Claude Duet Research Preview: How 6,000 Apps Could Automate Work Safely

Anthropic’s Claude Duet research preview turns Claude into a proactive work agent that can monitor connected services, prepare morning briefs and complete multi-step tasks in a cloud virtual machine. Opened on October 21, 2026, the preview is built around Claude Opus 5.5 and is designed to act across a user’s workday while keeping consequential decisions under human control.

Preview detail	What Anthropic says
Availability	US Claude Pro and Max subscribers through a waitlist
Platforms	iOS, Android and claude.ai
Connections	More than 6,000 connectors and plugins
Approval controls	Required before messages, payments, signatures or deletions
Extra cost	No additional charge, but shared Claude usage limits apply

What Claude Duet changes for everyday work

Traditional chat assistants wait for a prompt. Claude Duet is intended to notice relevant activity and coordinate actions across tools such as Gmail, Slack, QuickBooks, Stripe, Gusto, LinkedIn, DocuSign, HubSpot, Canva and Shopify. Anthropic describes use cases including summarising updates, identifying follow-ups and carrying work through several connected applications.

The central safeguard is approval at the point of consequence. Duet can prepare an outgoing message or payment workflow, but the user must approve actions such as sending messages, making payments, signing documents or deleting content. Anthropic also says Duet does not directly access passwords, cookies or sign-in tokens. A separate classifier checks outgoing messages, while highly sensitive information such as full card numbers and government IDs is blocked.

For businesses assessing agent workflows, the preview offers a useful test case for combining automation with review gates. Teams exploring broader AI development services can use the same principle: connect only necessary systems, define prohibited actions and require explicit approval where mistakes could create financial, legal or reputational risk.

Who can try the preview

Access is currently limited to US Pro and Max subscribers, while Team and Enterprise plans are excluded. Microsoft 365 is unavailable, and background checks consume usage limits.

What the preview cannot safely automate

Claude Duet’s safeguards do not make it autonomous in every situation. Anthropic says users cannot choose the underlying model, watch the browser in real time or take over an active browser session. Background checks also consume shared Claude usage limits, and checks happen at intervals rather than continuously. That means Duet may miss an event between checks, misunderstand a conversation thread or misjudge how urgent a task is.

The restrictions are especially important for financial and identity-sensitive workflows. Trading securities, moving money between accounts and accessing another person’s account remain prohibited. Some connected services also impose their own limitations, and Microsoft 365 is not available in the preview. Anthropic acknowledges that prompt-injection defenses are not perfect, so a malicious instruction inside an email, document or webpage could still create risk if the user approves an unsafe action.

How businesses should evaluate Claude Duet

The most practical starting point is a low-risk workflow with clear success criteria. A team might ask Duet to collect routine updates, prepare a draft brief or identify unanswered requests, while keeping sending, deletion and financial actions behind approval. Before connecting an app, administrators should review what data it contains, who can authorise actions and how long records should be retained.

It is also useful to separate observation from execution. Monitoring can remain broad enough to surface relevant work, while permissions for consequential actions stay narrow. Keep an audit trail of approvals, review missed or incorrect suggestions, and define a manual fallback for time-sensitive tasks. Organisations planning custom integrations can compare this approval-gated approach with broader project consultation services when mapping requirements, permissions and rollout stages.

For individual users, the preview is best treated as an assistant that prepares work rather than an employee trusted to finish it independently. Start with reversible tasks, inspect every proposed action and avoid connecting accounts that contain information Duet does not need.

How to set up Claude Duet responsibly

A careful rollout begins with scope, permissions and measurable boundaries. Instead of connecting every available service, users should choose one workflow where the information is relatively routine and the result can be reviewed quickly. Examples include preparing a daily summary, collecting open follow-ups or organising non-sensitive project updates.

1. Map the workflow. Identify which applications Duet needs, what information it should read and which actions it may propose.
2. Separate permissions. Reading a mailbox or project channel should not automatically imply permission to send, delete, sign or pay.
3. Define approval points. Require a human check for external communication, financial activity, identity-sensitive records and irreversible changes.
4. Review outcomes. Track missed events, incorrect summaries, unnecessary alerts and approvals that users regularly reject.

This governance model matters because a connected agent can combine errors from several systems. A mistaken interpretation in an email may become an incorrect task, an inaccurate draft or an unnecessary escalation. Periodic checks also mean that Duet is not a real-time monitoring system, even when a connected service changes between checks.

What developers should test before wider adoption

Technical teams should evaluate connector behaviour with realistic but controlled data. Test ambiguous instructions, duplicate records, conflicting calendar or task updates and messages containing suspicious embedded directions. The goal is not only to see whether the agent completes a happy-path task, but also whether it pauses, requests clarification or refuses an unsafe action.

