Anthropic opens Claude Duet preview to US Pro and Max users

Anthropic opened a US research preview of Claude Duet on October 21. The standalone agent app, available to invited Claude Pro and Max subscribers, can monitor connected tools, continue assigned work in the cloud and ask for approval before consequential actions.

Access starts through a waitlist, with invitations going out in waves and no guaranteed access date. Anthropic says the preview is limited to Claude accounts in the United States; Team and Enterprise plans are not included yet. During the preview, Duet is available as a separate iOS and Android app and through claude.ai on the web, rather than inside the main Claude app.

Anthropic describes Duet as more proactive than its chat product. The company says it can prepare a morning brief from email, calendar and other connected apps, check those apps at intervals, alert the user when it judges that attention is needed, and take requests by text or voice in a continuing thread. It carries over memory, skills and connected apps from a user’s Claude account and, according to Anthropic, can work with more than 6,000 connectors and plugins from the Claude Marketplace.

The agent runs on its own cloud computer and browser. Anthropic says that setup lets it keep working after the user closes the app or turns off a local device. It can return larger assignments as files such as briefs, financial models, slide decks or dashboards. Background briefs, checks and larger jobs all count against the subscriber’s existing Claude usage limits; Anthropic says the preview is included in Pro and Max subscriptions at no additional charge.

Anthropic says approval gates apply before Duet sends a message, makes a payment, signs a document or deletes anything. Some actions remain prohibited even with approval, including securities trading, transferring money between accounts and accessing another person’s account. Users can disconnect an app, although the help documentation says memories formed from earlier conversations are retained.

The company’s protection claims are not independent security findings. Anthropic says Duet uses a dedicated classifier and safety prompt intended to block disclosure of its strictest category of information, including card numbers and government identification. Health or personal-finance information can be sent only after an explicit user instruction. The company also says password entry is separated from the Duet chat so credentials go directly to the browser environment, and that internal red teams and an external firm conducted penetration testing. Anthropic does not identify that firm or publish the scope, methods or results.

Anthropic also warns that no prompt-injection defense is perfect. It presents user approval as one protection against malicious instructions embedded in emails or web pages, but users cannot watch or take over Duet’s browser during the preview. The company says Duet can misread a thread, misjudge urgency or miss something that arrives between scheduled checks. It also says the agent’s work-oriented features are currently stronger than its handling of personal errands. Anthropic has not disclosed how many people it will admit, when access will expand beyond the initial US plans or when Claude Duet might become generally available.