Anthropic’s own post dated October 21: a research preview of Claude Duet, a standalone app where Claude works as a proactive agent. Waitlist first, United States, Pro and Max. Included in those plans. Uses the same usage limits as the rest of Claude. That is a SKU gate. It is not a keystore.
CNBC the same Wednesday put Duet against OpenAI’s dots and Meta’s Muse. TechCrunch two days earlier: attackers hit an older OpenCode system overnight, touching 1.4 percent of users of OpenCode Console, where some people store the API keys they use for AI services. Three documents. Mix them and you will join a waitlist because a coding agent got popped, then paste a new key into the same console.
We already filed Claude Code 2.1.179 closing a hole Copilot did not and SHA pinning that did not save a plugin install. This week the new app is Duet. The old console still had keys.
Pro and Max, US, no extra line item
Anthropic: Duet comes to you with what needs attention, completes tasks you ask, keeps working when you step away, and checks with you before it acts. Built for professionals and small business owners with more on their plates than they can track. Paul Thurrott repeats the morning brief across connected apps, then messages only when something needs you. Tasks named: scheduling meetings, dashboards with dozens of tools, financial or sales forecasts, prototyping, building web apps.
The model under it, in Anthropic’s post, is Claude Opus 5.5. Thurrott adds “over 6,000 different apps.” The New York Times names Canva and DocuSign in that pile, and purchases through Stripe’s Link or Shopify’s Shop Pay, each purchase needing approval. Those are connectors. A connector is not a SOC 2 report. If your brief depends on a mailbox Duet is not allowed to see, the brief is empty.
Availability is narrower than the marketing sentence. Anthropic: research preview by waitlist today, starting with US Pro and Max subscribers. Standalone app on iOS and Android, and on claude.ai. Separate from the main Claude app for now. CNBC: eligible users get it through that app or the website. No extra cost beyond the subscription, the Times says. “No extra cost” is not “unlimited.” Anthropic is explicit that Duet shares your plan’s usage limits and uses them differently than a typical conversation. Background checks count. Building a financial model or a deck takes more model turns and more background work. If you are already near the cap on chat, Duet is how you hit it in your sleep.
Anthropic’s own caveats, which belong in the same paragraph as the waitlist: this is an early version; it might misread a thread or miscalibrate what is urgent; core functionality is work, so personal errands such as booking tickets are not as strong; it cannot yet show you its browser. CNBC quotes the misread-a-thread line. Believe the vendor when the vendor undersells. If your job is restaurant reservations, you are in Muse’s pitch, not this one. Meta’s Muse, CNBC says, launched last month and went to the top of Apple’s App Store. OpenAI introduced dots at its developer conference weeks later. Thurrott also lists Gemini Spark and Microsoft Autopilot. Timing, Thurrott writes, suggests Anthropic was late. Late is not a security review.
Show-the-plan is not a refund policy
The Times: Anthropic said Duet would show users exactly what it planned to do before sending a message or making a payment. Some actions, like trading stocks or moving money between accounts, are blocked even with a user’s approval. A new filter is meant to keep the agent from sharing credit card numbers or government ID numbers. That is a product constraint. It is not OpenCode’s incident response.
If Duet is on a waitlist, you do not have those guardrails yet. You have a form. Do not write an internal policy as if the filter is already sitting on every laptop in the company. US-only preview. Pro and Max. Waitlist. The rest of the world is still in the main Claude app, which is the app Anthropic just told you Duet does not live in.
Instinct, in the Times’s competitor list, raised $1 billion in its latest round. That is someone else’s cap table. It does not move Opus 5.5. Leave it.
We already learned Aoki wanted .claude.json, not the model. Duet’s interesting file is not a JSON blob on disk. It is whichever OAuth grants you click to fill the morning brief. Grant the mailbox, you grant the brief. Grant Stripe, you grant the purchase flow that still needs a tap. Revoke is the skill that matters when the preview ends.
1.4 percent is Console users, not “OpenCode is fine”
TechCrunch, Saturday October 19: OpenCode, an open-source coding agent people treat as an alternative to Claude Code and Cursor, said attackers broke into an older system overnight. Affected: 1.4 percent of users of its online platform, OpenCode Console, where some users store API keys. Overnight, developers posted spend alerts on Reddit and X. One wrote that OpenAI, Anthropic, and Google spend alerts all fired before bed. Other users reported hundreds of dollars; a few described totals above $1,000.
