Anthropic launches Claude Duet to run business tasks between check-ins

Claire Vo wanted to take their kids to a Warriors game against the Pacers. The noon start made it possible. On the way to dinner, they had software looking for tickets, but the wait grew long enough that they forgot about the search.

The software was Claude Duet.

Anthropic opened a research preview of Duet on October 21 for professionals and small-business owners who want work handled between check-ins. It monitors connected accounts and prepares tasks for approval, deciding when to contact the person who assigned the work.

Vo, a small-business operator at ChatPRD and host of How I AI, described the ticket search in an early review. The task appeared in Duet’s checklist, but the agent had not brought them back to it. By the time they returned, their attention had moved elsewhere. They already used agents for business work, with about five people involved in their regular working routine.

Work between messages

Duet runs on Opus 5.5 and has its own cloud virtual machine, a remote computer with a browser. As an agent, it chooses tools and steps to complete an assignment, checks results and continues until it finishes or needs help. Work can continue with the user’s laptop closed and phone switched off.

Claude users already had some of that freedom. Since October 6, new Pro and Max Cowork tasks have run in the cloud. New scheduled tasks can run without a device online, while existing local tasks and schedules can remain on the computer. Duet adds routine account monitoring and an ongoing conversation in which the software decides when something deserves attention.

Users can speak or type into that conversation. Memory, account skills and app connections carry over from Claude, and an immediate request can sit alongside a project lasting a week. Existing context gives an owner a starting point for assigning work without rebuilding everything in a separate service.

Each morning, Duet sends a brief drawn from connected applications. It checks accounts every few hours during the day, with users able to specify what warrants contact and how often. Finished assignments and requests for review also produce notifications. Those periodic checks leave intervals when a new message or account change may await the next check; continuous monitoring would use the subscription allowance faster.

Chelsea Larsson, who leads model and product behavior design, gives Duet a to-do list before leaving to spend time with the kids and receives an evening report. Amin Ebrahimi runs Shahs of Kabob, which had roughly 110 employees at the October launch, with accounting, customer-service and marketing work spread across applications. “I don’t need to open up 100 tabs,” Ebrahimi said. These employee and customer examples were selected by Anthropic.

The evening report describes an assignment begun by a person, with a known moment to look at the results. Account monitoring asks Duet to make an additional judgment: whether something the user has not just requested deserves an interruption.

Business permissions

The Claude Marketplace offers more than 6,000 connectors and plugins combined. For an owner, the useful question is what Duet can do with the records behind those connections. Announced workflows include checking QuickBooks or Stripe for unpaid invoices and drafting reminders, or using HubSpot contact and deal history to prepare a follow-up email.

The owner can return to a prepared response instead of starting with a search across accounts. Sending it still requires a decision. Before sending a message, making a payment, signing a document or deleting anything, Duet must show the proposed action and wait for approval. Trading securities and transferring money between accounts are blocked even with approval.

Payroll sits inside those limits. Anthropic lists preparing and running Gusto payroll, including hours, bonuses and reimbursements; its FAQ describes preparation for user review. The announced use case does not give Duet permission to bypass payment approval. An owner handing over payroll preparation still has a review to complete before authorizing consequential action.

Purchases can involve approval in two places. With Stripe’s Link wallet, Duet confirms the item with the user, then Link asks for spending approval. Payment uses a virtual card so the real card number is not shared. Shopify’s Shop Pay is another checkout option.

That arrangement lets preparation proceed while the owner is away, but it also creates points where a background assignment waits for a person. Someone returning to a finished draft may need only to review its wording; a purchase brings a separate spending decision. How often those requests arrive depends on the work being assigned.

Users can disconnect an app connection and can see activity and steer ongoing work. Duet cannot yet show them its browser, however, so reviewing an activity account does not offer the same visibility as watching the browser carry out a task.

Safeguards around connected accounts

Anthropic’s Claude Managed Agents design keeps sign-in credentials outside the environment where the model’s generated code runs. Authorized tool calls can use those credentials without exposing them to the model, allowing access to an account without putting its sign-in secrets into the model’s working context. Anthropic says Duet’s credential handling follows that design and that Duet never directly sees passwords or sign-in tokens.

The business records still have to be processed. Finding an unpaid invoice requires reading its contents; drafting a response requires using information from the account. Separating a password or sign-in token from the model protects the means of entry, while the email and invoice data remain part of the work the user authorized.

Anthropic describes automated checks for actions outside the user’s instructions and for sensitive information leaving the account. Anthropic says its classifier and safety prompt are designed to reject requests to share credit-card numbers and government identification. Other sensitive material, including health and personal-finance details, needs an explicit instruction before it can be sent.

