Claude Duet Enters Waitlist Preview: Why API Key Hygiene Still Matters After the OpenCode Incident
Anthropic's Claude Duet is a waitlist preview of a proactive agent for US Pro and Max users. What it does, its usage limits and safeguards, and what the OpenCode API-key breach the same week means for credentials and agent permissions.
Anthropic has opened a waitlist preview of Claude Duet, a standalone app in which Claude works as a proactive agent: it surfaces what needs attention, completes tasks, keeps working in the background, and checks in before it acts. The launch arrived in the same week that attackers compromised part of OpenCode, an open-source coding agent, and ran up charges on users’ stored AI API keys. The two stories involve different products, but together they show what changes when AI tools work in the background with access to accounts and credentials.
This article covers what Duet is and who can use it, the safeguards Anthropic describes, what happened at OpenCode, and a practical checklist for credentials and permissions.
What Claude Duet is
Anthropic’s announcement (October 21) describes Duet as a research preview aimed at professionals and small business owners “with more on their plates than they can track.” It comes to the user with what needs attention, completes requested tasks, keeps working when the user steps away, and checks before it acts. Anthropic says it runs on Claude Opus 5.5.
Paul Thurrott’s coverage describes a morning brief assembled from connected apps, with Duet messaging the user only when something needs a decision. Example tasks include scheduling meetings, building dashboards from many tools, financial or sales forecasts, prototyping, and building web apps. Thurrott reports support for more than 6,000 apps, and The New York Times names Canva and DocuSign among them, along with purchases through Stripe’s Link or Shopify’s Shop Pay, each requiring approval.
Availability and usage limits
| Detail | What Anthropic and press reports say |
|---|---|
| Access | Research preview via waitlist |
| Who first | US subscribers on Pro and Max plans |
| Platforms | Standalone app on iOS and Android, plus claude.ai; separate from the main Claude app for now |
| Price | Included in Pro and Max; no extra cost (per the Times) |
| Usage | Shares the plan’s usage limits with other Claude use |
The usage point deserves attention. Anthropic says Duet draws on the same limits as the rest of Claude but uses them differently than a typical conversation: background checks count, and larger tasks such as building a financial model or a presentation take more model turns. Users who already approach their plan limits with chat may find that a background agent uses up capacity while they are not watching. “No extra cost” does not mean unlimited.
Anthropic’s own caveats
Anthropic is candid about the preview’s limits. It says this is an early version that might misread a thread or misjudge what is urgent; that it is designed for work, so personal errands such as booking tickets are weaker; and that it cannot yet show the user its browser. CNBC’s coverage highlights the misread-a-thread warning and frames Duet against consumer-oriented competitors: Meta’s Muse, which CNBC says launched the previous month and reached the top of Apple’s App Store, and OpenAI’s dots, introduced at its developer conference. Thurrott also mentions Google’s Gemini Spark and Microsoft Autopilot, and suggests the timing means Anthropic arrived somewhat late to the category.
Safeguards Anthropic describes
According to the Times, Anthropic said Duet will show users exactly what it plans to do before sending a message or making a payment. Some actions, including trading stocks and moving money between accounts, are blocked even if the user approves them. A new filter is intended to stop the agent from sharing credit card numbers or government ID numbers.
| Action | Treatment described |
|---|---|
| Sending messages | Shows the planned action first |
| Purchases via Stripe Link or Shop Pay | Allowed with user approval |
| Trading stocks | Blocked even with approval |
| Moving money between accounts | Blocked even with approval |
| Sharing card or government ID numbers | Filtered |
These safeguards apply to Duet itself. Organizations that do not yet have access are not covered by them, and internal policies should not assume they are in place across a company while the product is a US-only waitlist preview.
What happened at OpenCode
TechCrunch reported on October 19 that OpenCode, an open-source coding agent often used as an alternative to Claude Code and Cursor, said attackers broke into an older system overnight. The incident affected 1.4% of users of OpenCode Console, the company’s online platform, where some users store the API keys they use for AI services.
