Why Anthropic Built Claude Duet to Say No Before It Says Yes

The most revealing part of Anthropic's new agent is the list of things it refuses to do. Claude Duet, announced Wednesday as a research preview, will read your inbox, watch your accounting software and run payroll prep in Gusto. But it will not trade securities or move money between your accounts, even if you tell it to. A new classifier is built to stop it from sharing your credit card number.

That is a deliberate pitch. Anthropic is the third major lab in roughly six weeks to ship an always-on personal agent, following Meta's Muse in September and OpenAI's Dots, and it is trying to win on trust rather than flash.

What Duet actually does

According to Anthropic's announcement, Duet is a standalone app for iOS and Android, also reachable on claude.ai, built around Claude Opus 5.5. Each morning it sends a short brief on what matters across your connected apps. During the day it checks those accounts and pings you only when something needs attention. It inherits your Claude memory and connectors and runs on its own virtual machine with a browser, so it keeps working after you close your laptop.

Anthropic is aiming squarely at "professionals and small business owners with more on their plates than they can track." The company says Duet can tap more than 6,000 connectors and plugins in its marketplace, from chasing unpaid invoices in QuickBooks or Stripe to sending agreements through Docusign.

Access is narrow for now. The preview is waitlist only, limited to US subscribers on Pro and Max plans, and it draws from the same usage limits as the rest of Claude.

The guardrails are the product

Anthropic spends an unusual share of its announcement on safety plumbing. Before Duet sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it is about to do and waits for approval. Credentials are handled so that the agent "never directly sees your passwords or sign-in tokens," the company says. Purchases run through Stripe's Link wallet, which pays with a virtual card so your real number is never shared.

The sensitive data classifier is the most interesting piece. Anthropic says it checks each message and is "designed to reject requests to share the strictest tier of information, including credit card numbers and government identification." Health and personal finance details pass through only when you explicitly instruct Duet to send them. Anthropic says red teams and an outside firm penetration tested the product.

Those are claims about design, not proof of behavior in the wild. The contrast with Meta is still hard to miss. Muse launched with its own isolated cloud machine and an action reviewer, yet Meta recently paused Muse's conversation sharing after researchers said they found more than 6,800 share links through public DNS records. Agents with access to your email tend to fail in boring, structural ways.

The honest caveats

Anthropic is also unusually upfront about what Duet gets wrong.

"This is an early version of Claude Duet, and it still might misread a thread or miscalibrate what's urgent." Anthropic, in its launch post

That matters for a product whose core promise is judgment about when to interrupt you. Anthropic says Duet checks connected accounts "every few hours" rather than continuously, because constant monitoring would burn through plan limits faster. So it is a periodic sweep, not a live watchdog. The company also admits personal errands like booking tickets "aren't quite as strong," and that Duet cannot yet show you its browser.

The early testimonials come from Anthropic's own selection of users. Amin Ebrahimi, who runs the South Florida restaurant chain Shahs of Kabob with about 110 employees, said he has used it for accounting, customer support and marketing.

"It brings it all together. I don't need to open up 100 tabs." Amin Ebrahimi, owner, Shahs of Kabob

Whether that holds up for thousands of small businesses is exactly what a research preview is supposed to find out. For now, Anthropic is betting that in a crowded field of agents that can do almost anything, the one that clearly says no to certain tasks might be the one owners let near their books.