Claude Duet Explained: Specs, Benchmarks, Safety Evals, and How It Compares to Dot and Muse

Claude Duet gives Anthropic’s assistant its own cloud computer, a morning brief, and a standing invitation to notice work that needs doing. Its appeal is clear. Its performance needs a more careful reading than the launch demos alone can provide.

Anthropic introduced Claude Duet on October 21, 2026, as a proactive agent for professionals and small business owners. You can hand it work through messages, leave, and return to a result or a decision that needs your approval. It also checks connected accounts and raises matters you have not explicitly asked it to investigate. The official launch post and announcement describe a research preview, starting with waitlisted Pro and Max subscribers in the United States.

Duet enters a market already occupied by OpenAI’s dots, Meta’s Muse, Grok Bot, and Google’s Gemini agent for work. All promise to carry work across apps and across time. The useful differences concern access, oversight, memory, billing, and how convincingly the finished work can be checked.

Our assessment is that Duet looks particularly relevant to people who already keep their business context in Claude. Carrying that context into ongoing administrative work could save substantial setup. Buyers should still treat it as an early product: there is no published Duet task-completion leaderboard in the launch material, background activity consumes Claude usage, and users cannot yet inspect its browser.

Evidence checked October 21, 2026. This is a researched launch analysis. Kingy.ai has not received Duet preview access or run a hands-on comparison. Announced capabilities, provider benchmarks, independent evaluations, calculations, and our proposed tests are identified separately. Availability and plan terms can change during the preview.

Claude Duet specifications and launch availability

Duet is an agent product built around Claude Opus 5.5. The model supplies reasoning and tool-use capability; the surrounding product supplies persistent work, account connections, notifications, memory, and approval checks. A model benchmark describes only part of that system.

Sources: Duet product page and FAQ, and launch announcement. The connector count covers connectors and plugins together. It does not establish that 6,000 separate apps have identical permissions or that every integration supports every business action.

On narrow screens, scroll the tables horizontally to read every column.

Several conventional specifications remain undisclosed in those materials: VM CPU, RAM and storage allocations; maximum task duration; concurrent-task limits; Duet-specific context management; exact background-check cost; and a guaranteed response-time or monitoring interval. Anthropic’s general pricing page lists model-dependent context windows up to one million tokens. That is not a promise that Duet continuously holds a million-token business history in active context.

The missing resource figures matter if you expect substantial code builds, large datasets, or uninterrupted monitoring. They matter less if your first use is drafting a meeting brief. Choose the workflow before deciding which absent specification would prevent you from using the product.

How Duet turns a message into ongoing work

The operating model has three parts: context, execution, and judgment. Context helps an agent understand which client, project, or preference you mean. Execution lets it operate software. Judgment determines whether a result is ready, whether a new issue deserves attention, and whether the next action needs you.

Context reduces the cost of getting started

Existing Claude users do not have to begin by explaining every preference again. The carryover of memory, skills, and apps gives Duet a potentially useful starting point. A company style guide, a recurring reporting skill, and a connected inbox could together make a request such as “prepare tomorrow’s client brief” much more specific.

That is our inference about the design’s value, rather than a measured onboarding result. Imported context can also import outdated assumptions. Before delegating recurring work, check the agent’s understanding of current priorities, the authoritative documents, and who owns the final decision. A remembered preference is evidence about the past; it should remain correctable.

Background execution is separate from checking for new work

A cloud computer allows an assigned task to continue after you close your laptop. Periodic checks determine when Duet notices something new. Those are different clocks. An already-running analysis may continue while a newly arrived email waits until the next account check.

This distinction changes how to use the product. Preparing a weekly report tolerates a loose discovery interval. Catching a cancellation minutes before a meeting may not. Anthropic explicitly acknowledges that something arriving between check-ins can be missed. An “always-on” description should not be read as an instantaneous notification guarantee.

Approval becomes part of the deliverable

A useful handoff includes enough detail to approve the action: recipient, message, attachment, amount, destination, and the reason for the step. Without those details, a confirmation prompt merely transfers uncertainty back to the person.

Consider a hypothetical overdue invoice. Good preparation would identify the correct customer, verify that payment has not already arrived, find the agreed terms, and draft an appropriate reminder. The final send is a separate event. If the agent confuses two customers with similar names, an accurate-looking draft can still cause damage. Checking entity identity belongs near the beginning and at the approval boundary.

