Anthropic's background agent, Claude Duet, launched only on individual Pro and Max subscriptions, so the first copies that read your company's Gmail, Slack or HubSpot will run on personal accounts your IT team cannot administer. No Team or Enterprise version exists yet, and the launch page says nothing about one. Your levers this week sit on your own side of the OAuth grant: the Google Workspace and Slack app policies that decide whether a personal agent can connect to work data in the first place.
Anthropic announced Duet on October 21, 2026 as a waitlisted research preview, "starting with US Pro and Max subscribers," on the web and in standalone iOS and Android apps. It is the company's answer to OpenAI's Dots, which we covered when Dots launched with its own enterprise admin gaps. Dots shipped with a workspace switch an administrator has to flip; Duet has no workspace for an administrator to manage.
What Claude Duet Actually Does
Claude Duet is a proactive agent: it watches your connected apps on a schedule and messages you when it thinks something needs attention, instead of waiting for a prompt. Anthropic's launch article says it runs on Claude Opus 5.5, sends "a short brief" each morning and checks connected accounts "every few hours." It works on "a virtual machine with its own browser," so the user's laptop can be closed while it runs.
The reach is broad. The same page cites "over 6,000 connectors and plugins" in the Claude Marketplace and names Gmail, Slack, Intuit QuickBooks, Stripe, Gusto, LinkedIn, Docusign, HubSpot, Canva and Shopify. SiliconANGLE reports that Duet inherits the user's existing Claude memory, skills and apps with no additional setup, and returns finished work as a doc, sheet or deck in one running thread. Anthropic's examples run from scheduling meetings to financial forecasts, dashboards and small web apps.
The target customer is spelled out. Anthropic built Duet for "professionals and small business owners with more on their plates than they can track." That works for a sole proprietor who owns every account Duet touches. When the professional is one of your employees, the Gmail it reads belongs to your domain.
There is no separate price. Duet is included in Pro and Max and "uses the same usage limits as the rest of Claude," with the background checks counting toward those limits. On Anthropic's pricing page, Pro costs $20 a month billed monthly and Max starts at $100. That is cheap enough to expense, or to pay personally without asking anyone.
Why a Personal Plan Changes the Risk
A personal Pro or Max account sits outside every administrative control Anthropic sells to companies. Anthropic's connector documentation describes org-level controls for Team and Enterprise: owners enable connectors for the organization, approve or block member requests, and set each tool to "Always allow," "Needs approval" or "Blocked" in a way individual users cannot override. Enterprise owners can also stop services on their verified domains from connecting to Claude accounts outside the organization. The same page describes Pro and Max users managing their own connectors under Customize > Connectors, with no organization layer above them.
The data terms differ too. Under the consumer terms update Anthropic published in August 2025, Free, Pro and Max users each choose whether their chats are used to train Claude. If a user allows it, retention extends to five years from 30 days. Team, Enterprise and API use fall under Commercial Terms and are excluded. The Duet announcement does not say whether its background checks and briefs follow that same setting. The plan it runs on implies they do, but treat that as unconfirmed until Anthropic says so.
Whether your customer email ends up retained for five years therefore depends on a toggle in an employee's personal privacy settings, which you never see.
Anthropic's side of the argument is strong. Duet's safety design is more conservative than most consumer agents. The launch page says Duet "shows you exactly what it's about to do and waits for your approval" before it sends a message, makes a payment, signs a document or deletes anything, and it refuses to trade securities or move money between accounts even with approval. Credential handling follows the Claude Managed Agents design, so it "never directly sees your passwords or sign-in tokens." A new classifier blocks the most sensitive data tier, including credit card numbers and government IDs. Red teams and an outside firm penetration-tested it.
All of those protections report to the employee. Approval prompts go to them and the action history lives in their thread. Anthropic's own trustworthy agents framework says "no single line of defense is enough to guarantee protection" and encourages customers to think carefully about which tools, data, permissions and environments they give agents. On a personal plan, the individual employee makes that decision for your data.
How Duet Compares With OpenAI Dots
OpenAI's Dots, Duet's closest rival, at least starts inside an admin boundary. MediaNama reported that the Dots beta for Enterprise is "off by default" until an administrator enables it. OpenAI's Dots admin guide lists four role permissions, including "Use dots" and "Allow local computer access," plugin controls for which apps and actions are allowed, and compliance records tagged client_id = DOTS in the Compliance API.
