Personal agents launch in droves, most apps unwilling to open their entry points

On October 21, US time, Anthropic released a new product, Claude Duet. It is a standalone mobile app that can keep an eye on your email and calendar for you, chase unpaid bills, and, with your approval, place orders and make payments.

Claude Duet's launch landed at a very busy moment. Within just over a month, Meta, OpenAI, and Anthropic successively rolled out their own personal agents, and on the same day Claude Duet launched, Walmart also announced it would open a dedicated shopping channel for agents.

What can Claude Duet do for you?

First, what is an agent? With an ordinary chatbot, you ask a question and it answers. An agent breaks a task down into several steps on its own, calls on various tools, and gets the job done step by step.

What Claude Duet aims to be is an agent that comes to you proactively.

"It will proactively tell you which things need your attention. The tasks you assign, it will finish. If you walk away, it keeps going. Before it acts on your behalf, it asks you first."

For example, Claude Duet sends you a briefing every morning summarizing the most important items across the apps you've connected. After that, it checks these accounts every few hours (checking nonstop would use up your subscription quota too quickly) and only comes to you when something needs attention.

Every morning, Duet first pushes a briefing. The briefing lists the things to handle that day | Anthropic

It does its work on its own computer. Claude Duet runs on a virtual machine in the cloud—a virtual machine can be understood as a "virtual computer" carved out of a server—where it runs its own browser to do things. So even if you close the app and lock your phone, it can keep working and notify you when it's done or needs your confirmation.

Currently Claude Duet can call on more than 6,000 connectors and plugins in its plugin marketplace. Most of the examples cited at launch were everyday chores for small business owners, such as finding unpaid invoices in QuickBooks or Stripe, drafting payment reminder emails, preparing payroll in Gusto, and preparing contracts ready for signature with Docusign.

It can also shop for people. Payments go through Stripe's digital wallet Link or Shopify's Shop Pay. Each purchase generates a virtual card that can be used only once and becomes void after use.

Claude Duet is based on Anthropic's Opus 5.5 model, is available on iOS and Android, and can also be used on the claude.ai website. There is no extra charge during the preview period; it shares a quota with Claude's other features.

Anthropic also acknowledges that it is not yet good at complex personal chores like booking tickets, and that it is not perfect—it may misread a message or misjudge how important something is.

Claude Duet is not the first Personal Agent. You could even say it arrived late.

Meta's Muse was the earliest, launching in the US in mid-September. According to reports, market research firm Sensor Tower estimates that Muse had surpassed 5 million downloads by September 30, in under three weeks. ChatGPT took 56 days to reach that number. During setup, Muse asks to take over your Gmail and calendar. Installed on a Mac, it also asks to control the entire computer.

Muse also asks for your confirmation before placing an order | Meta

OpenAI's dots launched on September 29, using the GPT-6 Astra model. Each dot also has its own cloud computer and browser, and you can check what it's doing at any time. When you're not engaging with it, it proactively does research in the background, but during that time it only has read access to your apps—it cannot send messages or change anything. dots is currently available only to OpenAI's paid tiers such as Pro (starting at $100 per month), while Claude Duet is planned to be included in the $20-per-month Pro plan.

Each dot has its own cloud computer and browser | OpenAI

Other personal assistant apps with similar features include CUE, released by Manus just before the National Day holiday, and Today.ai by Qi Junyuan.

In fact, the product forms of personal assistants from various companies are basically similar. They all have their own computer in the cloud, they all proactively come to you, and they all want to take over your email, calendar, and wallet.

Every personal assistant asks for your opinion before acting.

Once the email is drafted, you're still the one who clicks "Send" | Anthropic

"Before sending messages, making payments, signing documents, or deleting anything, Claude Duet will show you exactly what it is about to do and wait for your approval. There are also a few things it won't do even with your approval, such as buying or selling securities or transferring money between accounts."

Claude Duet won't directly see your passwords and login tokens. When a website asks for a password, you enter it in a separate form on your own phone. The company says this design is meant to keep passwords out of your conversation with Claude Duet. There is also a dedicated classifier responsible for blocking the outbound transmission of the most sensitive information, such as credit card numbers and identity documents.

