🔍 Read the full analysis: The Race For Always-On AI Agents Is Also A Fight Over Control on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic launched Claude Duet on October 21 as a waitlisted research preview for some U.S. subscribers, adding to a growing field of AI agents that work in the background on cloud computers. Anthropic says the agent requires approval for sensitive actions and blocks some financial activity, but independent testing has not been reported. The broader contest also concerns who controls connected accounts, stored context and the choice of model handling a task.
Anthropic launched Claude Duet on October 21 as a waitlisted research preview, joining OpenAI, Meta and SpaceXAI in a contest to sell AI agents that can work on a cloud computer while users are away. The release puts the focus not just on what agents can do, but on who controls their app access, approvals and model choices.
Anthropic describes Duet as a separate app available through iOS, Android and claude.ai. It is built on Claude Opus 5.5 and is being offered to U.S. Pro and Max subscribers by waitlist. The company says the agent can prepare a morning brief from connected apps, accept tasks by text or voice, and message users when it needs attention. Its work runs on a virtual machine with a browser, rather than on the user’s own computer.
Examples from Anthropic include scheduling meetings, building dashboards or sales forecasts, and finding unpaid invoices in services such as QuickBooks or Stripe. The company says Duet can draw on account memory and more than 6,000 connectors and plugins in the Claude Marketplace. Those capabilities and safeguards are Anthropic’s descriptions; the source material reports no independent test of the preview.
Anthropic says Duet must ask before sending sensitive messages, making payments or deleting items, and show the proposed action, destination and content. The company says trading securities, moving money between accounts and accessing another person’s account are blocked. It also says background checks run every few hours, consume shared Claude usage limits, and may miss developments between checks. Duet cannot yet show users its browser, according to Anthropic.
Infographic 01 · The permission ladder
What Claude Duet does alone, what it asks first, what it never does.
Anthropic’s three tiers for an agent that keeps working while you are away. Health or financial details go out only with your explicit consent.
Does it alone
no approval
- Reads connected apps: mail, calendar, Slack, invoices
- Sends a morning brief, then flags what needs you
- Drafts replies, reminders, decks, dashboards
- Prepares payroll or contracts for your review
- Checks accounts every few hours, not nonstop
Asks you first
approval card shows action, destination, content, recipients
- Sending a potentially sensitive message
- Paying (one-time card via Link, limited to merchant and amount)
- Signing a document
- Deleting anything
- Never on “don’t ask me again”: paying or sending money, deleting an order, creating an account
Never, even if you approve
blocked
- Trading securities
- Moving money between accounts
- Accessing someone else’s account
- Sharing sign-in credentials, full card or bank numbers, government ID numbers
- Seeing your passwords, cookies or sign-in tokens (kept off the model’s machines)
“Approval fatigue is a serious issue, because too many requests teach people to tap through them.”Anthropic, Claude Duet safety post
These are Anthropic’s stated rules for the research preview. No independent test has been published yet.
Sources: Anthropic, Introducing Claude Duet (21 Oct 2026); Anthropic, Duet safety post (23 Oct 2026); Claude Duet FAQ.
Powered by Thorsten Meyer AI
Control Over Access and Approvals
Always-on agents need permission to read information across services and may be asked to act on it. That makes account access and approval design central to whether users and organizations can trust them, not merely technical details. If an agent can draft a payment or message, the practical boundary between assistance and action depends on what it can access and when a person must intervene.
Anthropic’s own warning about approval fatigue points to a tension in the model: too many prompts can train users to approve without careful review. Its stated safeguards also have limits. Some actions are blocked outright, while the product’s periodic checks can miss events and its background work counts toward usage limits. These are material trade-offs for businesses considering agents for invoices, payroll, contracts or other sensitive workflows.
There is also a question of who selects the model behind an agent. The source material says SpaceXAI’s Grok Bot may route tasks to other companies’ models, including Claude Opus 5.5, and cites an xAI security FAQ saying customers cannot restrict Grok Bot’s model choice. If that description holds, users may interact through one company’s interface while another company’s model processes a task. That would place leverage with the service managing the routing, connected data and usage meter, though the commercial and technical consequences remain unsettled.
