Claude Duet and the agent that asks first
Anthropic's new proactive agent works in the background and waits for a yes before it sends, pays, signs or deletes anything. That design choice is the real news, and it is a good rule for any agent you let near your business.
On 21 October Anthropic opened a research preview of Claude Duet, a separate app in which Claude works as a proactive agent. Instead of waiting for you to type, it watches the tools you connect, tells you what needs your attention and keeps working on tasks after you close the app.
A disclosure first: I have not used it. The preview is by waitlist and, for now, only for Pro and Max subscribers in the US, and I work from Spain. Everything below comes from Anthropic's own pages and early reports, linked at the end. What I can add is the view of someone who builds agents and automations for small businesses, and who has had to decide, more than once, how much to let one do on its own.
What it does
According to Anthropic, Duet is built "for professionals and small business owners with more on their plates than they can track". In practice:
- A morning brief with the most important items across your connected apps.
- Watching during the day, and messaging you only when something needs your attention.
- Drafting the replies: follow-up emails, answers to the messages you missed, meeting scheduling.
- Working in the background on its own cloud computer, so a task carries on after you close the app.
It runs on Opus 5.5 and uses the same memory, skills and connectors as regular Claude. It is available as an app on iOS and Android and on claude.ai, and its background checks count against your plan's usage.
The part worth copying
What I find most interesting is not what it can do. It is what it will not do without you.
Anthropic's wording: before it "sends a message, makes a payment, signs a document, or deletes anything, it shows you exactly what it's about to do and waits for your approval". It shows the action, the destination and the content, including every recipient. And some things stay off-limits even if you approve them, such as trading securities or moving money between accounts.
Around that sit a few more decisions:
- It never sees your passwords, browser cookies or the sign-in tokens of your connected apps.
- It is designed to say that it is an agent, and its browser identifies itself to the websites it visits.
- A separate check looks at every message before it goes out, in case it contains sensitive information.
Anthropic is also unusually frank about the limits: it "still might misread a thread or miscalibrate what's urgent", and the safeguards "will occasionally miss something or flag a harmless message".
Why the approval step matters
An agent that reads your inbox and drafts replies is useful from day one. An agent that sends those replies on its own needs to be right every single time, because one wrong email to a client cannot be unsent.
That is the line Duet draws, and it is the line I draw in my own work. I run a much smaller agent that looks after my servers. On the one that only hosts my own projects it is allowed to act by itself. On the servers that run clients' businesses it proposes what it wants to do and waits for my yes. It is slower. It is also the reason I can let it run at all.
The rule underneath is simple: anything that cannot be undone needs a human yes. Reading, sorting, summarising and drafting can be automatic. Sending, paying, deleting and signing cannot.
Before you let any agent into your business
Duet is one product among several: Meta's Muse and OpenAI's Dots are going after the same people. Whichever you try, and the same goes for an automation someone builds for you, these are the questions I would ask:
- What can it touch? Connect only what the job needs. An agent that triages email does not need your bank.
- What can it do without asking? Make sure everything irreversible is behind an approval, and check where that list is written down.
- Can you see what it did? You want a record of every action, not only the ones it tells you about.
- How do you stop it? Revoking its access should take one click, and you should know where that click is before you need it.
- Start small. A week of drafts you approve one by one will teach you more about whether to trust it than any review.
What this means if you are hiring
If someone offers to build you an AI agent or an automation, ask them the same questions. What does it have access to, what does it do without asking, and how do you switch it off? The flashy part of an agent is what it can do. The part that decides whether it helps or hurts your business is what it is not allowed to do.
If you are thinking about an agent or an automation for your business and want it built with that line in the right place, try the indicative quote check or tell me what you need.
Sources, as of 30 October 2026: Introducing Claude Duet, Claude Duet: safety, privacy and security, TechCrunch. Duet is a research preview, so features and availability may change.