News · 2026-10-22

Claude Duet begins background work with approval gates and shared limits

Anthropic launched Claude Duet on October 21 as a proactive assistant that reviews connected information and continues delegated work in its own cloud computer. The research preview is waitlisted for US-based Pro and Max subscribers and shares their existing Claude usage limits. It can prepare work in the background, while consequential actions are designed to pause for approval.

Key facts

• Duet launched October 21, 2026 on mobile and claude.ai as a research preview.
• It uses Claude Opus 5.5, with no user-selectable alternative model.
• Background checks and jobs consume the same five-hour and weekly limits as the subscriber’s Claude plan.
• The primary source is Anthropic’s launch announcement.

The product changes who initiates the next step. A conventional chat assistant waits for a request. Duet can inspect authorized email and calendar information, decide what deserves attention and start preparing a response or work product. Its cloud computer keeps going after the user closes the app. The pitch is less time spent noticing and coordinating tasks, rather than simply faster answers once a task has been specified.

Anthropic’s product page and support guide describe connections to business services, inherited memory and skills, and a browser for sites without a connector. Larger handoffs can produce documents, spreadsheets, presentations or dashboards. Access is not an unrestricted view of everything on a user’s computer: the guide says Duet cannot see local files or all Claude projects.

A useful analogy is an assistant sorting a desk overnight. The assistant can put urgent correspondence on top, draft responses and assemble a packet for review. That saves attention before the owner returns. But the owner must understand what the assistant was allowed to read, which judgments it made and where it stopped. The intelligence of the draft is only one part of that working relationship.

Anthropic says Duet pauses before sending a message, making a payment, signing a document or deleting anything. It can continue other preparation while an approval is pending. Some actions remain prohibited even with approval, including securities trading, moving money between accounts and accessing another person’s account. The announcement therefore describes a bounded delegation product, not permission to perform any requested real-world action.

Purchases provide a concrete example. The Link payment guide describes separate approval of a maximum amount and a one-time card scoped to a merchant and amount. Anthropic says Claude does not receive the full underlying card or bank-account number. This is a described control design, not an independent security assessment of every shopping path.

The visible control gap is the browser. Users can receive updates and approve a proposed action, but cannot currently watch or take over the cloud browser as it works. Approval at the end does not reveal every intermediate interpretation of a message or page. Anthropic says its defenses treat external content as information rather than instructions, while acknowledging that prompt-injection defenses are imperfect. The prompt-injection lesson explains why reading a page can itself introduce an adversarial instruction.

Memory adds another boundary. With “Search and reference chats” enabled, the support documentation allows searching eligible prior chats. Disconnecting a service stops future access, but information already remembered can remain. A user deciding to connect an inbox therefore needs to consider both continuing retrieval and the derived context left afterward. Deleting a chat from searchable history is a different action from disconnecting an external service.

The general consumer privacy policy covers connected-service and agentic-session input. Anthropic’s retention guidance says deleted conversations leave history immediately and are removed from backend storage within 30 days. With model improvement enabled, qualifying new or resumed chats may be retained in de-identified form for up to five years. The reviewed public material does not supply a separate end-to-end retention schedule for Duet’s background checks, cloud-computer state, connector payloads and derived memory. Those general policies should not be presented as a complete product-specific data-flow specification.

Reception focuses on the exchange between convenience and continuing access. The launch discussion included interest in catching inbox and scheduling problems, alongside concerns about quota consumption, broad account access and value beyond ordinary Claude. Directly reviewed Reddit threads were polarized, with mixed early anecdotes rather than comparative evidence. No independent named expert assessment was established in the research record.

The preview also shares existing usage limits rather than adding unlimited background capacity. A check that produces no visible artifact can still consume quota. This makes notification quality, judgment and resource accounting central product questions. Duet’s promise is work prepared before the next prompt; its practical test is whether users can trust those preparations, understand the approval boundary and get enough benefit within their plan. Scoped credentials explain why limiting access remains useful even when final actions require consent.

Primary source, verified: read the paper →

Ground Truth. (2026, October 22). Claude Duet begins background work with approval gates and shared limits. Ground Truth. https://groundtruth.day/news/claude-duet-proactive-assistant-preview.html

@misc{groundtruth:claude-duet-proactive-assistant-preview,
  title  = {Claude Duet begins background work with approval gates and shared limits},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/claude-duet-proactive-assistant-preview.html}
}

Topics: anthropic · claude · personal-agents · product-launch · privacy