How Anthropic designed Claude Duet: an engineering breakdown

Anthropic opened a research preview of Claude Duet on October 21, 2026. It is an agent that works on its own: it watches your connected apps, sends you a morning brief, and does tasks in the background. The most useful part of the launch is not the model. It is two product decisions that any team building an agent like this has to make.

The first is how often the agent checks your apps. Anthropic treats that as a cost decision. The second is what the agent may never do, even when you say yes. Anthropic put hard limits, approval gates, an outbound data filter, and virtual cards around the agent before it shipped.

This is a summary of what Anthropic published, how those two decisions work, and what to copy for your own agent. Everything below comes from Anthropic's announcement, its product page, and TechCrunch's coverage. Security and safety details are Anthropic's own claims. They have not been independently tested.

What is Claude Duet?

Claude Duet is a separate app where Claude works as a proactive agent. It is available on iOS, Android, and claude.ai.

It runs on Claude Opus 5.5, according to Anthropic.
Each morning it sends a short brief on the most important items across your connected apps.
During the day it messages you only when something needs your attention.
It has a virtual machine with its own browser, so your laptop or phone does not need to be on.
It can use more than 6,000 connectors and plugins from the Claude Marketplace.
It carries over your memory, skills, and connected apps from your Claude account.

Access is through a waitlist for US Pro and Max subscribers. Team and Enterprise plans are not included yet. Anthropic says it built Duet for professionals and small business owners.

TechCrunch frames the launch as Anthropic's entry into a crowded market of agents, alongside products such as Meta Muse and OpenAI Dots.

How often does Claude Duet check your apps, and why?

Every few hours. Anthropic says Duet "checks your connected accounts every few hours, because checking nonstop would use up your plan's limits much faster."

That sentence is the core design choice. An agent that "keeps tabs" on your inbox and calendar is not watching in real time. It wakes up on a schedule, reads what changed, and decides whether anything needs you.

The reason is cost. During the preview, Duet shares your plan's usage limits with the rest of Claude. Anthropic says its background checks count toward those limits. Larger tasks, like building a financial model or a deck, use more model turns and more background work.

So the check interval is a budget setting, not just a product setting. Every check costs model work, even when nothing has changed. Checking more often makes the agent feel more alert, but it spends the user's limit faster.

There is a tradeoff, and Anthropic names it. The product page says Duet "can miss something that arrives between checking in with you." A slower schedule means cheaper runs and a longer gap before the agent notices something.

Anthropic also lets users adjust this. You can tell Duet what you want to hear about and how often. Anthropic says it is still testing the agent's judgment about when to message you and will keep tuning it.

What will Claude Duet never do, even with your approval?

Anthropic splits actions into three groups.

Done on its own. Duet reads, drafts, and prepares work without asking.

Done only after approval. Before it sends a message, makes a payment, signs a document, or deletes anything, Duet shows you exactly what it is about to do and waits for your approval.

Never done. A few things are off-limits even with your approval. Anthropic gives two examples: trading securities and moving money between accounts.

The third group is the interesting one. Most agent designs stop at "ask the user first." Anthropic decided that some actions are too risky to allow even when the user agrees in the moment. A hard block cannot be clicked through by a tired user or bypassed by a misread request.

You can also disconnect any app Duet has access to.

How does Claude Duet keep sensitive data from leaking?

Anthropic describes a new classifier and a safety system prompt that check each outgoing message. The point is simple: an agent that reads email and sends messages for you is always deciding where information should go.

Anthropic says the filter works in tiers:

Strictest tier. Requests to share things like credit card numbers and government identification are rejected.
Other sensitive data. Details such as health or personal finances go out only when you have explicitly told Duet to send them.

Anthropic lists other safeguards it says Duet uses:

Credentials follow the design Anthropic uses for Claude Managed Agents, so Duet never directly sees your passwords or sign-in tokens.
Actions are checked by Anthropic's auto mode classifier, the same safeguard it uses to stop Claude and Claude Code from taking steps you did not ask for.
Defenses against prompt injection and hidden instructions come from Anthropic's browser-use research.
Red teams and an external firm ran penetration tests, and Duet is covered by Anthropic's public bug bounty program.
The product page says approvals, logins, and safety checks run in your own cloud computer.

Anthropic says it will share more details about Duet's safety design in the coming days.

How does Claude Duet pay for things?

Through Stripe's Link digital wallet or Shopify's Shop Pay.

With Link, Duet confirms the item with you, and Link asks you to approve the spend. It then pays with a virtual card, so your real card number is not shared. Duet can also use Shop Pay to check out at online stores.

This is a second layer on top of the approval gate. Even if something goes wrong after approval, the agent never holds the real card number. Anthropic says signing in to sites with logins saved in 1Password is coming soon, with your permission.

What weaknesses does Anthropic admit?

Anthropic is direct about the limits of this preview:

It "still might misread a thread or miscalibrate what's urgent."
It can miss something that arrives between check-ins.
It was built around work, so personal errands, such as booking tickets, are weaker.
It cannot yet show you its browser while it works.
It lives in its own app, separate from the main Claude app.

The first two weaknesses follow from the design. Judging urgency is hard, and a scheduled check will always have gaps.

When does this design not apply?

Not every agent needs a schedule measured in hours. If missing an event for a few hours is costly, for example an outage alert or a fraud signal, a slow check is the wrong choice. In those cases an event-driven trigger, such as a webhook, is a better fit than polling.

The hard-limit list also depends on the domain. Anthropic's list fits a business assistant that touches money. A coding agent or a support agent would need a different list.

What can you copy for your own agent?

The lessons are about product design, not models.

Treat the check interval as a cost setting. Work out what one check costs and how many checks a user's budget can afford. Then pick the interval. Tell users what they give up by checking less often.
Let users tune it. Anthropic lets users say what they want to hear about and how often. That moves part of the cost decision to the person paying for it.
Write a never list. Decide which actions stay blocked even with approval. Put it in code, not only in a prompt.
Gate the actions that cannot be undone. Sending, paying, signing, and deleting should show the exact action and wait for a yes.
Filter what leaves. Check outgoing messages for sensitive data, with stricter rules for the most sensitive tier.
Keep secrets away from the model. Do not let the agent see passwords, tokens, or real card numbers. Use virtual cards and a credential layer the model cannot read.
Publish your weaknesses. Anthropic told users the agent can misjudge urgency and miss things between checks. That sets honest expectations.

Source: Introducing Claude Duet, Anthropic