Claude Duet Asks Before It Sends

What it does while you are gone

Each morning it can send a short brief across connected tools. Through the day it checks those accounts every few hours (constant polling would burn plan limits) and messages only when it thinks something needs you. Hand it a task and it picks connectors from Claude''s marketplace: unpaid invoices in QuickBooks or Stripe, payroll prep in Gusto, a LinkedIn job post after you edit it, HubSpot follow-ups, Canva campaigns, Shopify store work. Small-business testers quoted in Anthropic''s launch note used it for calendar mistakes, multi-store invoices, and call briefs timed against flights.

That is the seduction. An agent that notices the showing on the wrong day, without being asked, feels like a junior partner. An agent that notices wrong and acts is a different animal.

The approval wall

Anthropic''s safety write-up is unusually concrete. Duet may read, draft, and prepare on its own. Before it sends a message, makes a payment, signs a document, or deletes anything, it shows the action, destination, content, and recipients, then waits. A separate auto-mode classifier, running outside the model doing the work, checks whether the step matches your intent so a hidden instruction on a webpage cannot answer the approval card. Some moves stay forbidden even with a tap: trading securities, moving money between accounts, accessing someone else''s account. Payments and account creation never get a "don''t ask again" shortcut. Purchases go through Link with a one-time merchant card so Duet never holds your real number.

The company names the failure mode out loud: approval fatigue. Too many cards train people to tap through. That sentence is the product''s real philosophy problem. Consent theater collapses the moment the taps feel cheaper than reading.

Credentials stay out of the model''s sight via the same pattern Anthropic uses for managed agents. A dedicated classifier is supposed to block leaks of card numbers and government IDs, and to gate health or finance details unless you explicitly told it to send them. Red teams and an outside firm penetration-tested the stack; it sits under Anthropic''s bug bounty. None of that proves Duet will not misread urgency or ship a polite wrong email. Anthropic admits the preview "might misread a thread or miscalibrate what''s urgent," and personal errands are weaker than work flows.

Who controls the company after the IPO is a separate fight about board math. Duet is the fight about everyday agency: how much initiative people will delegate when the stop button is a notification on a bright screen. The lab is selling trust as a UX pattern. If the pattern holds, always-on agents become ordinary. If users learn to approve on reflex, the wall was only paint.