Always-On Agents Arrive: Claude Duet, Muse Wonder, and Perplexity Teammates

Proactive agents are moving from demos into daily work—but availability, approval gates, and privacy design still define what you can trust in production.

Chatbots wait for a prompt. Always-on agents watch connected tools, keep working after you close the laptop, and interrupt only when judgment—or policy—says you should decide. In October and early November 2026, that pattern crossed from research blogs into named products: Meta’s Muse Wonder models for personal and professional agents, Anthropic’s Claude Duet research preview, and Perplexity’s Teammates for ongoing project ownership. The common story is not a feature checklist. It is a governance story: what is generally available versus waitlisted, who approves irreversible actions, how credentials and sensitive data are handled, and where usage limits quietly throttle “always on.”

This article maps those shared design choices. For the related problem of agents that drive desktops and browsers in enterprise settings, see our earlier piece Computer-Use Agents Enter Production: What Actually Works in the Enterprise.

What “always-on” actually changes

Reactive assistants answer when asked. Proactive agents add three habits that change the risk surface:

1. Background continuity — work continues on a virtual machine or cloud desktop while the user’s device sleeps.
2. Monitoring loops — periodic checks of email, calendars, tickets, or campaigns, not only one-shot tasks.
3. Interrupt discipline — the product must decide when silence is correct and when a notification is worth burning attention (and plan quota).

Those habits collide with enterprise reality. An agent that reads Gmail and drafts Slack replies is constantly routing information. An agent that can post a job, run payroll prep, or pay with a virtual card needs hard stops. The products below advertise different maturity levels; buyers should treat marketing adjectives as secondary to access status, approval gates, and privacy architecture.

Availability: separate the generally available from the preview

Muse Wonder — model availability first, product rollout next

Meta Research’s 12 October 2026 post introduces the Muse Wonder series (Muse Wonder and Muse Wonder Full) as frontier models aimed at personal and professional agentic work. According to Meta, Muse Wonder is available through the Meta Model API and Muse Code; Muse Wonder Full is available for Muse Code subscribers. The same post says Muse Wonder will soon power experiences in Muse, rolling out first to subscribers, and will also power higher-intelligence artifact generation—language that is forward-looking, not a claim of universal consumer GA for every Muse surface on day one.

Capability framing centers on Active Memory (carrying and retrieving user-relevant context across conversations) and Active Focus (sustained effort toward a goal, with clarification and check-ins before important actions). Meta also stresses alignment for agents that may see messages, calendars, and private documents, and says Muse Wonder offers its strongest safeguards to date against CBRN and cyber misuse while preserving defensive cyber access under Meta’s Superintelligence Scaling Framework. A fuller safety report is described as forthcoming—so enterprise reviewers should treat current safety claims as vendor summary pending that report.

Separately, CNBC’s coverage of Anthropic’s Duet preview notes competitive pressure from Meta’s Muse consumer agent and OpenAI’s “dots” always-on agents, and reports Meta’s CEO telling analysts that more than 10 million people in the U.S. and Canada had set up Muse personal agents over roughly the prior month and a half. That is adoption context for the Muse product, not a substitute for Meta’s own Muse Wonder availability language.

Claude Duet — research preview, waitlist, US Pro/Max/Ultra

Anthropic’s 23 October 2026 article opens a research preview of Claude Duet: a proactive agent app that brings attention items to the user, completes assigned tasks, keeps working when the user steps away, and checks before acting on the user’s behalf. Access is waitlisted, starting with US Pro, Max, and Ultra subscribers; Duet is included in those plans and shares the plan’s usage limits with the rest of Claude. It ships as a standalone iOS/Android app and on claude.ai, currently separate from the main Claude app.

Anthropic is explicit about early-stage limits: Duet may misread a thread or miscalibrate urgency; core functionality is centered on work, so personal errands (for example booking tickets) are “not quite as strong”; and it cannot yet show its browser. Background checks run every few hours rather than continuously, because nonstop checking would exhaust plan limits faster. Larger tasks consume more model turns. CNBC’s 21 October piece (previewing the same launch window) similarly stresses the waitlist and workplace focus; prefer Anthropic’s post for plan eligibility (including Ultra) and product caveats.

Perplexity Teammates — launched for Max, ongoing ownership

Perplexity’s product blog describes Teammates as personal agents for complex, ongoing work: they plan and coordinate projects, monitor connected tools, follow through as conditions change, retain memory across runs, and bring completed work back for review. Teammates build on Perplexity Computer (tools, files, Projects, skills) and can orchestrate additional agents, including passing work between teammates and collaborating via Slack. Perplexity positions the launch for individual Max subscribers on web (with mobile noted as forthcoming in secondary coverage). Help-center material aligned with the launch emphasizes multi-agent orchestration, per-teammate desktop/browser environments, proactive monitoring of connectors such as Slack, GitHub, and Linear, and user ability to review work, take over the desktop, or redirect a teammate mid-flight.

Bottom line on status: Muse Wonder models are API/Code-available with Muse product integration still rolling out; Claude Duet is a research preview behind a waitlist; Perplexity Teammates are generally launched for the Max tier as described by Perplexity—not a free default for every Perplexity plan.

Approval gates: the shared safety pattern

Across vendors, irreversible or externally visible actions are supposed to stop for humans.