Pricing, limits, and the real cost of background work

During the preview, Duet is included in eligible Pro and Max plans and shares their usage allowance. Anthropic’s current US pricing lists Pro at $20 per month when billed monthly, or $200 billed annually, shown as approximately $17 per month. Max starts at $100 per month. Applicable taxes are additional. Those are subscription prices, rather than separate Duet charges. Source: Claude pricing.

Joining the waitlist does not guarantee immediate access. Buying a qualifying subscription should not be confused with a confirmed Duet invitation. The product FAQ also rules out assuming that a Team or Enterprise seat is currently eligible.

Shared usage creates an opportunity cost. A morning brief, periodic account checks, document preparation, and a long analysis all draw on capacity you might otherwise spend in Claude. Anthropic does not publish a fixed number of Duet briefs or completed projects per plan in its launch materials. There is therefore no defensible conversion from “Pro subscription” to “X automated business tasks per day.”

For a pilot, record usage before and after a representative week, alongside completed work and your review time. A service that drafts twenty reminders but requires twenty lengthy corrections may have consumed more attention than it saved. A single accurate brief that prevents a missed commitment could be more valuable.

A practical calculation is net time saved = manual work avoided − setup time − supervision − corrections. Add software fees and any separately approved purchases when calculating financial value. Keep this separate from token-price comparisons: Opus 5.5 API prices do not reveal Duet’s subscription metering or the full work performed between notifications.

What Duet can do for a small business

The announced integrations span communications, invoices, payroll, agreements, CRM, design, and commerce. Anthropic names Gmail, Slack, QuickBooks, Stripe, Gusto, LinkedIn, Docusign, HubSpot, Canva, and Shopify. It also describes Link and Shop Pay checkout, while a richer Shopify visual editor and sign-in using saved 1Password credentials are described as coming soon. Source: Duet announcement.

The workflows below are examples of how to evaluate those capabilities. They are not Kingy.ai test results.

Meeting preparation and follow-up

Give the agent a named meeting, approved sources, and a clear output: a one-page brief with the attendee list, the latest agreed scope, unresolved decisions, and source links. Ask it to separate a confirmed commitment from a proposal. That distinction prevents an old sales suggestion from becoming an invented obligation.

After the meeting, a useful follow-up draft should connect each action to an owner and a due date. Review the recipients and attachments before sending. The benchmark for success is a correct, usable brief and follow-up, with less effort than preparing them manually.

Invoice reconciliation and payroll preparation

Invoice work requires reconciliation across systems. An invoice can appear unpaid in one place because a transfer has not settled or a record has not synchronized. Ask the agent to show its sources and unresolved cases before preparing reminders. Do not grade the workflow by the number of emails it can draft.

Payroll preparation has similar identity and arithmetic requirements, plus sensitive employee information. Use the product only within your organization’s approved account and data rules. A sensible first evaluation uses fictitious employees and known expected totals. Errors in hours, reimbursement treatment, or recipient identity should be recorded even if the final payment step remains unapproved.

Dashboards, forecasts, and prototypes

A dashboard can be visually convincing while using stale data or the wrong definition of revenue. Specify the source system, reporting period, currency, timezone, refund treatment, and whether the chart uses bookings, invoices, or cash collected. A forecast should label assumptions and make its formulas inspectable.

For a web prototype, ask for a runnable artifact, setup instructions, and a record of what was tested. A screenshot proves appearance at one moment. It does not establish that authentication, saving, accessibility, or deployment works. Duet’s ability to perform work across tools increases the importance of knowing which parts of the result have evidence behind them.

Benchmarks: what the numbers establish

There are three distinct kinds of evidence to inspect: Duet product performance, the underlying model’s capability, and the safeguards around agent actions. A strong score in one category does not fill a gap in another.

1. Duet-specific results remain limited to launch evidence

The launch announcement offers employee use cases and selected customer accounts. It does not publish a Duet completion-rate benchmark, a representative task set, average human interventions, cost per completed workflow, or a controlled comparison against Dot and Muse.

Anecdotes can establish that a workflow was useful to a named tester. They cannot establish how often the system succeeds across the entire workload, or how many attempts failed before the example was chosen. We found no like-for-like Duet, Dot, and Muse product benchmark in the primary materials reviewed for this article.

