What can Claude Duet do while you are away—and where must it stop?
Anthropic's US research preview can monitor connected apps and continue tasks in a cloud browser after a device is off. Messages, payments, signatures and deletions require approval, while trading and moving money remain prohibited.
The short version
- What happened
- Claude Duet is a waitlisted US research preview for Pro and Max users, not a generally available service or a measured workplace study.
- Who it affects
- Professionals may gain help with follow-up and preparation while away from a screen, but they also become reviewers of an agent that can combine sensitive information across many services.
- What remains unproven
- This is a company announcement and waitlisted US research preview, not an independent evaluation or general release.
Keep in mind
This is a company announcement and waitlisted US research preview, not an independent evaluation or general release.
Selected tester anecdotes have no denominator, comparator or measured task, productivity, error or safety outcome.
Anthropic says the early version can misread threads and miscalibrate urgency; its browser activity is not yet visible to the user.
Security controls are described by the vendor without published task-level or adversarial-test results in the announcement.
Source analysis · 1 linked source. Primary analysed source date: 21 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The agent can keep working after the device is off
Claude Duet changes the interaction model from a person repeatedly opening a chatbot to an agent that can initiate contact. Anthropic says the standalone iOS, Android and web app sends a morning brief, checks connected accounts every few hours and can continue assigned work in a cloud virtual machine even when the user's device is off. The preview shares the subscriber's existing Claude usage limit, so monitoring and long tasks consume the same allowance as conversations.
The company lists more than 6,000 available connectors and plugins. Its examples include finding missed Gmail or Slack messages, drafting invoice reminders from QuickBooks or Stripe, preparing payroll in Gusto, creating a LinkedIn job post, sending documents through DocuSign and managing a Shopify store. It can also prepare purchases through Stripe Link or Shop Pay. These are described capabilities, not measured completion rates across those services.[1]
Approval gates narrow—but do not remove—the risk
Anthropic says the agent reads, drafts and prepares work independently, but pauses before sending a message, making a payment, signing a document or deleting anything. Trading securities and moving money between accounts remain off-limits. The company also says credentials are isolated, an action classifier checks proposed steps and a dedicated classifier blocks the strictest sensitive data, while health or financial information may be sent only after an explicit instruction.
Those controls matter because a background agent combines broad access, stored context and the ability to act. They do not establish that every harmful or mistaken action will be caught. Anthropic says Duet may misread threads, misjudge urgency and cannot yet show users its browser. It cites adversarial testing, an external penetration test and a bug bounty, but publishes no task-level error rate, prompt-injection success rate or independent assessment in this announcement.[1]
The distinction that matters
What happens without—and with—human approval
Anthropic draws a boundary between background preparation, approval-gated actions and prohibited financial activity.
Background
Read connected apps, draft and prepare work
Can continue in a hosted virtual machine
Approval gate
Send, pay, sign or delete
Must show the proposed action and wait
Prohibited
Trade securities or move money between accounts
Unavailable even with approval
For workers, the immediate question is delegation design
For a small-business owner or overloaded professional, the appeal is continuity: a task can progress without keeping a laptop open, while consequential steps return to the human. The new burden is deciding what the agent may see, how often it should interrupt and what evidence is needed before approving an action. Teams should start with narrow connectors, inspect drafts and transaction details, and keep a separate audit trail for approvals. Evidence from representative users—covering completion, error, correction time and harmful near-misses—would be needed before treating the preview as a productivity or safety gain.[1]