Claude Duet preview: access, privacy and approval controls

Listen to this article

Updated October 28, 2026: Added the invitation sequence for US Max and Pro subscribers and the current position on international access.

Updated October 27, 2026: Added a practical privacy, approval and usage checklist based on Anthropic’s preview documentation.

Anthropic opened a Claude Duet research preview waitlist on October 21, 2026. Invitations will arrive by email when access is ready. Joining the queue does not grant immediate use.

The product FAQ limits eligibility to US Pro and Max subscribers. Team and Enterprise plans are excluded for now. Duet is offered through separate iOS and Android apps and the Claude website.

In an access update last edited October 28, Claude Duet team lead Karan Ahuja said US Max subscribers on the waitlist would receive invitations first, followed by US Pro subscribers. Max invitations were already going out, with more planned for that week. The team was working to extend access outside the US but had not announced a date. This is a rollout order, not confirmation that every eligible subscriber already has access.

Work through connected apps

Anthropic describes an Opus 5.5 agent operating on its own cloud computer. It carries over Claude memory, skills and connectors into one continuing text or voice thread. Morning briefings, invoice reminders and prepared payroll are among the stated workflows.

The product page advertises more than 6,000 connectors and plugins, but that count does not establish the reliability of individual workflows.

Background work uses the same allowance

Duet shares the subscriber’s existing Claude usage limits. Background checks count against that allowance, and larger tasks require more model turns. The FAQ warns that information arriving between checks can be missed.

The announcement says connected accounts are checked every few hours. Its virtual machine keeps working with the user’s devices switched off, although users cannot yet see its browser.

Approval boundaries and unfinished features

Anthropic says sending messages, making payments, signing documents and deleting material require approval. Securities trading and transfers between accounts remain prohibited even with approval. Users can disconnect any connected app.

Anthropic says a dedicated classifier is designed to block sharing card numbers and government identification. Sharing health or personal finance information requires explicit instructions.

A richer Shopify editor and access through saved 1Password logins are described as coming soon. Those features should not be treated as part of the current preview.

The product FAQ also warns that Duet can misunderstand conversations or judge urgency incorrectly. Its feature descriptions therefore leave reliability to be established in actual use.

Disconnecting is not forgetting

Anthropic’s October 23 safety and privacy explanation makes an important distinction. Disconnecting an app stops future access, but information already learned remains in memory until it is reset in app settings. Turning a connection off applies to both Claude and Duet. Duet can also use memories from earlier Claude conversations.

What credential isolation does and does not mean

Anthropic says passwords, cookies and sign-in tokens stay outside the model’s working environment. For connected services, placeholders stand in for credentials and an external proxy supplies the real token. The browser runs separately, but page text and downloads can still return to the agent. These are vendor-described protections, not an independent security guarantee.

The company acknowledges that preview safeguards can miss sensitive content or flag harmless material. An approval prompt is therefore a place to inspect a proposed action, not evidence that the action is correct.

A practical first-workflow checklist

Choose a narrow task. Rather than starting with an entire business workflow, define one output and what would count as a mistake. For an invoice reminder, compare the customer, amount and due date with the original invoice before approving a message. This is a suggested evaluation, not a task ByteForward has run.

Separate preparation from permission. A useful draft is not yet a safe send. Check the destination, recipients, attachment and wording against your intent. Reject or revise a proposal that adds an action you did not request. Keep consequential decisions with the person responsible for them.

Keep a usage record. Note the task, corrections and allowance consumed. Compare a quiet day with a day containing larger assignments before deciding how much recurring work to delegate. Do not interpret a completed task as proof that every unattended check succeeded.

Plan the exit before connecting. Write down which accounts the experiment needs and what information you do not want carried forward. Treat stopping access and clearing learned memory as separate decisions. Review the effect in the settings rather than assuming one switch does both.

ByteForward has not joined the waitlist or tested Duet. This guide separates documented behavior from suggested checks for readers who receive access.

Illustrative small business order packing. Photo by Kampus Production via Pexels, used under the Pexels License.