2. Opus 5.5 supplies meaningful capability evidence

Anthropic’s September 22 Opus 5.5 release reports the following results. These describe models evaluated with particular tools and settings, rather than the consumer agent products built around them. Source: Opus 5.5 release and benchmark notes.

Most Opus results use adaptive thinking at max effort; Terminal-Bench uses xhigh for Opus and high for Astra. Anthropic reports fallback-model handling for some safeguard interventions, while the AutomationBench row excludes fallbacks. Terminal-Bench’s reported Opus standard error is ±2.6 percentage points. These details prevent treating the table as a controlled Duet-versus-Dot trial.

The direction of the result also depends on the task. Opus leads the displayed terminal score, while Astra is slightly ahead on the displayed business-workflow score. That supports testing the work you need. It does not support declaring one agent universally superior.

3. Zapier’s independent business evaluation is particularly relevant

Zapier’s Opus 5.5 AutomationBench report evaluates 657 tasks per effort setting on version 1.0.6, run September 17–18, 2026. Its simulated business environment spans 47 apps. Tasks receive a strict pass only when every required end-state assertion holds. The agent cannot ask clarifying questions, and there is no human approval loop.

Without fallbacks, max-effort Opus 5.5 passed 263 of 657 tasks, or 40.0%. Zapier separately notes 42.47% with Anthropic’s default fallback routing on its public leaderboard. Those are different configurations. The report estimates $4.22 per attempted task and $10.54 per pass at max effort, including failures, using a no-cache pricing calculation rather than billed costs.

These figures are neither Duet prices nor its expected success rate. They show how demanding complete business workflows remain, and why evaluation must inspect final records. Duet’s opportunity to ask a person may help on ambiguity; its real account connections introduce different difficulties. Only a product test can measure the combined effect.

A useful implication follows from strict scoring. An agent can perform most steps correctly and still fail the task because it writes the wrong field or misses an important exception. A cheerful completion message provides much weaker evidence than a checked invoice record, verified document, or correctly addressed draft.

Safety architecture and evaluations deserve separate treatment

Duet’s launch describes several defenses: credential handling derived from Managed Agents, action review using the auto mode classifier, browser prompt-injection defenses, and a new classifier and system prompt for sensitive information. Anthropic says internal red teams and an external firm penetration-tested the infrastructure, and points to its public bug bounty. These are provider descriptions of protections, rather than a published independent Duet audit report.

Keeping credentials outside the model reduces one kind of exposure

Anthropic’s Managed Agents engineering explanation separates execution environments from credential storage. It describes a vault and proxy for authenticated tool use, so the agent can call an authorized service without handling the underlying OAuth secret.

This is relevant because a hostile document cannot extract a password the model never receives. It does not prevent every misuse of an authenticated account. An agent could still propose an inappropriate action through an otherwise legitimate connection. Credential isolation and action authorization solve different problems.

The auto mode numbers describe Claude Code, not Duet

Anthropic’s March 25 auto mode report evaluates a full two-stage pipeline on 10,000 real internal tool calls, 52 curated real overeager actions, and 1,000 synthetic exfiltration attempts. It reports a 0.4% false-positive rate on real traffic, a 17% false-negative rate on the curated overeager set, and 5.7% false negatives on synthetic exfiltration.

False positives block benign actions; false negatives allow dangerous ones through. The small curated sample is an important qualification. These rates belong to that documented coding-agent evaluation. Duet’s announcement references the safeguard lineage but does not establish that its production configuration has those exact rates.

The practical lesson is that permission review can improve safety without becoming infallible. A separate checker should still be tested on vague requests, similar-looking recipients, changed instructions, and actions whose consequences extend beyond the immediate document.

Browser attack resistance also depends on configuration

Anthropic’s November 2025 browser-security research reports an attack success rate of 1.4% for Opus 4.5 with improved safeguards under its internal adaptive attack procedure. The attacker received 100 attempts per environment. This is an older model and a browser-extension setup, not a Duet security score.

The same report emphasizes that low attack success still leaves meaningful risk. A percentage from an adversarial test cannot be converted into “one bad action per hundred customer tasks.” Attack availability, retries, permissions, and the distribution of real work all differ.

Sensitive information and prohibited actions

Anthropic says Duet’s new information-sharing protections reject requests to share its strictest information tier, including government identification and credit-card numbers. Other sensitive information, such as health and personal finances, requires explicit instruction. Duet also excludes securities trading and moving money between accounts, even with approval. Source: Duet’s launch safety description.

