.' Infrastructure: 'Claude Duet has a virtual machine with its own browser, so it doesn't require your laptop or phone to be on.' Approvals: 'Claude Duet reads, drafts, and prepares work on its own. But before it sends a message, makes a payment, signs a document, or deletes anything, it shows you exactly what it's about to do and waits for your approval. A few things are off-limits even with your approval, like trading securities or moving money between accounts.' Connectors: 'Claude Duet can use the over 6,000 connectors and plugins in the Claude Marketplace to:' an eight-item list naming Gmail and Slack, Intuit QuickBooks or Stripe, Gusto, LinkedIn, Docusign, HubSpot, Canva ('Turn your product launch into a social campaign in Canva.') and Shopify; purchases run through Link, Stripe's digital wallet, with a virtual card, or Shop Pay; and 'Coming soon, with your permission, it will be able to sign in to sites with logins you've saved in 1Password.' Safety, per the announcement: credentials follow the Claude Managed Agents design 'so it never directly sees your passwords or sign-in tokens'; 'Red teams and an external firm penetration tested Claude Duet, and it's covered by our public bug bounty program.'; and the new classifier and safety system prompt: 'This new classifier and prompt are designed to reject requests to share the strictest tier of information, including credit card numbers and government identification. Other sensitive information, such as health or personal finances, are let through only when you've explicitly instructed Claude Duet to send it.' The vendor's own limits: 'This is an early version of Claude Duet, and it still might misread a thread or miscalibrate what's urgent. We built its core functionality around work, so personal errands, such as booking tickets, aren't quite as strong, and it can't yet show you its browser.' and 'Its background checks count toward those limits, and larger tasks, like building a financial model or a deck, require more model turns and background work.' Per TechCrunch (Ivan Mehta, 6:53 AM PDT October 22): the app is 'aimed at rivaling Meta Muse, OpenAI Dots, Hark, Instinct, Grok Bot, and Fo' — TechCrunch's list, absent from the announcement; 'Built on the Claude Opus 5.5 model, Duet can connect to over 6,000 connectors and plug-ins in the Claude Marketplace.'; and 'It said that, by default, the agent would turn down requests asking for credit card numbers and government identification.' — 'by default' is TechCrunch's rendering where the announcement reads 'designed to reject requests to share the strictest tier of information'.

Evidence pipeline

From the news

Breakdown

An agent launch that reads email and moves money, where the discipline is scope and attribution. Layer one, availability: a 'research preview' by waitlist, included in Pro and Max plans, scoped 'in the US' by both official pages — TechCrunch's availability sentence drops the US, and the card never does. Layer two, the safeguards: 'never directly sees your passwords or sign-in tokens', the auto mode classifier, the red-team and external-firm penetration test, the bug bounty, and the strictest-tier classifier are all Anthropic's claims about Anthropic's design — attributed every time, with the vendor's own counterweight ('it still might misread a thread or miscalibrate what's urgent') carried wherever the capability is praised. Layer three, the approval map: Duet reads, drafts, and prepares on its own; exactly four actions gate on approval (send a message, make a payment, sign a document, delete anything); two categories are off-limits even with approval (trading securities, moving money between accounts) — 'asks before everything' is wrong in both directions. Layer four, the renderings: the model line exists three ways ('designed it around', 'Powered by', 'Built on'), the classifier rule exists two ways ('designed to reject' vs 'by default'), the errand limit exists two ways ('aren't quite as strong' vs 'isn't good at') — per-outlet, never blended. Layer five, the future stays future: the 1Password sign-in is 'Coming soon', the safety-details writeup is 'in the coming days', and TechCrunch's six-rival list is TechCrunch's alone — the announcement names none of them. Editor's rules: the qualifiers survive compression, the vendor stays the claimant, and the enumeration beats the summary.

Sources

Risks

Before publishing, re-check each layer: 'research preview' + waitlist + US + Pro/Max survives in title, hook, summary, and whyNow; every safety sentence names Anthropic as the claimant; the four approval-gated actions and two off-limits categories stay enumerated, never generalized; the classifier wording stays per-outlet with the two-tier structure; the 1Password sign-in and the safety-details writeup stay future-dated; testimonials stay vendor-attributed; no standalone price appears; the usage-limits caveat survives. If your script compresses any of these, cut the detail rather than round it.

Demo ideas

Permission-map diagram explainer: the four approval gates, the two walls, and the off-limits list drawn from the announcement's own sentences, with the 'reads, drafts, and prepares work on its own' lane shown separately
Waitlist-to-workflow walkthrough: who can join (US, Pro/Max), what to connect first (email, calendar, one invoicing app), and what the every-few-hours cadence means for usage limits