Anthropic describes Duet as reading, drafting, and preparing work on its own, but showing exactly what it will do and waiting for approval before sending a message, making a payment, signing a document, or deleting anything. Some actions remain off-limits even with approval (Anthropic cites trading securities or moving money between accounts). Purchases via Stripe Link use confirmation plus a virtual card so the real card number is not shared; Shop Pay is supported; 1Password-assisted sign-in is described as coming soon with permission. Actions are also filtered by Anthropic’s auto mode classifier—the same family of safeguard used for Claude and Claude Code.

Perplexity’s Teammates framing similarly returns completed work and approval requests for follow-through (for example preparing outreach or offers after investigating a stalled customer), and stresses that users can inspect and guide work along the way. Separate environments per teammate, encrypted credential entry, and Project-scoped permissions are part of the control story in Perplexity’s materials.

Meta’s Muse Wonder post emphasizes that Active Focus includes asking for clarification and checking in before important actions—less a UI checklist than a model-behavior claim, but directionally the same pattern: proactivity without unilateral high-impact acts.

For enterprises, the operational test is boring and essential: can you enumerate which action classes auto-run, which require click-through approval, which are hard-blocked, and where those rules live (model policy, product classifier, or admin console)?

Privacy, credentials, and sensitive data

Always-on agents fail closed only if credential handling and data egress are designed that way.

Anthropic states that Duet’s credential handling follows Claude Managed Agents design so the agent never directly sees passwords or sign-in tokens; prompt-injection defenses draw on browser-use research; red teams and an external firm penetration-tested Duet; and it sits under Anthropic’s public bug bounty. A dedicated classifier and safety system prompt check messages against sensitive-information leaks: the strictest tier (including credit card numbers and government identification) is rejected; health or personal finance details pass only when the user has explicitly instructed Duet to send them.

Meta frames Muse Wonder as needing discretion with private information and robustness to adversarial instructions—again, with a fuller evaluation report still promised.

Perplexity describes saved credentials as encrypted and entered securely, with teammate browser sessions isolated from one another.

None of these claims remove the buyer’s duty to map which connectors are enabled, where transcripts live, and how long background monitoring retains content. “Shares plan usage limits” (Duet) and “Max-only” (Teammates) are also privacy-adjacent: aggressive monitoring burns quota, which pressure-tests how often vendors will let agents poll.

A practical privacy review for always-on agents looks less like a model scorecard and more like a data-flow diagram. List every connector; mark whether the agent can read, draft, send, or administer; note whether memory is account-global or project-scoped; and record whether human operators can audit a single run after the fact. If the vendor cannot answer those four questions in writing, the product is not ready for regulated inboxes—regardless of how polished the morning brief feels.

Preview limits buyers should budget for

Research previews and early Max launches share predictable constraints:

• Quota coupling — background loops consume the same budget as chat (explicit for Duet; implicit wherever Computer/Teammate runs are metered).
• Judgment calibration — Anthropic warns Duet may misread urgency; Meta and Perplexity both stress check-ins and review rather than silent autonomy.
• Surface gaps — Duet cannot yet show its browser; Muse Wonder’s consumer Muse integration is still rolling out; Teammates’ depth depends on Computer connectors and Project setup.
• Audience fit — Duet is positioned for professionals and small businesses; Muse Wonder spans personal and professional agents; Teammates target ongoing business functions (marketing, sales, ops, and similar examples in Perplexity’s launch narrative).

Decision criteria (evergreen)

1. Label the SKU. Model API access ≠ consumer agent GA ≠ research preview.
2. List approval classes. Send, pay, sign, delete, post publicly—default deny unless documented.
3. Trace credentials. Prefer designs where the agent never holds raw passwords; require virtual cards for spend.
4. Cap monitoring. Set which inboxes and repos an agent may watch; measure quota burn in week one.
5. Pilot with reversible work. Prefer draft-only and internal artifacts before any customer-facing send or payment path.
6. Demand an exit. Disconnect connectors; export memory/artifacts; rotate any tokens the agent used.
7. Evaluate computer-use separately. Desktop/browser control is a different failure mode—see Computer-Use Agents Enter Production.

Organizations that skip the reversible-work pilot tend to discover approval UX gaps the hard way: an agent that is excellent at drafting invoices is still a liability if “send reminder” sits one mis-tap from “mark invoice paid” in the same thread.

Bottom line

Always-on agents are no longer a single demo genre. Muse Wonder ships as Meta’s agent-oriented frontier models with Muse product integration arriving in phases; Claude Duet is an Anthropic research preview built around morning briefs, background work, and explicit approvals; Perplexity Teammates launch ongoing, multi-agent ownership for Max users inside Computer. The competitive week CNBC described—Muse traction, OpenAI dots, Anthropic’s counter—matters less than whether your deployment can prove who approved what, what the agent could see, and what remains unavailable outside preview. Treat proactivity as a privilege gated by policy, not as a default.

Related reading

• Computer-Use Agents Enter Production: What Actually Works in the Enterprise
• From Chatbots to Work OS
• From Chat Box to Living Interface: Voice, Avatars, and Generative Spaces

Images: original illustrations generated for AndBeyond.Tech; no logos or real people depicted.