Claude Duet Launches: Proactive Agents Take Their First Step, with Approval Cards as the Key Constraint

From "You Ask, I Answer" to "It Speaks First": Claude Duet's Proactive Interaction Logic

According to a video shared on Bilibili, Anthropic has released Claude Duet, a research preview app whose core change lies in a shift in interaction mode—Claude no longer merely responds passively but proactively initiates conversations. Specifically, every morning it pushes a briefing of key items to the user; users can assign tasks via voice modulation; and after the user puts down the phone, Claude continues working. This attempt at a "proactive agent" marks a shift in conversational AI from a tool attribute toward an agentic one.

From a product design perspective, proactive briefing pushes are a low-risk, high-perceptibility entry point. They involve no sensitive operations yet effectively cultivate users' acceptance of "AI reaching out proactively." The voice modulation interaction hints at contextual considerations—users may need to quickly issue instructions in different environments, and modulation processing may serve to distinguish instructions from ordinary conversation or to adapt to specific hardware.

Proactive Agent is defined in contrast to traditional "reactive AI." Reactive systems trigger computation only after user input, whereas proactive agents possess the ability to autonomously initiate tasks, perceive environmental changes, and decide when to act without external prompts. This shift requires the system architecture to have persistent memory, task scheduling, and goal management modules, while also resolving the judgment problem of "when to proactively intervene"—being overly proactive becomes an intrusion, while being insufficiently proactive loses the value of agency. The industry generally regards proactive agents as a key watershed from "tool" to "agent," with challenges not only in model capability but also in permission boundaries and the engineering design of user trust.

The Approval Card Mechanism: The Proactive Agent's "First Rein"

When AI shifts from passive answering to proactive execution, permission boundaries become an unavoidable issue. Claude Duet's solution is to introduce "approval cards": operations such as sending messages, making payments, and deleting must be confirmed by the user on an approval card. According to the video description, passwords and login tokens do not pass through the model, and payments use one-time virtual cards. This means sensitive credentials are isolated from the model's inference chain—even if the model is induced or errs, it cannot directly touch core assets.

This design approach is worth unpacking. First, the approval card is essentially a hard "human-in-the-loop" checkpoint that strips irreversible operations from the model's autonomous decision-making. Second, tokens not passing through the model and payments using one-time virtual cards constitute defense in depth—even if the approval card is bypassed, the credentials themselves carry no lasting harm. For proactive agents, such constraints are not optional but a precondition for user trust.

Human-in-the-Loop (HITL) is a system design paradigm that embeds human judgment into automated processes. In agent scenarios, it manifests as mandatory manual confirmation at key decision nodes rather than letting the model complete everything end-to-end autonomously. The value of HITL lies in forming hard checkpoints for irreversible operations (such as payments and deletions), ensuring that even when the model misjudges or is attacked by adversarial prompts, a human gate remains. The cost is sacrificing some automation efficiency and fluidity, so the design difficulty lies in the granularity of checkpoints—too dense and users are frequently interrupted, too sparse and protection loses meaning. The approval card is precisely the concrete productized form of HITL in conversational agents.

Defense in Depth originates from the information security field, referring to deploying multiple complementary layers of security controls in a system so that if a single line of defense is breached, other layers still provide protection. The article's "tokens not passing through the model, payments using one-time virtual cards" embodies this idea: the approval card is the first layer, credential isolation is the second, and one-time virtual cards limit the scope of loss if payment credentials are stolen. For agents connected to external tools and payment capabilities, defense in depth is especially important because the model itself may be induced by prompt injection attacks; excluding sensitive assets from the model's inference chain can architecturally eliminate an entire class of risk rather than relying on the model's own judgment reliability.

Research Preview and Waitlist: Anthropic's Cautious Rollout

Claude Duet is currently available as a research preview to a waitlist of Pro and Max users in the United States. This pace indicates Anthropic's cautious attitude toward deploying proactive agents: first validate interaction modes and security mechanisms on a small scale, then consider expanding coverage. Combined with the approval card and credential isolation design, it is clear the product team deliberately maintains tension between "capability demonstration" and "risk control."

From an industry perspective, the competitive focus for proactive agents is shifting from "how smart the model is" to "how controllable the permissions are." Whoever can solidly implement approval, isolation, and traceability without sacrificing user experience is more likely to make users comfortable handing over more tasks. Claude Duet's approval card is a concrete attempt, but whether it can become a universal paradigm for proactive agents still depends on subsequent real-world usage feedback and security incident records.

The Next Step for Proactive Agents: Trust Is Harder to Build Than Capability

Proactive pushes, voice task assignment, continued background work—these capabilities themselves are not hard to imagine; what is hard is getting users to accept that "AI can act proactively." Approval cards address controllability at the operational level, but psychological trust takes much longer to build. Users need to observe: whether proactive briefings are accurate, whether approval cards are triggered too frequently, and whether background tasks are transparent and traceable.

Claude Duet's research preview positioning is reasonable. The first step for proactive agents is not to demonstrate the upper limit of capability but to prove that boundaries are reliable. The approval card is the "first rein," but how tight it is, its trigger frequency, and interaction cost will all determine whether users feel protected or disturbed. These issues will only surface in real-world use and are worth continued attention.

One-line Summary

Claude Duet lets AI speak first, building the trust boundary of proactive agents through approval cards and credential isolation.

Paragraph Summary

Anthropic has released Claude Duet, a research preview app whose core change is a shift in interaction mode from passive response to proactive initiation: daily briefings of key items, voice-modulated task assignment, and continued work after the phone is put down. The article notes that proactive pushes are a low-risk, high-perceptibility entry point, but what truly determines deployment is permission design—sending, payment, and deletion must be confirmed via approval cards, passwords and login tokens do not pass through the model, and payments use one-time virtual cards, forming a two-layer constraint of human-in-the-loop and defense in depth. Claude Duet is currently open only to a waitlist of Pro and Max users in the United States, with a cautious rollout. The article argues that the competitive focus for proactive agents is shifting from model capability to permission controllability and user trust; the approval card is the "first rein," and how tight it is and how often it triggers will determine whether users feel protected or disturbed.