The preview starts with Pro and Max subscribers in the United States, through a waitlist. Anthropic said Duet is available as a standalone app on iOS and Android and on claude.ai. During the preview it is included in Pro and Max at no extra charge and uses the same usage limits as the rest of Claude. The help center says Team and Enterprise plans are not included yet, and that invitations go out in waves, so a waitlist signup does not come with a date.

Access also depends on the email address. The help center says the waitlist email has to match the Claude account, and on a phone it has to match the Apple or Google account, because access is tied to that address.

What the agent is built to do

Anthropic said each morning Duet sends a short brief on the important items across connected apps, watches those apps through the day, and messages the user only when something needs them. People can type or send a voice message in one ongoing thread. The help center adds that separate channels can be opened for different topics and that they share memory.

The work is not tied to an open laptop. Both documents say Duet has its own computer in the cloud, with a browser, so a task can continue after the app is closed. Larger jobs can come back as files to review, such as a research brief, a financial model, a slide deck, or a dashboard. The help center says finished work shows up in a Make tab, and that a Tasks tab shows work in progress. A person can be told a task looks finished, but only that person can mark it complete.

The announcement says Duet was designed around Claude Opus 5.5. The help center is more specific about choice: during the preview, users cannot pick a model. Duet runs on Claude Opus 5.5 and decides how much effort a job needs.

Checks are periodic, not continuous. The announcement says connected accounts are checked every few hours, because checking nonstop would burn through plan limits faster. The help center says background work, including the morning brief and check-ins, counts against the five-hour session limit and the weekly limit at the same rate as ordinary Claude chats, so a person can hit those limits sooner than with chat alone. People admitted to the preview get one full reset of both limits. That reset is available until November 30, 2026.

Approval, and what stays off limits

Anthropic said Duet can read, draft, and prepare work on its own. Before it sends a message, makes a payment, signs a document, or deletes anything, it is supposed to show the action and wait. The help center says that if the person cannot approve immediately, Duet finishes the rest of the task and brings the approval back later.

Some actions stay blocked even with approval. The announcement names trading securities and moving money between accounts. The help center adds accessing someone else’s account. Duet does not make phone calls or send text messages to other people. With approval, it can send email from accounts the user has connected.

The announcement says credential handling follows the design used for Claude Managed Agents, so Duet does not directly see passwords or sign-in tokens. A new classifier and safety prompt check messages and are meant to reject requests to share the strictest tier of information, including credit card numbers and government identification. Health information and personal finances are let through only when the user has explicitly told Duet to send them. Anthropic said red teams and an external firm penetration-tested the security infrastructure, and that the app is covered by its public bug bounty. It said more safety detail would follow in the coming days.

The help center describes prompt injection directly: mail and web pages can contain instructions meant to mislead the agent. Duet is built to treat what it reads as information and to act on what the user asked, and Anthropic says no defense is perfect, which is one reason consequential actions need approval. When a site asks for a password, the person types it into a separate form on their device. That form is designed to send the password to the browser and keep it out of the chat.

Connectors and payments

The announcement says Duet can use the more than 6,000 connectors and plugins in the Claude Marketplace. The examples it lists include finding missed Gmail and Slack messages, checking Intuit QuickBooks or Stripe for unpaid invoices, preparing payroll in Gusto, posting a job to LinkedIn after the user edits and approves it, sending agreements through Docusign, drafting follow-ups from HubSpot, building a Canva campaign, and managing a Shopify store. A richer visual editor for Shopify is described as coming soon.

The help center narrows some of that. Connectors the user has already set up in Claude can be reused, including Gmail, Google Calendar, Google Drive, Slack, QuickBooks, HubSpot, Docusign, and Calendly. The user starts each connection and can disconnect an app. Disconnecting stops further access, but memory of earlier conversations is kept. Slack works with limits, and Microsoft 365 is not available yet. For a site without a connector, Duet uses its cloud browser.

Purchases are a separate path. Anthropic said Duet can buy things for a business with Link, Stripe’s digital wallet: Duet confirms the item, Link asks the user to approve the spend, and payment uses a virtual card so the real card number is not shared. Shop Pay from Shopify can be used at online stores. The help center says each purchase uses a one-time card, that Duet is designed to ask before each purchase, and that Link and Shop Pay are connected inside Duet rather than in the usual connectors directory. The Stripe connector used for invoices is separate from Link. Signing in to sites with logins saved in 1Password is described as coming soon, and only with permission.

Limits the company is already stating

Anthropic’s announcement calls this an early version that might misread a thread or misjudge what is urgent. Work tasks are the core; personal errands such as booking tickets are weaker. Users cannot yet watch Duet work in its browser or take the browser over. The app is separate from the main Claude app. The help center adds that Duet cannot see every project or the files on a person’s computer, that it can read work in Claude but cannot change it, and that something urgent can arrive between scheduled checks. Drafts and approval requests should be reviewed before they are confirmed.