Browsing and connected messages also expose Duet to prompt injection: malicious instructions hidden in material the agent encounters. The danger is that software treats something it was supposed to read as permission to change its task. Safeguards must distinguish an owner’s instruction from text in an email or webpage, even when both appear during the same assignment.

In its trustworthy-agents research, Anthropic says multiple prompt-injection defenses together do not guarantee protection. The same trustworthy-agents post describes users tuning out approval prompts during tasks with dozens of actions, a concern when human approval is part of the protection.

Anthropic says red teams and an outside firm penetration tested Duet’s infrastructure, and the product is covered by its public bug bounty. The launch materials provide no independent Duet productivity or security measurement, or estimate of allowance consumed per task.

An early user’s experience

Vo’s review praised the onboarding for making access and capabilities clear. Existing artifacts were already available, task lists made assignments visible, and Slack-style channels offered places for separate work. For sales-pipeline work, connected Slack, email and customer-management data came in quickly.

A Google Docs sales deck started from the phone was usable, though it did not use Figma to match the company’s fonts and design. The reviewer explicitly acknowledged having a high personal design bar and thought a less particular business user could be happy producing sales material from a template. The distinction matters for review: a generated deck may supply a working document while still requiring attention to the company’s presentation.

Waiting was a more persistent obstacle. Some parallel task threads took more than ten minutes to finish, return or ask for permissions, Vo said. These were reported waits during one person’s early use, rather than a performance rate for all Duet assignments. As threads continued, they forgot about them, leaving results or requests competing with whatever work had taken their place.

The reviewer also wanted more proactive contact, while acknowledging uncertainty about whether notifications had been enabled. Their experience therefore cannot be treated as a controlled notification failure.

The missing desktop app made that harder. Duet has separate iOS and Android apps and can be opened through claude.ai, but the reviewer wanted a desktop presence during meetings and computer work. Tasks begun on the phone needed somewhere familiar to be picked up later.

Sharing was another business requirement. ChatPRD’s operator described working regularly with about five people, without needing a large enterprise deployment. Duet’s channels resembled a collaboration tool, but lacked the shared-agent experience they wanted with those colleagues. An assignment might begin with one person, while its results need to enter work involving others.

Anthropic separately acknowledges that Duet can misread threads and misjudge urgency, and that personal errands such as ticket booking are weaker. Those limitations concern both what work gets done and which unfinished matter gets brought back to a user.

Other background agents

Meta introduced Muse in September, with its own cloud computer and approval for sensitive actions. Its proposed work includes purchases and travel. OpenAI’s dots followed later that month, promising work between conversations. Both preceded Duet’s preview, with overlap in background execution and decisions about when to seek a person’s help.

Duet places business work such as invoice follow-ups and payroll preparation near the center of its pitch. Vo’s review considered it alongside agents already in regular use, making the point of comparison an existing working routine rather than a first encounter with background software.

A shared allowance

Access begins with a waitlist for U.S. Pro and Max subscribers. Team and Enterprise plans are not included yet in the research preview. Duet carries no additional subscription charge during the research preview; the pricing page lists Pro at $20 billed monthly or $200 billed annually, with Max starting at $100 a month.

Background checks draw on the same usage allowance as the rest of Claude. A financial model or deck requires more model turns and background activity than a smaller assignment. An owner using Claude throughout the day therefore has to fit Duet’s monitoring and delegated work into that existing allowance.

The cost in attention also varies with the assignment. Reviewing an invoice reminder, checking a deck’s design and authorizing a purchase require different kinds of judgment, even if the preparatory work happened out of sight. Vo’s reported waits included requests for permission, so returning to a thread did not always mean returning to finished work.

For an owner joining the preview, how many useful assignments will fit alongside existing Claude use, and how much time will completing the required reviews take?

Meta and Sierra Draft Open Standard for How AI Agents Sign In to Businesses

Meta, Sierra and partners including Walmart and Stripe announced Tuesday Personal Agent Protocol, a standard its backers say anyone can implement for personal AI agents' authentication and permissions

The Implicator

Google Launches Gemini Agent That Gives AI Coworkers Their Own Workspace Email

Google Cloud launched the Gemini agent on Thursday, October 8, letting companies give an AI coworker its own company email address, calendar and directory entry. The agent takes objectives, plans work

The Implicator

Apple Will Require Explicit Consent for Mac Full Disk Access, Citing AI Agent Risks

Apple will add controls requiring Mac users to take “very explicit user action” before granting an app Full Disk Access, citing growing risks from AI agents. The permission “largely sidesteps” macOS p

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai