Claude Duet vs Meta Muse vs OpenAI Dots: Access, Costs and Control

01 / The story

How do Claude Duet, Muse and Dots compare?

These are three verified agent products, not three names for the same assistant. Anthropic announced Duet on October 21, 2026; Meta announced Muse on September 8; OpenAI’s announcement is dated September 29. We opened the Duet and Muse announcements. OpenAI’s launch page was available through indexed primary-source text, while its current product and help pages were opened separately. [1] [4] [7] [8] [9]

Their common idea is ongoing work: an agent can keep context, use permitted tools and continue a task without requiring a new prompt for every step. The meaningful differences are who can join, where work runs, what the user can inspect and how permission is handled. They are not independently proven replacements for human oversight.

Our existing Duet explainer covers the launch and basic workflows. This comparison instead focuses on access, cost, control and memory, including Anthropic’s October 23 security disclosure. We did not connect accounts or run a head-to-head trial. [3]

02 / The story

Key takeaways

• Duet’s research preview requires an invited US Claude Pro or Max account; buying a plan does not guarantee entry.
• Muse’s personal and business offerings should not be confused; its opened business announcement establishes US and Canada availability.
• Dots eligibility differs between personal Pro and workspaces; personal Pro access excludes the EEA, Switzerland and UK.
• Duet’s browser cannot currently be watched or taken over; Muse and Dots document ways to intervene in their cloud environments.
• Permission rules and retained memory differ, so “always-on” is not a sufficient buying criterion.

03 / The story

Who can actually access each agent?

As checked October 25, Duet’s research preview is limited to invited US Claude Pro and Max users. Team and Enterprise are not included. The waitlist distributes invitations in waves; neither a subscription nor an application establishes when access will arrive. [2]

Meta’s sources distinguish a personal agent from its small-business offering. The opened small-business announcement establishes availability in the US and Canada. Do not extend that statement into a universal country list for every Muse product, and check the specific offering before choosing it. [4] [5]

OpenAI’s current guide says personal Pro rollout is for adults outside the EEA, Switzerland and UK. Business Premium follows different supported-region and workspace eligibility conditions; Enterprise beta requires administrator enablement. An organization’s access should not be inferred from a personal-plan rule or vice versa. [9]

04 / The story

Does always-on mean continuous monitoring?

No. It is a broad description of persistent or background work, not a measured promise to inspect every source every second. Anthropic explicitly says Duet checks connected accounts every few hours to conserve usage. A message arriving after a check may not be surfaced until a later one. [1]

Meta describes a dedicated cloud computer with background tasks and subagents, while OpenAI describes ongoing project work and proactive research. Those descriptions do not establish identical polling schedules, response times or task success rates. The work remains limited by configured permissions, usage and product behavior. [4] [8] [10]

Do not use a general agent as an emergency alerting or deadline-monitoring system without independently establishing its suitability. For routine preparation, a delay may be acceptable. For payroll, customer commitments or urgent security events, missing an event can have a different consequence. This is a workflow judgment, not an untested speed ranking.

05 / The story

Where does each agent work, and what can you inspect?

Duet works in a cloud computer and browser, so the user’s laptop need not remain on. Its current Help Center guide says users cannot watch or take over that browser and it cannot see files on their computer. Task visibility is not the same thing as direct browser control. [1] [2]

Muse’s product page describes a dedicated Linux cloud environment and a browser shared with the user, who can intervene. That supports cloud-browser visibility, not an inference that Muse automatically reads a local device. A cloud computer and the computer on your desk are separate access boundaries. [6]

Dots also has its own cloud computer, which the current guide says users can view and interact with. It documents optional local-computer access, initially off. Giving an agent that additional access changes the data and action boundary; it should be a deliberate decision rather than a default assumption. [8] [9]

For any agent, inspect the actual record that matters: a sent message, edited document, calendar entry or changed account setting. A clear activity view is useful, but a completion summary is not proof that the right thing happened.

06 / The story

Which actions need approval?

Duet is designed to request approval for consequential actions, and some actions remain prohibited even with approval. Anthropic’s October 23 security explanation adds an important distinction: an explicit user request can count as consent for some information sharing. Do not assume every outbound step always requires a fresh approval tap. [2] [3]

Meta describes an independent Sentinel system controlling actions outside the agent’s environment. Its business announcement says nothing publishes, sends or spends without approval. These are company-stated boundaries, not results from Qlauson testing whether every possible action is blocked correctly. [4] [5]

Dots uses configurable Rules and additional Auto-review checks. The guide describes permissions that can allow or pre-approve actions, require confirmation or hand control to the user. Its policy is therefore not identical to Duet’s, even when both mention human review. [8] [9]

The safest practical comparison is action-specific: what is being sent or changed, to whom, using which permission, and can it be undone? Compare those boundaries rather than counting approval screens. For higher-impact tasks, our financial approval guide explains why authorization must match the exact action.