Teams building related workflows can use application development services to plan authentication boundaries, logging, fallback paths and human-review interfaces around an agent. Those controls should be designed before users connect production accounts, particularly where several employees share access to the same systems.

Claude Duet’s research preview therefore represents a practical experiment in supervised automation. Its value will depend less on the number of integrations than on whether organisations can make permissions understandable, approvals routine and mistakes recoverable.

What developers should test before wider adoption

Technical teams should evaluate connector behaviour with realistic but controlled data. Test ambiguous instructions, duplicate records, conflicting calendar or task updates and messages containing suspicious embedded directions. The goal is not only to measure whether Duet completes a routine task, but also whether it pauses, requests clarification or refuses an unsafe action.

Each test should define an expected result and an acceptable failure mode. For example, a duplicate invoice should trigger a warning rather than a second payment proposal, while an unclear email should produce a question instead of an invented interpretation. Teams should also test revoked permissions, expired sessions, unavailable connectors and changes made by another user during a workflow.

Organisations building related workflows can use application development services to plan authentication boundaries, logging, fallback paths and human-review interfaces around an agent. Those controls should be designed before users connect production accounts, particularly where several employees share access to the same systems.

Why approval design will shape the preview’s value

Claude Duet’s usefulness will depend on how easily people can understand and review its proposed actions. An approval prompt should make clear which application is involved, what data will be sent, who will receive it and whether the result can be reversed. Vague prompts can turn a formal safeguard into a routine click-through.

Businesses should therefore monitor more than completed tasks. Useful review measures include rejected approvals, missed events, false urgency alerts, repeated clarification requests and actions that require manual correction. These observations can reveal whether automation is reducing work or simply moving effort into supervision.

The preview is also a reminder that connector breadth is not the same as operational readiness. Every integration adds another permission boundary, data source and failure mode. A staged rollout—starting with observation, then drafts, then narrowly approved actions—gives teams a clearer basis for deciding where Duet belongs in everyday work.

How to make Claude Duet safer in practice

The strongest safeguard for Claude Duet is a clear division between observation, recommendation and execution. During an initial trial, users can allow the agent to gather information and prepare drafts without granting permission to complete consequential actions. This creates a practical baseline for judging whether its summaries are accurate and whether its timing matches the way a team actually works.

Approval requests should also be treated as decision points, not formalities. Before accepting one, reviewers should confirm the destination, the information being shared, the requested change and the likely consequences. A message that appears routine may still expose confidential material, contact the wrong person or create an obligation that is difficult to reverse.

Build recovery into every connected workflow

Because Anthropic says Duet can miss events between checks and misinterpret context, important workflows need a fallback path. That may include a manual queue, duplicate notifications, activity logs or a second-person review for sensitive tasks. Teams should document how to revoke access, correct an incorrect update and investigate an action that was approved too quickly.

Businesses planning broader automation can use project consultation services to map these boundaries before connecting production systems. The useful question is not simply whether Claude Duet can perform a task, but whether the organisation can detect and recover from failure without disrupting customers, employees or financial records.

What the Claude Duet preview will reveal

The research preview will be most informative when users report the conditions behind both successful and unsuccessful runs. A task may work well with a short, structured request yet fail when several applications contain conflicting information. Results can also vary when permissions change, a connector is unavailable or a conversation includes malicious instructions.

For now, Claude Duet is best understood as supervised experimentation with broad connectivity, rather than a replacement for operational controls. Its practical promise lies in reducing repetitive coordination; its central test is whether people can keep authority, visibility and recovery mechanisms in the loop as automation expands.

What the Claude Duet preview will reveal

The research preview will be most informative when users report the conditions behind both successful and unsuccessful runs. A task may work well with a short, structured request yet fail when several applications contain conflicting information. Results can also vary when permissions change, a connector is unavailable or a conversation includes malicious instructions.

That makes careful observation essential. Users should record what Duet was asked to do, which applications it accessed, when it checked for updates and whether a person had to correct its interpretation. These notes can distinguish a genuinely useful workflow from one that merely shifts effort into constant supervision.

What businesses should take from Claude Duet

For now, Claude Duet is best understood as supervised experimentation with broad connectivity, rather than a replacement for operational controls. Its practical promise lies in reducing repetitive coordination, while its central test is whether people can keep authority, visibility and recovery mechanisms in the loop as automation expands.

The preview’s early limits are therefore as important as its feature list. Approval prompts, usage caps, connector restrictions and the inability to watch or take over the browser all shape how much responsibility users can reasonably assign.