Claude Duet: Inside Anthropic's Agent That Keeps Working After You Close the Lid

On October 21, 2026, Anthropic opened Claude Duet as a research preview: a waitlist, the US only, Claude Pro and Max subscribers first. It runs on Opus 5.5 and ships as a standalone iOS and Android app, with the web version inside claude.ai. It is the third always-on consumer agent to arrive in seven weeks, after Meta Muse in September and OpenAI Dots in September.

But the interesting part is not the model. It is the two things Duet is allowed to do that a chat window cannot, and the two things it is forbidden to do even when you say yes.

What Claude Duet actually is

Duet is not a new chat. It inherits the memory, skills and connected apps from your existing Claude account, keeps everything in one thread, and accepts text or voice. What changes is the direction of initiation: you describe a task once, and it decides which apps to open and which steps to take, then reports back when it is done or when it needs a decision.

That is the same vocabulary this site uses everywhere else — an agent is a model plus tools plus a loop plus memory (see what is an AI agent). Duet's contribution is hosting the loop and the memory somewhere other than your laptop.

How it runs: a cloud VM, its own browser, and 6,000 connectors

Each Duet instance gets a dedicated virtual machine with its own browser, and that VM keeps running when your phone is off or your laptop is shut. This is the structural difference from every "browser agent" that ran locally: there is no lid to close. Meta made the same move with Muse's Secure VM, and the reasoning is identical — an agent that only exists while you watch is a demo, not a delegate.

The tools come from Claude Marketplace: Anthropic says Duet can call more than 6,000 connectors and plugins, including Gmail, Slack, QuickBooks, Stripe, Gusto, LinkedIn, HubSpot, Canva, Shopify and DocuSign. The tasks it is built for are unglamorous and specific: triage an inbox, schedule meetings, track invoices, assemble a forecast or a dashboard, build a small web app.

Two limits matter more than the connector count. First, Duet does not receive your passwords or your login tokens — Anthropic states they are never handed to the agent, and any connected app can be disconnected at any time. Second, logged-in browsing through saved 1Password credentials is announced, not shipped: it is described as coming with your permission, which makes it a claim to check later rather than a capability to plan around.

The permission model: four doors and two walls

Anthropic splits actions into work that needs no approval and work that does. Reading, drafting and preparing runs without asking. Four things require your sign-off, and the request arrives with the full action displayed first:

• sending a message
• making a payment
• signing a document
• deleting content

Then there are the two actions that do not unlock even with your approval:buying or selling securities, and moving money between accounts. Those are not approval gates, they are walls. It is a small detail that tells you where Anthropic expects the liability to sit — a brokerage trade is irreversible, attributable, and regulated in a way that a consumer subscription cannot absorb.

There is also a data-side filter. A dedicated classifier and safety system prompt check every message in two tiers. The hard tier refuses requests to share credit card numbers and government identity documents outright, with no conversational route around it. The softer tier — health and personal financial information — is released only when you explicitly instruct it to be sent. Anthropic says the remaining details of the design will be published over the following days, which is the honest reading of a research preview: the architecture is documented, the audit is not.

Anthropic also lists its own early defects: Duet may misread a conversation, and it may misjudge how urgent something is. Both are the failure modes you would expect from a loop that decides when to speak.

How it pays: Link, Shop Pay, and a card that is not yours

Payments run on two rails. Through Stripe Link, Duet confirms the item with you, Link then asks you to approve the spend, and the purchase is made with a virtual card — the merchant never sees your real card number, and Duet never holds it. Through Shop Pay, it can complete checkout on Shopify storefronts.

This is the most transferable design decision on the page. The spending limit is not a sentence in a system prompt; it is a card with a number that belongs to nobody. If the agent is compromised, the blast radius is whatever that card holds. Compare that with agents that ask for your real payment credentials and promise to be careful — one is a boundary, the other is a preference.

Why the banks said no

Within days of Muse shipping in September, US banks started closing the door on third-party agents. By mid-October the list was public:

• Citi does not allow third-party AI agents or assistants to log into a customer's account or transact directly inside its digital banking platforms. Customers can still grant read-only access to account information through certain open-banking providers.
• Bank of America is restricting agent access while it works out who is liable for a payment an AI authorised. CEO Brian Moynihan put it plainly: there should be a human in the loop to authorise money moving out of an account.
• JPMorgan Chase is doing the same, and Jamie Dimon gave the reason in one line — you do not want thousands of rogue systems reaching your customers.
• Morgan Stanley has begun blocking third-party agents from its platforms, according to reporting from Axios, while saying it has not observed rogue agents on them.

Bank executives also raised the question with the Federal Reserve, which declined to comment; regulators privately welcomed the blocks. Note what is absent from every one of these statements: nobody argues that the agent cannot do the task. The objection is about authority and liability, not capability.

The arithmetic behind the block

Apollo's chief economist Torsten Slok supplied the numbers that explain the urgency. The average US checking account pays about 0.1%. The accounts an agent could move idle cash into pay 3.3% to 5%. JPMorgan, Bank of America and Wells Fargo together hold roughly $1.6 trillion in non-interest-bearing deposits — about 16% of their liabilities. Paying 3% on that money would cost the three banks around $47 billion a year, which is nearly half of their combined annual earnings.

So an assistant that "optimises your cash" is not a feature request. It is a transfer of roughly five percent of a large bank's funding cost to its customers, executed automatically, at four in the morning, by something the bank cannot identify. Every restriction above follows from that sentence.

The boundary on a personal agent will not be set by the model. It will be set by whoever owns the balance sheet the agent wants to touch.

What to watch

Four things, in order of how much they would change the picture:

1. Whether the walls hold. The securities and account-transfer prohibitions are product decisions made before commercial pressure arrived. They are the first thing to check in six months.
2. Whether read-only becomes the pattern. Citi's compromise — agents may read through open banking, humans execute — is the most likely shape of the settlement between banks and agent vendors. If it sticks, every consumer agent ships with a read-only mode and a handoff.
3. Whether anyone audits the permission model. Everything in the section above is a vendor claim. No independent test of the classifier tiers has been published.
4. Whether the preview leaves the US. Availability is a waitlist for Pro and Max subscribers in one country, which is also the honest signal about how much of this is production-ready.

For builders, the copyable shape is narrow and clear: a per-user runtime the agent owns, a sibling process that decides whether an action proceeds (Muse calls its version Sentinel — see how Muse wires Sentinel), per-action approval for the four irreversible verbs, and a payment rail that hands over a limited instrument instead of a credential. The failure that sits one step earlier — the click that grants the agent everything — is the grant moment.

Related: What is an AI agent? · Are AI agents safe? · How AI agents escape sandboxes · Perplexity's portable computer · AI agent cost calculator

Next Steps

Read the vocabulary, then the safety checklist — Duet is the consumer version of both, with a bank's balance sheet attached.

how do AI agents work — return to the complete AI agent architecture guide.