The breach landed the same night OpenCode made GLM-5.3-Flash free. TechCrunch notes the broader GLM-5.3 family’s cybersecurity capabilities had been compared, by researchers, to levels associated with restricted models such as Anthropic’s Claude Mythos Preview. That comparison is color. It is not a root cause. OpenCode has not detailed how attackers got into the older system, how keys were stored, or the full extent of misuse. It told affected users to revoke and replace keys directly with each provider. The company said the incident remains ongoing.
Anthropic and Google blocked the API keys they believed were exposed. OpenAI said it worked with OpenCode to restore access and refund its API customers for credits used in the attack. OpenCode said refunds for unauthorized charges are underway. Three vendors, three postures. Blocking is not a refund. A refund is not a new key. If your key was in Console, you do all three: confirm the block, confirm the refund, mint a key that never goes back into Console.
1.4 percent is the Console slice OpenCode named. It is not 1.4 percent of every OpenCode GitHub clone running locally. If you never stored a key in Console, this story is still a warning about the next dashboard that offers to hold Anthropic, OpenAI, and Google keys in one place. If you did store them there, the waitlist for Duet is a separate product. Do not put the replacement key in a “proactive agent” on day one of a preview.
A waitlist does not rotate the leaked key
Duet’s pitch is background work. OpenCode’s failure mode this week was background spend. Those rhyme. They are not the same system. Duet is Anthropic-hosted, usage billed against Pro/Max, purchases gated, money-movement blocked. OpenCode Console was a place some developers left provider keys. If your threat model is “the agent might email a client,” you are in the Times’s show-the-plan paragraph. If your threat model is “someone ran my Anthropic key until the alert fired,” you are in TechCrunch, and joining Duet’s waitlist does nothing for the old key.
Rotate first. Then decide whether a morning brief is worth sharing the mailbox. Anthropic already told you Duet might misread a thread. OpenCode already told you a console can be an older system. Believe both, on the same desk, without averaging them into a vibe about “agents.”
Background checks count against the same cap
Anthropic’s preview note is the billing paragraph most launch posts bury. Duet shares Pro and Max usage limits with chat, Projects, and whatever else you already run. Background checks count. Larger tasks need more model turns. If your team is used to leaving Claude running in a tab, Duet is another consumer on the same meter, and it runs when you are not looking. That is the product. It is also how a “no extra fee” preview becomes an empty chat window on Thursday.
The standalone app is a second login surface. iOS, Android, claude.ai, not the main Claude app. Until Anthropic says the two share session grants, treat OAuth on Duet as a new grant. A mailbox you connected to Claude last month is not automatically in the morning brief. Clicking Connect on Duet is a new decision. Write it down in the same place you write “no production keys in previews.”
NYT’s blocked actions belong on that same list. Trading stocks: blocked even with approval. Moving money between accounts: blocked even with approval. Sharing credit card numbers or government IDs: filtered. Purchases via Link or Shop Pay: allowed with a tap. If your small business wanted Duet to pay a contractor, you are in the blocked bucket or the tap bucket depending on the rail. Do not demo “it can do payments” without naming Stripe Link versus a wire. The wire is not in the post.
CNBC’s competitive frame is workplace versus consumer. Muse and dots can be pitched as everyday. Duet, Anthropic says, is weaker on tickets and reservations and cannot show its browser yet. If a VP asks why you would not just use Muse because it hit the App Store, the answer is not “Anthropic is safer” as a slogan. The answer is: this preview is Pro/Max, US, waitlist, work-shaped, usage-shared, no browser view. Muse’s ranking is a different store.
OpenCode’s missing details are the other checklist. How attackers entered the older system: not published. How keys were stored: not published. Full extent of misuse: not published. Incident: ongoing. “Refunds underway” is not “keys rotated in our org.” If your developers used Console as a convenience vault for three providers, you now have three revocation UIs and one vendor who cannot tell you how the vault was built. That is the cost of a dashboard that holds Anthropic, OpenAI, and Google keys next to a free-model promo night.
Do not store the replacement keys in Duet either. Duet is not a secrets manager. It is an agent that will keep working when you step away. Stepping away is exactly when a leaked key spends. Different products. Same desk rule: keys stay in the provider console or a vault you audit. Morning briefs can wait until the old key is dead.