Claude Duet In-Depth: A Proactive AI Employee With Four Locks Before It Touches Your Money

From Reminders to Getting Things Done: What an AI Employee Actually Manages for You

Google built Google Now over a decade ago, with the tagline "the right information at just the right time." Duet's difference is that Google Now only reminds you, while Duet takes tasks all the way to the last step.

The official demo is set in a fictional coffee chain called Marlow. Founder Maya wakes up to a briefing with several items lined up: a job candidate has another offer and needs an answer by 6 PM tonight, a major client wants payment terms changed to 60 days, a new Chicago store's health permit awaits her approval for $640, the fundraising deck has been reworked with the latest data, and a weekend delivery error's refund has been drafted. Every item stops at "waiting for her sign-off." An opening checklist lists dozens of items, most already done or in progress, and the only thing that truly needs her today is one thing—paying the permit fee. A card pops up on screen: Approve or Later.

Real user cases illustrate what "proactive" really means. Brand strategist Maya Dalton had a prospect call on her calendar; Duet prepared background materials in advance, noticed the call was right next to her flight, and proactively offered to reschedule. Amyn Ebrahimi, owner of South Florida barbecue chain Shasaf Kabob with about 110 employees, has Duet handle bookkeeping, customer service, and marketing—invoices come in store by store for verification. His assessment: "Everything comes together in one place, no more opening 100 tabs."

How Does It Know What Matters

Duet doesn't watch your accounts constantly. The official explanation is practical: constant checking would burn through your plan quota too fast, so it patrols every few hours—more like a security guard on rounds than a bodyguard standing at your side.

Patrols run in a dedicated cloud virtual machine with its own browser. Your computer can be off, your phone locked, and it still works. Apps with direct integrations go through connectors—the Claude app marketplace has over 6,000 connectors and plugins combined. For sites without connectors, it opens its own browser and clicks through like a human.

Once connected, its work centers on tasks that are "not hard but incredibly tedious": finding missed messages in Gmail and Slack and drafting replies, checking uncollected money in QuickBooks or Stripe and drafting payment-chase emails, filling in payroll hours, bonuses, and reimbursements in Gusto, and preparing contracts for signature through DocuSign. Anthropic insiders use it most heavily: Boris Cherney, who leads the Claude Code team, dictates to-dos while on walks; Chelsea Larsen, who leads model and product behavior design, hands off her to-dos before spending time with her kids after work and gets an evening report later; Mike Krieger, Instagram co-founder now at Anthropic, says he's used it for weeks both at work and at home.

All of this is powered by Claude Opus 5.5. Anthropic's claim is that Duet's strength lies in judgment—deciding what needs you, what can wait, and when to ask first. The model is economical to run and fast at producing work, exactly the kind of smart-yet-thrifty brain a machine patrolling in the background every day needs.

Connectors and plugins are two types of extension mechanisms that let agents access external tools. Connectors are typically standardized OAuth authorization interfaces provided by platforms or third parties, allowing AI to read and operate apps like Gmail, Slack, and QuickBooks as the user—without simulating web clicks. Plugins are lighter, often providing only specific function calls (such as checking exchange rates or generating charts). The difference lies in permission depth and maintenance cost: connectors are more stable but require app-side cooperation, while plugins are flexible but limited in coverage. The 6,000+ connectors and plugins in the Claude app marketplace mean Duet can cover a large number of mainstream SaaS tools, but for legacy systems without open APIs, it still falls back to browser simulation—which explains why it needs a dedicated virtual machine with a browser.

Before Touching Money: How the Four Locks Work

Imagine you've just hired a financial assistant. Would you hand over your online banking password on day one? Duet's rules are built on basically the same logic.

Lock One: Four types of actions require pre-approval. Sending messages, making payments, signing documents, and deleting anything must be presented to you before action—it only proceeds after you click approve.

Lock Two: Payments don't use your real card. When buying something, it first confirms which product. Online payments go through the Stripe digital wallet, and after approval, payment is made with a single-use virtual card valid only for that order—your real card number is never handed over. At online store checkouts, it can also use Shopify's Shop Pay. It's like giving a new assistant a company card with a single-use limit, where every swipe needs your nod on your phone.

Lock Three: Passwords never enter the conversation. When logging into websites, passwords are entered in a separate form on your phone and never enter your conversation with Duet. It also adds dedicated classifiers: the most sensitive items like credit card numbers and ID documents are never sent out, and health and personal financial information is only sent when you explicitly instruct it. When it reports a number, it notes which email, file, or table it came from.

Lock Four: External security teams review. Both red teams and external security firms have conducted penetration testing, and a public bug bounty program has been added.

The four locks together amount to the onboarding rules for a new employee: no passwords, spending requires approval, and expense reports require receipts.

More interestingly, some things it won't do even if you click approve: trading stocks, transferring money between accounts, or entering someone else's account. It helps you spend money, but it won't touch how funds are moved or invested. Only you can mark a task complete—it can only suggest. If you're not around to approve something, it doesn't wait idly; it finishes other parts first, then brings the pending item back to you.

