With Claude Duet, Anthropic follows Meta and OpenAI into always-on agents that watch your Slack, email and calendar and act before you ask. Its own CTO calls handing over the keys "a little scary." He did it anyway.
For most of the past three years, AI companies competed on whose model scored highest. On Wednesday, Anthropic made clear that the contest has moved somewhere else.
The company opened a waitlisted research preview of Claude Duet, an agent that reads your inbox, keeps an eye on your calendar and business apps, and messages you when it thinks something needs your attention. You don't have to open it first.
Anthropic CTO Rahul Patil gave the launch its most candid endorsement. "Giving an AI the keys to your Slack, mail, calendar and everything else is a little scary," he wrote on LinkedIn. "I know, because I did it."
Patil runs engineering at a company that has built its reputation on caution, and his pitch wasn't about how smart the model is. He was explaining why he decided to let it into his accounts. That's a different argument from the one the industry has been making, and Meta and OpenAI have been making it too.
An Agent That Goes First
Duet runs on Claude Opus 5.5 inside a hosted virtual machine with its own browser, so it keeps working after you close your laptop. Each morning it sends a brief drawn from your connected apps. During the day it checks those accounts every few hours, works on tasks you've handed it by text or voice, and reports back in one ongoing thread.
Anthropic says Duet works with more than 6,000 apps, including Gmail, Slack, Stripe, QuickBooks, Gusto, Shopify and DocuSign. Its sample tasks are aimed squarely at small businesses: chasing unpaid invoices, preparing payroll for review, getting contracts ready to sign.
The examples Anthropic has shared from early testers say a lot about where the value comes from. In one, Duet noticed a property showing had been entered on the wrong day. In another, it saw a client call booked shortly before the user's flight and offered to move it, AlphaSignal reports. Neither catch takes much reasoning. They depend on the agent being able to see the calendar in the first place.
Anthropic's choice of who led the project fits the same pattern. Karan Ahuja, who ran product management at Meta Superintelligence Labs until July, led Duet's development, according to BigGo Finance. The labs have spent years recruiting researchers. Now they're also hiring the people who know how to get a product onto your phone and into your daily routine.
Why Patil Says He Trusts It
Patil gave three reasons for handing over access. "I trust it because it checks with me before anything important," he wrote. Duet also scans outgoing messages for private information, and "it pays with a one-time card, so it never needs my real one."
The card detail has a backstory. Patil was Stripe's CTO before joining Anthropic in October 2025, TechCrunch reported at the time. Duet makes purchases through Link, Stripe's digital wallet, which issues a virtual card that hides the real number. So the payment system he's vouching for comes from his former employer.
The safeguards themselves are substantial. Before Duet sends a message, makes a payment, signs a document or deletes anything, it shows the user exactly what it plans to do and waits for approval, according to AlphaSignal's account of the launch. A separate classifier looks for actions the user never requested. Duet can't trade securities or move money between accounts even when the user says yes. It never directly sees passwords, and it won't send card numbers or government ID numbers at all.
Nearly all of those protections apply to what Duet does, though, and very few to what it reads. Going through your email, drafting replies and deciding what's urgent all happen without anyone watching, because that's the whole reason the product exists. Meta and OpenAI are asking users to accept the same arrangement.
What the Preview Can't Do Yet
"It's a preview, so it won't be perfect," Patil wrote. Anthropic says as much in its own launch thread, acknowledging that Duet can still misjudge what's urgent. For a product built to decide what's urgent, that's a notable admission.
There are practical limits as well. Because Duet checks connected accounts only every few hours, an email that arrives between checks can sit for a while. Background work counts against the same usage limit as regular Claude, so Pro subscribers may run out sooner. Users can't see the agent's browser while it works. Access is limited to US Pro and Max subscribers on a waitlist, and Team and Enterprise plans aren't included yet, with no date given, Trending Topics reports.
A few days before the launch, Anthropic disclosed that Claude models in internal testing had sometimes worked around obstacles rather than stopping, in some cases submitting forms on real websites, Trending Topics noted. Anthropic deserves credit for publishing that. It also shows why Duet's approval step has to work every time.
Meta and OpenAI Got There First
Anthropic is the third big name to ship this kind of agent since early September. Meta released Muse on September 8, free to start, with $20 and $100 monthly tiers, and it was downloaded 730,000 times in its first five days. OpenAI followed on September 29 with Dots, which connects to more than 4,000 plugins. Google's Gemini Spark has been available since May.
The products are built in much the same way. Each runs on a cloud computer with a browser, connects to the user's apps, and asks for approval before doing anything significant. With the underlying setup this similar, the model matters less than which agent people connect first and how much they let it see. An agent that already handles someone's email, calendar and payroll is hard to replace.
The companies on the receiving end are pushing back. Amazon blocked Muse from shopping on its site, and a Meta agent posted a Toronto man's home address on Facebook Marketplace without his permission. As State of AI reported this week, Delta, JPMorgan Chase, Charles Schwab and Yelp have also started restricting AI agents. Schwab CEO Rick Wurster says the firm blocks dozens of attempts by AI agents to reach client money every week.
What Enterprise Leaders Should Be Asking
Duet is a consumer preview for now, but the questions it raises will land on corporate desks soon.
The first is about attention. Once an agent sorts your inbox, you mostly see what it decided to show you. If it takes a wrong action, you'll probably notice. If it decides an important email can wait, you may never know, and that's the mistake Anthropic says Duet can still make.
Approval is another weak point. Each of these companies says a person signs off before anything consequential happens. The more useful an agent becomes, though, the more often it asks, and people who get a dozen approval requests a day tend to stop reading them.
Security teams will worry about concentration. An agent connected to email, chat, payroll, contracts and payments is a single target with access to all of it. Microsoft CEO Satya Nadella has already advised businesses to treat AI models like insider threats, and always-on agents make that advice harder to ignore.
IT departments also have a shadow AI problem coming. Duet is sold to individuals, but it's designed for people's working lives. Plenty of employees will connect a personal agent to their work Slack and email without asking anyone.
Cost is the next question. Duet checks in every few hours in part to limit compute, and it's easy to imagine faster check-ins becoming a paid upgrade. Companies that already ration AI spending, like Accenture with its $29-a-month Claude cap per employee, will have to decide whether constant monitoring is worth paying for.
There's also the matter of agents dealing with other agents. If your Duet drafts a payment reminder and your client's Dot is the one that reads it, software is handling both sides of a business relationship, and there are no norms yet for how that should work.
Patil ended his post by asking early users to share their stories. Those stories will probably say more about where this goes than any benchmark. The models are already capable of much of this work. What's still unsettled is how much access people are willing to give them, and which company they'll give it to.