Payment integrations do not contradict protected handling of card details. A wallet can authorize a scoped purchase without placing the underlying card number into the agent’s conversation. The result still needs a clear item, merchant, amount, and human approval.

For professional use, check the applicable plan’s data terms and your own organization’s requirements before connecting accounts. Anthropic’s pricing comparison lists individual-plan training as opt-out. Do not infer Team or Enterprise contractual protections from Duet’s business-oriented marketing, especially while those plans are excluded from the preview.

Claude Duet versus OpenAI Dot, Meta Muse, and other agents

The comparison below describes documented product design and positioning. It does not award a speed or reliability winner. “Dot” refers here to an OpenAI dot; the product family is styled “dots.” “Muse” refers to Meta’s personal agent, whose capabilities should be distinguished from the Muse model family.

Sources: Anthropic, OpenAI documentation, Meta engineering, Grok Bot documentation, and Google Cloud’s October 8 announcement.

Duet and Dot differ in visibility, control, and accounting

OpenAI’s dots launch describes GPT-6 Astra, a cloud computer users can inspect, and access through ChatGPT, Slack, and Teams. Its safety explanation says proactive research uses read-only tools and cannot directly change connected-app content or control a browser. Follow-up work must pass the usual action rules.

That distinction makes proactivity more precise. Discovering a possible issue and acting on it have different permissions. OpenAI also documents Custom Rules and separate Auto-review, with mandatory requirements that user preferences cannot remove. Duet’s launch presents a more explicit list of actions that wait for approval, plus actions it will not perform.

Current dots documentation lists gradual access for eligible Pro users outside the EEA, UK, and Switzerland, Business Premium rollout worldwide, and Enterprise access enabled by an administrator. Dot conversations do not count toward ChatGPT limits; delegated Work and Codex tasks count toward those products’ limits. This differs from Duet’s shared Claude allowance. Neither description justifies assuming unlimited computational work.

For a buyer, browser visibility can materially change recovery. If a workflow stalls, seeing the page may reveal an expired login or an unexpected form. Duet’s current lack of browser viewing leaves that particular intervention unavailable. It does not establish that Duet is slower or less accurate overall; it identifies a concrete control to test.

Muse competes directly for the same small-business work

Meta’s Muse launch describes a personal agent powered by Muse Spark, accessible through its app and WhatsApp, with its own Secure VM. Its small-business announcement adds tools including QuickBooks, Shopify, Slack, Stripe, Canva, and business accounts on Facebook and Instagram. This overlaps substantially with Duet’s announced target workload.

Meta’s technical write-up describes the main runtime as separated from security services, with Sentinel authorizing connector actions and network egress. It also describes credential isolation and an inspectable Chromium browser. Those are useful architectural disclosures. They do not constitute an independent demonstration that Muse is safer than Duet.

Likewise, “dedicated VM” should not be treated as a complete privacy specification. Meta’s launch distinguishes its Secure VM from a planned Confidential VM. Those terms should remain separate unless a current release establishes otherwise. Availability also evolved after launch: Meta’s September 24 Connect account names the US, Canada, and Mexico.

Our practical recommendation is to compare the exact systems your business uses. For a retailer deeply involved in Meta’s business channels, Muse’s integration choices deserve a close look. For someone with established Claude skills and working context, Duet’s continuity may matter more. Neither advantage predicts the quality of an individual completed workflow.

Grok Bot and Gemini widen the choice

Grok Bot’s documentation emphasizes persistent teammates with a browser, filesystem, terminal, and skills or routines. It lists desktop and mobile platforms and access through paid Cursor plans or linked qualifying SuperGrok subscriptions. Its multiple-Bot approach is relevant when a user wants distinct ongoing responsibilities rather than one primary assistant conversation.

Google’s Gemini agent announcement emphasizes shared business context, Workspace access, persistent execution, multi-agent orchestration, and organizational controls. It also separates the agent from its underlying model choice, describing routing across Gemini and Claude models. That is a reminder that a model ranking and a product procurement decision answer different questions.

For an organization, identity, auditability, permitted data destinations, administrator controls, and cost enforcement can decide the purchase before small benchmark margins matter. Duet’s consumer-plan preview should be assessed on the terms and controls it currently offers.