Single-use virtual cards are the core technology for payment isolation. Payment providers like Stripe dynamically generate a card number, expiration date, and security code at authorization time, linked to but independent of the user's real bank card, usually with a per-transaction limit and short validity period, expiring after the transaction completes. Even if the card number leaks during transmission or storage, it cannot be reused. Duet applies this mechanism to AI shopping: only after user approval does the system generate a virtual card for that order, and the AI always receives a "single-use credential" rather than a real card number. This mirrors the logic of single-purchase corporate cards issued to employees—completing payment while cutting off long-term risk—and is a relatively sound engineering approach for proactive agents handling financial matters.

Three Players on the Same Stage: The Diverging Paths of Proactive AI

Duet's launch timing was coincidental—it collided with Meta's Q3 earnings. Zuckerberg announced at the earnings call that Meta's Muse had been set up by over 10 million people in the US and Canada, with about a quarter of those using it on any given day, and shopping being the biggest use case. A month and a half earlier, first came Meta's Muse, then OpenAI's Dots, and finally Duet. 9to5Mac's headline read directly: "Anthropic takes on ChatGPT's Dots and Meta's Muse."

OpenAI's Dots takes a different approach: each Dots has its own cloud computer. You can message it in ChatGPT, Slack, or Teams, and when nobody's looking for it, it does proactive research in the background with read-only permissions. One early tester's Dots discovered he'd forgotten to invoice a publisher, prepared the invoice, and sent it after his approval. The three look different but share the same skeleton: do it for you first, then wait for your nod.

Proactive agents differ from traditional reactive assistants in their trigger mechanism: the latter wait for user input, while the former periodically sense the environment in the background according to preset policies, identify to-dos, and proactively push them forward. This brings two engineering challenges—balancing patrol frequency against cost (checking too often quickly consumes model call quota) and the decision model for "when to bother the user." Duet chooses to patrol every few hours and only push items requiring sign-off; OpenAI's Dots does proactive research with read-only permissions when nobody's looking for it. The industry generally agrees that the product challenge for proactive agents has shifted from "can it do it" to "should it come to you now," requiring a blend of user habit learning and task urgency judgment—and this is currently the main differentiator among players.

Hands-On Experience and Availability in China

Claire of You, host of How I AI, a podcast under US tech newsletter Lenny's Newsletter, offered a thought-provoking assessment: Duet is the most polished agent launch she's seen—thoughtful onboarding, complete finished files, and a Slack-like channel-based interface. She tested the inbox, Slack sales pipeline, and presentation decks, and even had her kid use it to find Warriors tickets.

But her headline was also candid—"Claude Duet is beautiful, but I still forgot to use it." The reason: a proactive agent that never nudges you is hard to turn into a habit. Anthropic's official position is that messaging timing is still being tested and will be adjusted based on tester feedback; you can also directly tell it what you want to hear about and how often to check in.

Duet isn't available in China yet—the research preview is US-only. But the wave hasn't passed: according to 36Kr, the global AI world was flooded with "personal agents" in September this year. Alibaba's DingTalk announced at the Yunqi Conference that it's accelerating the build of DingTalk Personal Agent, with its product lead saying it will leverage model agent capabilities to provide continuous personalized services to 300 million users. Huawei's newly released Mate 90 series upgraded Xiaoyi into a personal dedicated agent supporting call answering, real-time transcription, and automatic summary generation. Feishu Daily automatically monitors group chats, document updates, and task changes, generating reply drafts that are only sent after your confirmation—the same logic as Duet. Bosses using Feishu for work can already use half of it today.

A Checklist for Judging Whether an AI Assistant Is Reliable

This design can actually serve as a general checklist for evaluating any AI assistant: whether sensitive operations require pre-approval, whether payments isolate real credentials, whether passwords stay out of conversation context, whether there's third-party security auditing, and whether there are clearly drawn red lines for "won't do even if approved."

For ordinary people, the tasks most worth handing off are checking accounts, monitoring groups, drafting, and preparing materials; the thing most worth keeping in your own hands is the final step—paying, sending, signing, and deleting. Press that approve button yourself.

One-line Summary

Claude Duet turns AI from a passive responder into a proactively patrolling personal employee—but approval power stays with humans.

Paragraph Summary

Anthropic launched Claude Duet, flipping AI interaction from "answer only when asked" to proactively patrolling email, calendars, and ledgers, presenting only items requiring user sign-off. It runs in a cloud VM with browser simulation, patrolling every few hours, connecting to Gmail, Slack, QuickBooks, and other tools through 6,000+ connectors and plugins to handle tedious work like account checking, drafting, and material preparation. Security features four locks: sending messages, payments, signing documents, and deletion require pre-approval; payments use single-use virtual cards to isolate real card numbers; passwords stay out of conversations; and external security teams conduct penetration testing. Stock trading, transfers, and entering others' accounts are red lines—refused even with approval. The article also compares the shared skeleton of Meta Muse and OpenAI Dots, and notes that DingTalk, Huawei Xiaoyi, and Feishu Daily offer partial alternatives in China.