Dots has gaps of its own: no data residency during the beta, and no cloud events in your OpenTelemetry collector. Still, an administrator can decide who gets it and read what it did, and Duet offers no equivalent today. Google took a third route and gave its Gemini agent a Workspace account identity that an admin manages.
| Claude Duet | OpenAI Dots | |
|---|---|---|
| Plans at launch | Pro and Max, US, waitlist | Pro and Business Premium; Enterprise, Edu and Healthcare beta |
| Enterprise default | No Enterprise tier | Off until an admin enables it |
| Admin permissions | None on personal plans | Four role permissions plus plugin controls |
| Audit trail for the company | None | Compliance API records tagged DOTS |
| Runs on | VM with its own browser | Cloud computer with its own browser |
If you already block personal ChatGPT accounts at the identity layer but allow personal Claude, Duet is the reason to revisit that asymmetry.
Where Your Controls Actually Are
For a personal-plan agent, your controls live in the apps Duet connects to. Every connector an employee adds is an OAuth grant against your Google Workspace, Slack or HubSpot tenant, and those tenants have policies.
Google Workspace defaults to open. Google's API controls documentation lists three settings for unconfigured third-party apps, and the default is "Allow users to access any third-party apps." Admins can instead block all third-party apps until they are configured, or mark Gmail and Drive as Restricted services so that only Trusted apps reach them. Google states that switching a service to Restricted revokes the tokens of previously installed untrusted apps. Gmail, Drive and Chat can also restrict specific high-risk scopes such as sending mail.
Slack is open by default too. Slack's app approval help page says that "by default, members can install them without approval from a Workspace Owner." Owners can switch on "Only allow pre-approved apps" under App Management Settings.
If your Workspace and Slack settings are still at defaults, a Duet user can connect work mail and work channels today, and the first sign you get is an entry in Google's accessed-apps list, which Google says updates 48 hours after a token is granted. We traced the same exposure when Adobe acqui-hired Rilo and its Slack tokens kept working. A personal-plan agent is a standing OAuth grant held by someone your vendor-risk process never reviewed.
Blanket blocking has a cost. Plenty of your staff will get real use from a morning brief across their inbox, CRM and calendar, and a ban tends to push the same work onto personal phones. A background agent holds access around the clock, which is the standing-privilege problem in agent authorization, so the better control is a sanctioned path with scoped access.
What to Do Before the Waitlist Opens
This Week:
- Pull the accessed-apps list in the Google Admin console and search for Anthropic or Claude grants. Note which users already have them; those are your likely Duet adopters.
- Check the unconfigured third-party apps setting. If it reads "Allow users to access any third-party apps," decide with your security lead whether Gmail and Drive should become Restricted services, and test the change on one organizational unit first, because Restricted revokes existing untrusted tokens.
- Confirm Slack's "Only allow pre-approved apps" is on, and do the same review in HubSpot and QuickBooks, where Duet's named connectors reach customer and financial records.
This Month:
- Write a one-paragraph rule on personal AI agents connecting to company systems, and publish it where people will actually read it. Our coverage of OpenAI agents that leaked images from users who never opted out shows why the training toggle should sit in that rule.
- If you already run Claude Team or Enterprise, ask your Anthropic account team in writing whether and when Duet comes to those plans, which admin controls it will honor, and whether Duet activity will appear in your audit logs. Get the answer on paper.
- If you don't, compare what a sanctioned seat would cost against the personal plans already on expense reports. Team standard seats list at $25 per month billed monthly on the pricing page, and only Team and Enterprise put connector permissions in your hands.
The Bottom Line
Duet is entering companies by the familiar shadow-IT route: a personal sign-up that arrives before any enterprise admin console does. This time the personal tool reads and drafts on its own every few hours, holding an OAuth grant into your systems.
Anthropic calls Duet early and says it "might misread a thread or miscalibrate what's urgent," and it promised more safety detail "in the coming days." Until an Enterprise path exists, your Workspace and Slack app policies are the only admin console you have for it. Check them before the waitlist opens.
Continue Reading
- OpenAI's Dots Beta Skips Data Residency and Your OTel Collector
- Google's Gemini Agent Gets Its Own Mailbox Before It Gets a Price
- ChatGPT's Chrome Agent Acts in Logged-In Tabs Without a Full Log
- Adobe Took Rilo's Team. Its Slack Token Never Expires.
- Agent Authorization: Standing Privilege Is the Whole Problem
- Claude Enterprise Spend Controls: 5 Things to Configure Now