Claude Duet: How Anthropic’s Always-On AI Agent Works
Learn how Claude Duet monitors connected apps, handles background tasks, and asks before taking action—plus its limits, safety controls, and access model.
Claude Duet: What an Always-On AI Agent Can - and Can't - Do
Most AI assistants wait for you to ask. An always-on agent flips that: it can check connected apps in the background, catch things that might need attention, and surface them to you. That sounds handy - especially when you're juggling email, calendars, and projects. It also creates new questions fast: what exactly can it see, how much will it do on its own, and what happens when it guesses wrong about priorities?
Claude Duet is Anthropic's version of this idea. In the early-access account described in the source material, it could put together a morning brief, check connected services on a schedule, and run tasks on a remote virtual machine. It also required approval for high-impact actions like sending messages or deleting items. Those guardrails help - but they don't remove the need to stay in the loop.
This article looks at how Duet is set up, what early testing suggests, where the limits show up in business use, and how to separate judgment-heavy AI work from repeatable automation. Availability and plan details reflect the reported research-preview period and could change.
What is Claude Duet?
Claude Duet is an Anthropic AI agent built to work proactively across connected apps. A traditional chatbot answers when you prompt it. Duet can also check selected services on a schedule, flag items it thinks matter, and start work in the background. You can talk to it in a continuing conversation, using text or voice.
The key difference is how it operates. A chatbot is mostly a tool you use while you're paying attention. An agent can access information you've authorized, decide whether something warrants your time, and either prepare work or carry it out based on the permissions you've granted. That can cut down on routine checking - but it also means the system has more chances to misunderstand context.
Duet is described as a separate app that uses a Claude account. Its interface is split into three areas:
- Chat: where you ask questions, give instructions, and review connected-app information.
- Tasks: where you see background work, including tasks that may require input or approval.
- Make: where you create projects using templates like a daily task list or email triage.
The source account says Duet uses Claude's latest models and carries over relevant context from your Claude account, including tools, projects, chats, memory, and skills. That can make setup faster, but it also means you should understand what's already configured before you connect another agent to business accounts.
In the reported early-access test, Duet connected Gmail, Calendar, and Google Drive. By the next morning, it had reviewed security alerts from those connections and summarized them, including what to do if account changes weren't recognized. The value wasn't that it completed a huge, complex project - it spotted something small and relevant without being asked.
That's the promise of proactive agents: less time spent noticing and routing, more time spent acting. Whether it works out in practice depends on the quality of its signals, what background activity costs you, and how bad a missed (or misclassified) item would be.
How does Claude Duet work?
Duet runs on its own virtual machine with a browser, according to the source material. Your phone or laptop doesn't have to stay open while it runs. In other words, it's not limited to the moment you're chatting with it - it can keep doing scheduled checks and carry tasks forward in the background.
The reported setup has three main pieces: access to connected apps, recurring monitoring, and task execution. During setup, users can connect services like Gmail, Slack, Calendar, and Google Drive. Duet can use those sources to answer questions or to look for items that match instructions and project context.
Scheduled checks and notifications
Duet can send a morning summary and check accounts every few hours, then notify you when it thinks something needs attention. You can set what it should look for and how often it should check. It's not meant to be a nonstop stream or a simple daily dump - the idea is to filter and surface selected events.
That filtering is also where the risk lives. If Duet treats something as low priority, you might not hear about it quickly. If it overestimates urgency, you'll get more interruptions than you want. The right approach is to agree on the kinds of events it should flag, then verify what it actually does before relying on it for time-sensitive work.
Connectors and browser actions
Duet can use connectors supported by Claude. The source mentions thousands of possible app connections, but also notes that many aren't verified by Anthropic. If a connector isn't available, Duet can use its own browser to visit sites and fill out forms. Browser access expands what the agent can attempt, but it doesn't mean every website interaction will be reliable - or appropriate to automate.
The source account also describes connecting Zapier to reach additional apps and create repeatable workflows. That can help when a task touches multiple systems, but it adds another service and more permissions to the chain. Connect only what a specific job needs. Broad access can be convenient, but it isn't automatically safer or more effective.
Where work happens
Duet can keep running even when you're not looking at it. Depending on what you ask for, it may read and summarize information, draft a response, or prepare a change. For consequential actions - like sending a message, making a payment, signing a document, or deleting information - the reported behavior is to show the proposed action and wait for approval.
A helpful way to think about the workflow is: observe, interpret, prepare, ask, act. The first steps can save time, but you still need to check the interpretation. Approval is a control point, not proof that everything is correct.
What are Claude Duet's strengths and limits?
The most encouraging early signal is that proactive monitoring can be useful without a complicated setup. In the reported test, existing Claude connections carried over, first-party app connections were described as quick to enable, and the agent surfaced a relevant security summary overnight. That's a small win, but it's exactly the kind of win a background assistant is supposed to deliver: catching something you would otherwise forget to check.
The Tasks area also offered suggested work instead of forcing users to build every automation from scratch. That helps early adoption. A blank automation canvas can be intimidating for teams, and a suggested scan of connected tools gives people a starting point. Still, a suggestion is not the same as an always-correct task. Treat it as a proposal, not something the system should "own" forever.
The main operational trade-off: background activity costs usage
In the early test, Duet used the same Claude plan limits as normal Claude activity. Background checks and larger tasks consumed usage, and the tester reported hitting session limits quickly during the first days. That matters, because "always-on" in practice still has an allowance.