Another risk is called prompt injection, which refers to someone hiding a piece of text in an email or webpage, disguised as instructions to the AI, to induce it to do things its owner did not ask it to do. Claude Duet has to read a large number of emails and webpages sent by others every day, so this risk is naturally unavoidable. Claude Duet's principle for handling this is, "Treat anything it reads only as information, and act only on your instructions. But no defense is perfect, which is also one of the reasons important actions require your approval."

OpenAI's approach is similar. Users can set custom rules for dots, setting a certain action as allowed, requiring approval, or prohibited. For the most sensitive few things, OpenAI states in its help center that users must do them personally: for example, changing passwords, making transfers, and so on.

As e-commerce platforms that will frequently deal with personal assistants in the future, they also need to take into consideration the question of how many permissions to open up.

For example, Walmart plans to launch Agent Profiles next month. When a customer approves an agent to shop on Walmart, the system will create a separate profile for that agent; customers can require every purchase to be approved by them, or set a spending limit for it, such as 50, 100, or 200 dollars, and can revoke permissions at any time. The agent cannot obtain the customer's payment card information; you can think of it as adding an additional card to your own credit card.

Walmart creates a separate profile and sets a spending limit for each agent | Walmart

Layer upon layer of approval is safer, but also troublesome. Every step requires your nod, and the time the agent can save you is limited. OpenAI's approach is to allow you to pre-approve repetitive tasks, so you don't have to confirm every time.

Because I sent out an agent to work for me, my account got banned

Permissions on the user side are still negotiable; what's harder is whether those internet apps are willing to let agents in the door.

Amazon shut Meta's Muse out. On September 20, according to GeekWire, when users wanted to shop on Amazon through Muse, a prompt would pop up saying that unauthorized AI agents continuing to access violated Amazon's terms of use. Amazon said, "We think the reasoning is simple. If a third-party app is going to shop at other merchants on a customer's behalf, it should operate openly and respect the service provider's decision on whether it wants to participate."

The prompt that pops up when shopping on Amazon with Muse | Amazon

The situation is the same in China. Doubao Phone Assistant is a phone agent made by ByteDance in cooperation with Nubia. It relies on recognizing buttons and text on the screen, clicking, swiping, and typing like a human, to handle things across apps on your behalf; this approach is called screen automation. After the first-generation engineering prototype launched last December, Southern Metropolis Daily reported that some users had their accounts abnormally logged out after using it to operate WeChat, and were prompted to change devices and log in again.

More than 150 apps rejected Doubao's screen automation | Securities Times

This year, Doubao launched the Screen Automation Operation Declaration Protocol (SAEP), letting each app declare whether it allows or rejects it. According to Securities Times, when the 30-day public notice period ended on October 14, more than 150 apps had explicitly refused, and WeChat, Taobao, Alipay, Meituan, Xiaohongshu, China Merchants Bank, and even DeepSeek and Kimi were all on the list.

Xiaohongshu's restrictions on screen automation came earlier. According to Jiemian News, Xiaohongshu issued governance measures on March 10: ordinary accounts that occasionally use AI hosting to ghostwrite or post notes on their behalf will be handled according to the severity of the violation, and accounts that directly use AI hosting tools to register, publish, or interact will be banned.

Xiaohongshu's AI hosting governance measures introduced in March | Jiemian News

And I myself have stepped in this pit. Previously, I wanted to give my younger sister, who was about to enter college, a computer as a gift. I asked Baidu's companion DuMate to first search Xiaohongshu for highly liked recommendation posts and filter out ads. Then go to e-commerce platforms to help me pick a suitable model.

On Xiaohongshu, it only searched and browsed, and did not publish any content. As a result, not long after, my account was restricted from use: I could not post notes, post comments, send bullet comments, or send private messages or group chats, and traffic exposure and commercial rights were also restricted.