What remains unproven about Duet

Anthropic acknowledges possible thread-reading errors, urgency misjudgments, and weaker performance on personal errands such as ticket booking. The inability to show the browser is another explicit preview limit. Beyond those disclosures, the reviewed launch materials leave several operational questions open.

We do not have a measured rate for useful versus unnecessary notifications, recovery after a connector fails, correct resumption after a long pause, or resistance to stale business context. We also lack a representative measure of approval quality: whether the agent asks at the right time and shows enough evidence for an informed decision.

These are evaluation gaps, rather than proof of defects. A fair review should be equally demanding of competitors. Different products may disclose different amounts of detail; disclosure breadth and measured effectiveness are related but separate assessments.

Portability deserves attention too. If months of corrections teach an agent how your company works, switching services may require rebuilding that context. Ask how you can inspect, correct, export, and remove retained information. Disconnecting an app and erasing previously learned information are different operations. OpenAI’s admin guidance, for example, explicitly distinguishes stopping future access from deleting retained dot context.

How we would evaluate Duet against Dot and Muse

A useful comparison would give each product the same bounded business problem, the same source facts, and an explicit action policy. Run it in disposable test accounts with fictitious contacts and money amounts. This is a proposed protocol, not a test we have performed.

Record complete success, partial success, failure, and safe abstention separately. An agent that asks a necessary question should receive different treatment from one that guesses incorrectly. Also separate work blocked by a product’s access policy from work attempted and performed badly.

Measure your active supervision time alongside elapsed time. Track corrections, unnecessary approvals, useful alerts, false alarms, missed developments, duplicate writes, and usage consumed. Verify final records directly. The agent’s own description of what it did is a claim to check.

Proactivity needs a different denominator from assigned tasks. Plant a fixed set of meaningful events over several days, include harmless noise, and count which events are caught. Precision is the fraction of alerts worth receiving; recall is the fraction of relevant events detected. Measure detection delay as well. A daily brief and an urgent alert serve different needs.

Repeat tasks enough to expose variation and retain the product version, date, plan, permissions, and prompts. With a small pilot, report counts such as “8 of 10 completed correctly” rather than implying a population-wide reliability guarantee. A short observed streak cannot establish that an agent is safe for unrestricted use.

Begin with one reversible workflow and expand only after checking its outputs and its effect on your attention. For Duet, meeting briefs or a read-and-draft invoice review are more informative starting points than immediately delegating live payroll. Your first decision should be whether it completes one useful job consistently under clear limits.

Who should try Duet first

Duet is worth considering for an eligible Claude user who has connected business apps, useful existing skills, and recurring work that can tolerate periodic checks. The strongest initial case is reducing preparation and coordination across several tools while keeping consequential decisions visible.

People who require instant monitoring, direct browser takeover, confirmed organizational controls, or documented performance for a specific high-stakes workflow should check those requirements before joining a pilot. Availability through a personal subscription does not settle an employer’s approval of connected company data.

Our buying recommendation is to keep your current agent until Duet demonstrates a practical advantage on your own workload. The launch gives Claude users a credible reason to test it. The next useful evidence is a verified brief, reconciled invoice set, or working dashboard, with the time and usage required to produce it recorded.

Source notes and evidence boundaries

Duet product facts come from Anthropic’s October 21 announcement and product FAQ. Model capability figures come from the September Opus 5.5 release, with AutomationBench checked against Zapier’s own report. The auto mode and browser-security numbers describe earlier, separate evaluations. Competitor descriptions come from their vendors’ product and engineering documentation, including later updates where launch availability changed.

We have not measured these products against one another, verified every advertised connector, or audited their security implementations. The workflow examples and pilot above are Kingy.ai analysis. No Duet-specific performance score, savings claim, or cross-vendor safety ranking is implied.

The Kingy Brief

Get The Kingy Brief.

AI changes, original tests and one practical thing to try. Fridays at 09:00 Vancouver time.

Free · Double opt-in · Unsubscribe anytime

Privacy policy

Sign up for The Kingy Brief on Beehiiv.

Signup help and newsletter schedule

Signup form provided by Beehiiv. After submitting, check your inbox for "Confirm your subscription to The Kingy Brief" and open its confirmation link. Check Spam or Promotions if you cannot find it.

Fridays at 09:00 Vancouver time: source-checked AI changes, original tests and one practical thing to try. We skip a week when there is not enough verified material. Free. Unsubscribe anytime.

Sign up free