07 / The story

Why is Dots’ proactive research narrower than its action tools?

OpenAI’s safety FAQ says proactive research can read allowed sources and save private notes, but cannot directly send messages, change connected content or control a browser or computer. Follow-up actions have a separate permission framework. That distinction prevents two opposite errors: calling all Dots work read-only or assuming proactive research itself can perform every action. [10]

A private note about a customer email is not the same as replying to that customer. Preparing a suggested calendar change is not making the change. Ask which mode is operating and which policy will apply if a suggestion becomes an action. [9] [10]

This separation is useful beyond Dots. A well-defined preparation step can reduce risk, while the transition to external action still needs explicit responsibility. An agent’s helpful suggestion should not silently become an instruction to spend, publish or disclose information.

08 / The story

How much does access cost, and what usage is included?

Duet is included at no extra charge during its eligible Pro/Max preview, but background checks and briefs consume shared Claude usage. The opened pricing page lists Pro at $20 monthly or $200 annually and Max starting at $100 monthly, before applicable taxes. These are prices checked October 25, 2026; terms may change or vary by billing and region. Purchasing a plan does not guarantee a preview invitation. [2] [11]

Meta confirms basic free use and paid subscriptions. Exact current paid prices and caps were not established from the opened primary sources, so we omit dollar figures rather than substituting an older report or guess. Check the actual product checkout and limits before committing. [4]

OpenAI says the first dot is included with eligible Pro or Business Premium plans at no extra charge, with an allowance for deeper work. Its current Pro guide lists $100, $200 and $500 monthly USD tiers. These are dated plan prices, not a claim that every account or workspace receives the same allowance; tax, billing and rollout conditions must be checked. [9] [12]

“Included” and “unlimited” are different claims. A system working in the background can consume usage while the user is not actively chatting. Compare how usage is measured, when it resets and what happens when it is exhausted—not just the subscription headline.

09 / The story

Which security claims are documented, and what remains unproven?

Anthropic’s newer security article describes isolation between browser and agent compute, credential handling outside the agent, external action checks and sensitive-information classification. It acknowledges missed detections and false positives. Credential isolation does not mean the system processes no sensitive data, and a classifier is not a guarantee against every mistaken disclosure. [3]

Meta describes credential isolation, Sentinel controls, an audit trail and a training opt-out, and says VM conversations and data are excluded from Meta advertising systems. Its launch source describes Confidential VM as forthcoming; we do not treat that announced protection as universally delivered. These are vendor disclosures, not an independent security comparison. [4]

OpenAI describes rules, review layers and separate restrictions for proactive research. These mechanisms should be evaluated against the actual setup and connected services. We did not perform red-team, privacy or penetration tests for any of these products. [9] [10]

Prompt injection remains a shared risk: hostile instructions in a page, message or document can try to redirect an agent. Other mistakes need no attacker at all, such as choosing the wrong recipient or misunderstanding a thread. Limit permissions and review consequential outcomes rather than expecting one brand name to solve these categories of error.

010 / The story

Does disconnecting an app erase remembered information?

Not necessarily. Duet’s documentation says disconnecting stops new access but previously learned information can remain until memory is reset. Dots’ guide also separates app disconnection from deleting acquired information and points to reset or deletion for saved information. [2] [3] [9]

This matters when a project ends or someone accidentally connects the wrong account. Removing the connection may stop future reads without clearing earlier notes or context. Review both the access setting and the memory/deletion controls, and check the current terms before assuming a particular retention period.

We do not fill Muse’s retention details with another product’s behavior. For any organization, ask separately about deletion, backups, logs and applicable contractual requirements. A general product page is not automatically a complete data-processing agreement.

011 / The story

Which agent should you choose?

Start with availability. If your country, plan or workspace is not eligible, a strong feature list is not a usable option. Then pick a narrow task and decide whether cloud-browser control, optional local access or strict preparation-only behavior matters to it.

For an existing invited Claude user, Duet may fit periodic work-context preparation. Muse is worth investigating for its documented personal or business connections and shared cloud environment. Dots may fit eligible ChatGPT project workflows where its Rules and optional local access are useful. These are setup-based considerations, not verified quality rankings. [2] [5] [6] [9]

Do not assume Muse’s Wonder upgrade has reached every user: Meta’s October 12 announcement describes consumer rollout as coming soon, subscribers first. API or coding-product availability does not establish universal personal-agent rollout. [13]

Test the same reversible task, record errors and usage, and confirm the result in the connected service. That comparison will tell you more than an invented “best agent” score. The race is real, but the decision is about permissions, accountability and the work you can actually complete—not who has the broadest marketing label.