Developers reported spend alerts from OpenAI, Anthropic, and Google firing overnight. Some described charges of hundreds of dollars, and a few reported totals above $1,000. The breach came on the same night OpenCode made the GLM-5.3-Flash model free to use. OpenCode had not explained how the attackers got in, how keys were stored, or the full extent of misuse, and said the incident was ongoing. It told affected users to revoke and replace their keys directly with each provider.
The providers responded differently:
- Anthropic and Google blocked the API keys they believed were exposed.
- OpenAI said it worked with OpenCode to restore access and refund API customers for credits used in the attack.
- OpenCode said refunds for unauthorized charges were underway.
The 1.4% figure refers to Console users, not everyone who runs OpenCode locally. Developers who never stored a key in Console were not affected by this incident, although it is a warning about any dashboard that offers to hold keys for several AI providers in one place.
Why the two stories belong together
Duet and OpenCode Console are unrelated products with different security designs. Duet is hosted by Anthropic, billed against Pro or Max usage, with purchases gated and money movement blocked. OpenCode Console was a place where some developers kept provider keys. What connects them is the shift toward AI tools that act on a user’s behalf while the user is not watching. Background work is the point of a proactive agent, and in the OpenCode case, background spending on stolen keys was the harm.
Two different threat models follow:
- An agent might take an unwanted action, such as sending the wrong message. Duet’s plan-preview and blocked-action rules address this.
- A stored credential might be stolen and misused. Joining a new agent’s waitlist does nothing about a key that has already leaked.
A practical checklist
If you stored keys in OpenCode Console:
- Revoke the keys with each provider (OpenAI, Anthropic, Google, and any others).
- Confirm whether the provider blocked the key and whether refunds apply to your account.
- Create new keys and store them only in the provider’s console or a secrets manager you control and audit.
Before connecting a proactive agent such as Duet:
- Treat each connection as a new permission. Because Duet is a separate app, connecting a mailbox or calendar there is a new grant, even if you connected the same account to Claude earlier. Record what you connect.
- Do not store API keys in an agent. A background assistant is not a secrets manager.
- Know how to revoke. Before connecting payment services or business systems, check how to remove those connections when the preview ends or if something goes wrong.
- Check payment rails. Duet’s approval flow applies to Stripe Link and Shop Pay purchases; transfers between accounts are blocked. Do not assume it can pay contractors or vendors by other methods.
- Watch usage. Monitor plan usage in the first weeks, since background checks count against the same limits.
Related coverage
For more on agent security, see our articles on the Claude Code 2.1.179 release, plugin supply-chain attacks on AI coding agents, and credential theft targeting Claude configuration files.
Bottom line
Claude Duet is a carefully limited preview: US-only, Pro and Max, waitlist access, shared usage limits, and explicit blocks on high-risk financial actions. Its value will depend on which accounts users connect and how well it judges what matters. The OpenCode incident is a reminder that the biggest practical risk with AI tools is often credentials rather than the model itself. Rotate exposed keys first, keep keys out of agents and convenience dashboards, and treat every new connection to a background agent as a deliberate permission decision.
Sources
- Anthropic, “Claude Duet” (October 21): https://claude.com/resources/articles/claude-duet
- CNBC, Anthropic preview of Claude Duet (October 21): https://www.cnbc.com/2026/10/21/anthropic-preview-of-claude-duet-personal-ai-agent-take-on-muse-dots.html
- The New York Times, Anthropic AI agent Claude Duet (October 21): https://www.nytimes.com/2026/10/21/technology/anthropic-ai-agent-claude-duet.html
- Thurrott.com, “Anthropic announces Claude Duet, a personal AI agent”: https://www.thurrott.com/a-i/anthropic/343121/anthropic-announces-claude-duet-a-personal-ai-agent
- TechCrunch, “Hackers hit AI coding tool OpenCode” (October 19): https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/