Products Worth Considering
Oral-B iO Series 5 Rechargeable Electric Toothbrush with Travel Case and 3 Brush Heads, Black
Theragun Mini 3rd Generation Massage Gun – Travel Essential (Black)
Levoit Eleva 300X HEPA Air Purifier for Home and Bedroom
As an affiliate, we earn on qualifying purchases.
A Crowded Field of Background Agents
The launch follows a series of agent announcements described in the source material. SpaceXAI opened the Grok Bot beta on August 11, Meta launched Muse on September 8, OpenAI introduced Dots at its September 29 DevDay, and Google released Gemini Agent on October 8, according to TechTarget as cited by the source. Anthropic announced Duet on October 21.
The products share a broad pitch: instead of waiting for a prompt in a chat window, an agent can work in the background, retain context and return with a result or a request for help. Their features, access rules and pricing may differ, and the source material does not provide a fully comparable independent evaluation. The sequence establishes a fast-moving market, not proof that the products perform equally well.
Anthropic published a safety post on October 23 describing Duet’s approval gates and restrictions. It says the system does not see users’ passwords, browser cookies or sign-in tokens, and that a classifier refuses to share credentials, full payment-card or bank numbers, and government identification numbers. Anthropic also says health or financial details are shared only with explicit consent. These remain company-reported protections in a research preview.
“Approval fatigue is a serious issue, because too many requests teach people to tap through them.”
— Anthropic, in its safety post
Preview Limits and Open Questions
Duet is a waitlisted research preview, and the source material cites no independent evaluation of its performance, security or safeguards. It is not clear how often the described approval checks will work as intended in varied real-world settings, or how users will respond to prompts over time. Anthropic acknowledges that the agent may misread threads and urgency, and that it can miss updates between checks.
The source also does not establish whether model routing in Grok Bot applies to every task, what information is passed to outside model providers, or what controls customers may have beyond the quoted FAQ language. Comparisons among Duet, Dots, Muse and Grok Bot are limited by the lack of consistent independent tests in the material. Availability beyond the stated U.S. Pro and Max subscriber preview, future pricing and a general release date are also not specified.
Anthropic says disconnecting an app stops new access, but information Duet has already learned remains until its memory is reset. The source does not give further detail on how long that information is retained or how the reset process works. Those details matter to organizations weighing connected agents for sensitive workflows.
Pilots Before Wider Deployment
Anthropic’s preview is currently limited to U.S. Pro and Max subscribers by waitlist. The company has not provided a general release date in the source material. Further information about availability, product limits and controls may emerge as the preview develops, but no specific next announcement is identified.
For companies considering this type of software, the source recommends starting with small, written pilots, read-mostly permissions and an exit plan. That approach can test whether the agent is useful while limiting the consequences of errors or unwanted access. Users are advised to begin with low-stakes tasks, connect only a few apps and retain approval requirements for anything that sends, pays or deletes.
As rival services develop, users and administrators will also need clearer answers about which model handles each task, what information it receives, and whether customers can control those choices. For now, the key next step is not a settled winner in the agent race, but evidence from real use about reliability, permissions and the amount of control customers retain.
Key Questions
What is Claude Duet?
Claude Duet is Anthropic’s agent in a waitlisted research preview. The company says it runs tasks on a cloud computer, can prepare briefs and work across connected apps, and can be contacted by text or voice.
Who can use Claude Duet now?
Anthropic says access is limited to U.S. Pro and Max subscribers through a waitlist. The source material does not give a date for wider availability.
Can Duet send messages or make payments without asking?
Anthropic says Duet must request approval before sending sensitive messages, paying or deleting items. It also says certain activities, including trading securities and moving money between accounts, are blocked.
Has Duet’s safety been independently tested?
The source material describes Anthropic’s stated safeguards but reports no independent test of the research preview. Its performance and protections in wider use remain unverified in the material.
Why is model routing part of the control debate?
An agent may route a task to a model made by another company. The source cites xAI statements indicating Grok Bot’s model choice cannot be restricted through a team allowlist, but does not establish how every task is routed or what information is shared in each case.
Source: ThorstenMeyerAI.com