The posts do not give a date for general availability, a price after the preview, or a date for Team and Enterprise access. Anthropic also published comments from people it said had early access. Those remarks are in the company’s announcement; this desk did not interview them.

In “Broad access through consistent standards”, the company said it has spent recent months aligning safety policies with customers and partners that provide its models. It is also updating its usage policies, effective November 20, 2026, “to clarify the rules for safe model development and sensitive uses of AI.” The post names models such as GPT-6 Astra as an example of systems that expand what developers can build, and says safeguards have to stay effective as those capabilities grow. It does not describe GPT-6 Astra any further.

What OpenAI says it already does

Before a deployment, OpenAI said it evaluates capabilities and risks, trains the model to follow safety requirements, and tests whether safeguards hold when people try to bypass them. After deployment, it said it monitors for abuse and investigates concerns. On cyber misuse, the post says the company trains models to refuse harmful requests and uses systems that look for suspicious patterns across interactions. Trusted-access programs are another layer, with eligibility rules for the most powerful capabilities.

OpenAI draws a distinction that matters for the partner rules: some safeguards sit in the model, and others depend on the systems and people around it. Both, it said, have to work whether the person is using OpenAI directly or a partner.

What partners have to do

The company said developers should be able to choose where they access a model and still meet one safety standard. It said it wrote policies to align safeguards across providers and is working with each partner so the partner’s implementation meets or exceeds OpenAI’s. The policies apply to direct use, to partners that host the models, and to resellers.

Those partners have to keep safeguards consistent with OpenAI’s, investigate possible violations, and take action when a concern is identified. That includes coordinating enforcement so a restriction is not easy to route around by switching services.

The updated usage policies add a gate for a specific kind of product. Services that provide direct access to OpenAI models, such as model routers or AI gateways, will need OpenAI’s review and approval before they offer that access. The post says the company will keep explaining what is allowed, what is restricted, and how a customer or partner can raise a compliance question.

OpenAI described two mechanisms in the same document. Private Safety Processing is given as an example of work with customers and partners on safeguards that still leave customers more control over sensitive data. SafetyIDs, which it said it is introducing with customers, would let a customer help OpenAI tell end users apart during an investigation without OpenAI learning those users’ identities. The stated aim is a more precise response to misuse, with less disruption to everyone else.

On enforcement, OpenAI said decisions are based on documented conduct and risk, rules are applied consistently, and the response is proportionate. If it restricts access, it said it will revisit the restriction when meaningful changes in conduct, commitments, or safeguards address the concern.

What the post does not do

The document is a company policy statement. It is not a statute and it is not a regulator’s order. It does not include the full text of the November 20 usage policies. It does not name which partners are already covered, and it does not describe an enforcement action taken under the new partner standard.

The same day, OpenAI said its frontier models and Codex workflows are coming to Google Cloud. That announcement is a distribution deal. This one is the rule OpenAI says should travel with the models when another company hosts them.

The announcement says customers will get native access to those models for agentic workflows, using Google Cloud’s data governance and infrastructure. OpenAI frames the control as a requirement for regulated industries: deploying the models means deciding who can reach sensitive data and how that data is used. The integration is described as pairing the models with Google Cloud’s access controls, centralized data governance, and high-performance infrastructure.

Customers will buy the frontier models in Model Garden, and the sale will run through the Google Cloud Marketplace. Enterprises that already have Google Cloud spend commitments will be able to draw those commitments down for the purchases, OpenAI said.

OpenAI also said its models will soon be available in Google Antigravity and the Gemini Agent, which it presents as a way for enterprise customers to choose a model per task. The post does not describe what those two products include beyond that.

General availability is planned in the coming weeks. The announcement does not give a calendar date. A separate preview page says a limited preview is open by invitation. It lists two pieces: frontier models through the Responses API on Google Cloud, for supported development and internal testing, and Codex through the API in the Codex app, the command-line interface, and supported development environments. The form asks customers to register interest. OpenAI’s wording is that the preview is invite-only and that registering is a request to be considered, not an approval.

Greg Brockman, OpenAI’s president and co-founder, said in the announcement that Google Cloud is a platform where developers and businesses already build agents and write software, and that the partnership is a step toward offering OpenAI’s most capable models and Codex there. Thomas Kurian, Google Cloud’s chief executive, said the company wants customers to have a broad selection of models, including OpenAI’s, so they can choose one for a given job with an eye on quality and cost.

The same post draws a boundary around the deal. Microsoft remains OpenAI’s primary cloud partner.

The same day, OpenAI published a separate note on partner safeguards and updated usage policies. That note is about how safety rules travel when other companies host or resell the models. It does not list Model Garden prices or which model names will be sold there. The Google Cloud posts do not list those prices or model names either.