Anthropic opened a waiting list for Claude Duet on 21 October 2026. The personal agent is designed to monitor work across connected apps, prepare tasks and contact its user when a decision is needed. This is an early research preview for Pro and Max subscribers in the United States. Israel is outside the initial rollout, and Team and Enterprise plans are not currently eligible.
The practical difference is where work begins. In an ordinary chat, the user opens a window and asks for help; Duet is supposed to notice something worth addressing first. Anthropic says it delivers a morning briefing, checks connected accounts during the day and keeps working even when the user's phone and computer are off. That promise comes with usage limits and defined boundaries on actions.
A morning briefing, then work in the background
Duet runs on Claude Opus 5.5 and has a separate app for iOS and Android, alongside browser access. It uses an existing Claude account, carrying over its memory, skills and connected apps. Users can type or speak in one continuing thread that accommodates both quick requests and longer assignments.
According to the company, the agent operates in a virtual machine with its own browser. That allows it to continue after the user disconnects, without requiring a personal computer to stay on. It sends a notification when work is complete or needs review. This separation also explains the product's operating model: work happens remotely, using the access connected to the account.
Checks are periodic, not continuous. Anthropic says connected accounts are checked every few hours because constant checking would consume the subscription allowance faster. A new message can therefore wait until the next check. Users can adjust what updates they receive and how often, but the announcement does not promise to detect every event immediately.
The morning briefing is intended to bring together the important items from connected apps. During the day, the agent must decide what deserves an interruption and what can wait. This changes how attention is allocated, beyond adding reminders: the system chooses which details to highlight from the information it can access. The company acknowledges that this judgment still needs tuning.
What it prepares, and when approval is required
Anthropic describes tasks including scheduling meetings, building dashboards, preparing business forecasts, prototyping and creating web apps. Duet can use more than 6,000 connectors and plugins in Claude Marketplace, the company says. That is the number available in the ecosystem, not a promise that every business account or every service action is accessible to every user.
Examples include finding Gmail and Slack messages, checking unpaid invoices in Intuit QuickBooks or Stripe, and preparing documents for signature through Docusign. The company also describes preparing payroll in Gusto and working with Shopify stores. These are advertised use cases, not measurements of the product's success rate across businesses.
The main boundary separates preparation from consequential action. Anthropic says Duet can read, draft and prepare independently. Before sending a message, paying, signing a document or deleting something, it shows the action and waits for approval. Securities trading and transfers between accounts remain prohibited even with user approval.
For purchases through Link, Stripe's digital wallet, the agent confirms the item with the user and Link requests approval for the spending. Payment then uses a virtual card so the actual card number is not shared. Anthropic also lists Shop Pay support. Access to logins saved in 1Password and a richer Shopify visual editor are future features.
For a business owner, this does not make a financial action automatically safe. The approval screen is where the recipient, amount and prepared action need checking. It keeps a consequential decision with the user while the agent handles preparation. Users also retain control over disconnecting apps, according to the company.
Permissions and sensitive information are part of the design
Anthropic says Duet never directly sees passwords or sign-in tokens. Its credential handling follows the design used in Claude Managed Agents. An action classifier is intended to prevent steps users did not request, while prompt injection defenses address outside content that attempts to redirect the agent.
Prompt injection matters particularly for an agent reading messages and documents. Text from another person can contain an instruction that appears to belong to the task. The system must distinguish information to process from an authorized instruction to act. App connections extend its capabilities and the places where that distinction matters.
The company describes an additional classifier and dedicated safety instructions that screen messages for sensitive information leaks. They are designed to reject requests to share credit card numbers and government identifiers. Personal health or financial information should be sent only on explicit instructions. These are company-described protections, not a guarantee against every error or leak.
Anthropic says red teams and an external penetration testing firm tested the infrastructure, and the product is covered by its bug bounty program. However, the launch announcement gives no overall failure rate for these defenses or comparative agent performance measure. It therefore cannot establish how much work the product will save each business.
Usage limits and availability constrain the promise
Duet is currently included for eligible Pro and Max subscribers but shares their usage allowance with the rest of Claude. Background checks consume that allowance too. Building a financial model or presentation can require more working turns than a short conversation. An existing subscription therefore does not provide a separate unlimited allowance for the agent.
Anthropic warns that the early version can misread a thread or misjudge urgency. Development has focused on work, while personal errands such as booking tickets are less mature. Users also cannot yet see the agent's browser. These are limitations of the announced product, not features promised for a particular completion date.
For readers in Israel, eligibility is the immediate issue: access starts through a waiting list in the United States, and the company has announced no Israeli launch date. The change already evident is in the working interface: an agent that prepares and proposes proactively, yet pauses before consequential actions. Its success will depend on those decisions as well as its output.