Editorial illustration of a phone showing an approval request card with an amber highlighted action, a laptop behind running a blank cloud browser, and translucent panels reading US waitlist only and Vendor claims.

Claude Duet is a US-only waitlisted preview, not a general rollout

November 1, 2026 Alex Mercer

Anthropic opened a research preview of Claude Duet on 21 October 2026, but this is not a general rollout. Access is limited to Claude accounts in the United States, requires one of the eligible paid plans and depends on an invitation from a waitlist that Anthropic says is opening in waves.

Plan wording is not consistent across sources. Engadget described availability for Pro and Max subscribers in the US, while Anthropic’s help article and launch announcement list Pro, Max and Ultra. Available documents do not explain when or why the plan wording changed. Eligibility may be evolving during the preview, so readers should check Anthropic’s current documentation rather than rely on a secondary guide.

A waitlist, not an open sign-up

Duet is available as a standalone app on iOS and Android and on claude.ai, according to Anthropic. The help article sets out three requirements: an eligible paid plan, a Claude account in the US and an invitation from the waitlist. Joining does not guarantee a date, the preview is US-only, and Anthropic says features can change during the preview. Team and Enterprise plans are not included yet; Anthropic says it plans to bring Duet to them later, without giving a date.

Engadget reported that the waitlist asks for a name, company, email address, phone type and a short description of the work the applicant intends to hand off. That last field points to the intended use. Anthropic built Duet around work and says it is less capable at personal errands such as booking tickets.

What the agent actually does

The difference from a chat window is not just packaging. A Claude chat waits for a prompt; Duet is designed to work on its own computer in the cloud, with a dedicated browser, and to keep going after the app closes. It runs on the user’s Claude account, so existing memory, skills and connectors are available from the first message.

Anthropic says Duet can use apps connected in Claude, produce a morning brief across email and calendar, send updates during the day and take on larger jobs that return files. Those tasks fit the work the product was designed around. The preview is not pitched as a general personal assistant.

The preview has firm limits. It runs on Claude Opus 5.5 and users cannot choose another model. They cannot watch or take over its browser. It checks connected accounts at set intervals, cannot see all projects or files on a computer, does not support Microsoft 365 and works with some connectors, including Slack, only in a limited way.

Those limits shape the experience more than the capability list suggests. A morning brief and a series of check-ins are not continuous monitoring, so work that depends on an immediate reaction may arrive late. The browser is how Duet reaches sites without connectors, yet the preview offers no live view of it. Oversight therefore rests on drafts, finished files and approval requests rather than observation of each step. That describes the design, not an independently observed pattern of user behaviour.

Approval gates and retained memory

Anthropic says Duet shows the user what it is about to do and waits before it sends a message, makes a payment, signs a document or deletes anything. Some actions are barred even with approval, including trading securities and moving money between accounts.

Users make each app connection themselves and can disconnect an app at any time. Disconnection stops future access, but Anthropic says memory of past information from earlier conversations is kept. The available documentation does not state how long that memory is retained or what deletion options exist. Disconnecting an app should therefore be treated as a forward-looking access control, not a full data reset.

Usage limits are part of the product

During the preview, Duet is included with Pro, Max and Ultra plans at no extra cost, according to Anthropic. It uses the plan’s usage limits at the same rate as Claude chats. Background work, including the morning brief and check-ins, also counts, so users may reach their limits sooner than they would with chat alone.

That makes the always-on design a capacity question as well as a capability question. The agent’s scheduled checks are useful only if enough allowance remains for the rest of a user’s Claude work. Anthropic’s statement is the only basis for that trade-off; no independent measurement of typical consumption was available.

Security claims and prompt injection

Duet reads content written by other people, including email and web pages, and that content can contain instructions intended to mislead it. Anthropic calls this prompt injection and says no defence is perfect. The approval gates are one reason it gives for requiring confirmation before consequential actions.

Anthropic also says a dedicated classifier and safety system prompt are designed to guard against leaks of sensitive information. It says the strictest tier, including credit card numbers and government identification, is rejected, while other sensitive information such as health or personal finances is allowed only when the user has explicitly instructed Duet to send it. The company says credential handling follows the design used for Claude Managed Agents, so Duet never directly sees passwords or sign-in tokens, and that it ran red-team and external penetration tests and covers the product under its public bug bounty programme.

Those are vendor statements. The available information contains no independent security measurements, specific vulnerability, breach or observed bypass. Approval prompts and classifiers are mitigations, not proof that a determined piece of text in an email cannot influence the agent’s behaviour. The absence of a reported incident is not evidence that the safeguards hold under adversarial content.

What to weigh before connecting work accounts

For eligible users, the practical test is narrower than the launch framing suggests. Start with the apps the job requires, and consider read-and-draft work before connecting payment, contract or messaging tools. Review the actions Duet asks to take. Remember that disconnecting an app limits future access but does not remove what the agent already remembers.

For Australian readers, the available material documents no local waitlist or launch date. For everyone, the central uncertainty is not whether Duet can draft a brief or prepare a file. It is whether the approval model and security claims hold up when the agent reads untrusted content and acts inside real work systems. The material available establishes what Anthropic says it has built, not how well it works under independent testing.

Granting an assistant permission to read your inbox and act on it raises a question that predates this preview: how much authority should travel with a single approval? An agent that drafts a reply is one thing; one that can send, pay or sign needs boundaries that are named, tested and reversible. Studying cybersecurity fundamentals gives that question structure, covering how access, identity and permission are defined as separate, checkable layers rather than a single switch, and why a remembered detail can outlast the connection that supplied it. The Hack Academy’s online cybersecurity training programme sets out those foundations, with self-paced learning and practical exercises alongside the theory, for readers who want to reason about agent permissions rather than simply trust the prompt.