The cost isn't only financial. If background activity draws down the same quota you use for analysis, writing, or coding, Duet can end up competing with the work you actually started directly. Before you turn on frequent checks, estimate whether the payoff is worth it and watch usage closely. If a task is truly routine, running an AI agent through the whole process every time may be overkill.
Where early use can fall short
The source account notes that the native Gmail connector only saw one account. That's a problem if you keep separate personal, work, and shared inboxes. A workaround through another connector might exist, but it would add setup and should be tested with the right account permissions.
More generally, an agent can get urgency wrong, miss nuance, or act on incomplete context. A "routine" message could still imply something important for a customer or colleague. Even with frequent checking, it can still miss the one thing that matters. Testing over just a few days isn't enough evidence to treat it as dependable monitoring.
A practical rollout should stay narrow at first: start with low-risk summaries or drafts, compare what it surfaces to what you would have noticed yourself, and expand only once you're confident in the signal quality. Keep human ownership of decisions where a missed alert, incorrect response, or accidental change would have real consequences.
Is Claude Duet safe, and what does it cost?
Safety breaks into two parts: what information the agent can access, and what it can do with that information. Connecting an inbox may allow reading sensitive customer or employee data even if it can't send messages. Approval gates reduce risk for certain actions, but they don't make broad data access harmless.
The source material says Duet uses OAuth, meaning it doesn't receive your account password or sign-in token. You can disconnect an app. The source also says Anthropic screens for prompt injection, uses a classifier intended to catch sensitive information before it leaks, and has tested the system using internal red teams and an outside firm. These are meaningful safeguards, but they don't guarantee the agent will interpret every page and instruction correctly.
What approval does - and does not - protect
Duet's controls let it read, draft, and prepare work without asking each time. Before it sends a message, makes a payment, signs a document, or deletes something, it's meant to show the proposed action and wait for approval. Some actions - like securities trading and moving money between accounts - were described as prohibited even with approval.
That boundary is useful because it keeps a person involved for high-impact actions. But approval quality still matters. If you approve a vague summary without checking the recipient, amount, or actual content, you're not really validating much - you're just signing off on the description. For sensitive work, inspect the real change, not the agent's explanation of it.
For business use, apply least privilege: connect only the accounts needed for the job, avoid using a personal account as a bridge to company data, and start with read-only or draft-oriented work when possible. Also define who can approve actions and make sure your team knows how to revoke access. These are operational controls - they're not a substitute for your organization's privacy, security, and compliance review.
Pricing and access in the reported preview
In the source material, Duet is described as included with Claude Pro, Max, and Ultra during its research preview, with no separate Duet price. It shared usage limits with the rest of Claude, and background checks counted toward those limits. The early-access tester also found that usage could run out quickly.
Access at that time was described as waitlist-based for U.S. subscribers on those plans, with an iOS and Android app and access through claude.ai. Because availability and the product may change, these details should be treated as a snapshot of the research preview, not a current eligibility guarantee. Check the latest Claude app and plan information before making decisions based on access or cost.
How should you use Claude Duet with automation?
Use an agent when the task depends on context, judgment, or exceptions. Use conventional automation when the same trigger and steps should produce the same result every time. This isn't about "modern vs. old-fashioned." It's about matching the tool to the work.
For example, an agent can review a set of emails and flag which ones look like they need a human response. A repeatable workflow might take a new invoice email, extract vendor, amount, and due date, add it to a spreadsheet, and notify a finance channel. The second option has a stable trigger and defined outputs. It doesn't need a general-purpose agent rethinking the whole process every run.
The source describes connecting Zapier to Duet so a user can ask it to build a workflow. In the example, recurring invoice emails could trigger extraction of key fields, a Google Sheets update, and a Slack notification. That kind of workflow can run without you keeping an open Duet conversation. The source also describes using standard automation steps for predictable actions, while using AI only where interpretation is needed - like reading an unclear invoice.
A decision rule for task selection
Before you ask Duet to take on a process, answer four questions:
- Does the task repeat? If it follows a consistent pattern, automation may be cheaper than repeated agent reasoning.
- Does it require judgment? If there are exceptions or ambiguous inputs, an agent can help interpret them - then you review when it matters.
- What's the cost of an error? Keep a person in the approval path when mistakes could affect money, customer relationships, legal commitments, or important records.
- How will you verify the result? Make the output visible and test it on real examples, including edge cases, before relying on it.
A simple way to split the work: have Duet notice, summarize, and propose - while a deterministic workflow handles stable repeated steps. Put AI where it's adding judgment, not where it's just re-running the same checklist. That can reduce unnecessary usage and make failures easier to debug.
The reported Zapier setup also provides a way to review workflow runs and manage or turn off workflows. But automation still needs ownership: decide who checks failed runs, who can change a workflow, and how changes get tested. If an AI-assisted workflow can modify itself, review those proposed changes as carefully as you would any production configuration update. Convenience isn't a replacement for change control.
Conclusion
Claude Duet is a shift from asking an AI assistant for help to having it monitor selected work and bring possible next steps to you. That can save attention - but it also brings ongoing access, usage costs, and the risk of misjudged priorities. The safest starting point is a narrow, low-risk task with output you can verify.
Use the agent for noticing and interpretation when those capabilities actually help. Use repeatable automation for work that should run the same way every time, and keep human approval for consequential actions. That division is usually more reliable than treating an always-on agent as a substitute for process design.