The reason given in the Xiaohongshu backend notification was "the account repeatedly used AI hosting for posting/interaction." The explanation below was broader: using third-party tools or scripts (such as AI) to automatically browse, view, or publish content to operate an account is within the scope of restrictions, and repeated violations or serious circumstances will lead to account bans. The notification also included this sentence: "The platform strictly prohibits any behavior that uses technical means to simulate real people and conduct non-authentic content creation or interaction."

I did not post a single note, yet the penalty notice said "posting/interaction." Under this rule, the agent searching on my behalf is no different from other automation scripts: as long as a machine is operating the account, it counts as a violation.

So what happens if Claude Duet enters someone else's website? "In its browser, Claude Duet will try its best to follow the rules each website sets for agents." Anthropic has not yet announced exactly how it will handle being blocked by a website; the company says it will release more security details in the coming days.

Muse has a sharing feature that can turn a conversation into a public web page that anyone with the link can view. The system embeds the chat title and a random ID into the domain name. Once someone opens the page, third-party DNS services can record the full domain name. Security company Claroc opened several hundred of them; most of the content was harmless, but there were also loan applications from small businesses, an internal revenue review a company wrote to its CEO, and a to-do list that included bank fraud alerts and some account numbers.

Claroc said it reported the issue to Meta through its bug bounty program on October 8. After media inquiries, Meta said it would suspend the sharing feature. Claroc rechecked 40 shared links on October 20, and none of them could be opened anymore, but the URLs carrying the conversation titles remain in passive DNS history.

Disconnecting does not delete what has already been seen. Claude Duet's help center notes that after disconnecting an app, it can no longer access it, but memories left in previous conversations will be retained. OpenAI's official documentation also states that disconnecting a plugin will not clear information that dot has already obtained.

Apps want to block them, agents want to get in; for now there are two paths.

One is to pretend to be more human. A company called PhoneUse rents real iPhones to agents. According to reports, these are retail iPhone 15 Pro units placed on racks in San Francisco, with a stylus tapping the screen and a camera above reading the display. Each phone has a real carrier SIM card and can receive SMS verification codes, for a monthly rent of $89.

Its official website says: "A retail phone with a real SIM card, tapped by a physical stylus, looks exactly like a real person. In the eyes of an app, it is a person."

The stylus on the rack taps a real phone | PhoneUse

However, this is all PhoneUse's own claim, and no media reports have been seen so far. What it sells happens to cross the red line explicitly prohibited in Xiaohongshu's notice: "using technical means to simulate real people."

The other path is to let apps recognize that it is an agent and then decide whether to let it through. Walmart's Agent Gateway, launched the same day, takes this path. Agents shop through the MCP protocol (MCP is a universal interface that lets AI call external tools and services), which is faster than simulating clicks on a web page. Walmart claims that agents that do not comply with the new terms will be blocked from the website.

Doubao's SAEP also first asks apps to declare their stance, and prioritizes protocols such as MCP and A2A when interacting with apps. Zhou Wei, vice president of vivo and dean of its Global AI Research Institute, said in an interview with Securities Times: "The mainstream model in the industry in the future will be protocols such as MCP and A2A. More than 90% of mainstream applications will adopt protocols such as MCP and A2A, and only the remaining long-tail applications may adopt the GUI model."

Omdia senior analyst Zhong Xiaolei is more conservative: "Overall, a consensus on technical interconnection is forming, but the battle over commercial profit distribution will continue."

Anthropic's published transparency report shows that from January to June 2026, it banned a total of 11.4 million accounts and received 398,000 appeals, of which 42,000 were ultimately overturned. By that calculation, fewer than one in ten appeals is overturned. Among the reasons for account bans listed in the Claude help center is "creating accounts from unsupported regions," and mainland China is not on Claude's list of supported regions.

For domestic users who are already afraid of having their accounts banned, handing over their email and wallet to it probably makes them even less confident.

Claude Duet cannot reach China for now. If that day really comes, besides me, it will first have to convince the pile of internet apps on my phone.

References

This article is from the WeChat public account "Guokr" (ID: Guokr42), author: Ben Yi, published by 36Kr with authorization.