Claude Now Works Before You Ask. What Can It Touch?

Today, we're diving into:

Claude Now Works Before You Ask. What Can It Touch?

For three years, enterprise AI has waited politely for someone to type. Anthropic's newest agent does not wait.

On October 21, Anthropic launched Claude Duet as a research preview for US Pro and Max subscribers. It sends you a morning brief, checks your connected apps every few hours, and messages you when something needs a decision. It works with more than 6,000 connectors and plugins, from Gmail and Slack to QuickBooks, Stripe and DocuSign.

Your Next Agent Will Read Everything You Connect.

Find out which of your systems an always-on agent could reach, and whether the data behind them is ready for it.

From Chat Window To Chief Of Staff

Duet runs on Opus 5.5 inside its own cloud virtual machine, complete with a browser. You hand it work by voice or text, and it keeps going after you close the app.

The examples Anthropic chose are revealing. Finding unpaid invoices and drafting reminders. Preparing payroll for review. Getting contracts ready to send. Building dashboards, forecasts and even web apps.

The Guardrails Anthropic Built In

Duet asks for approval before it sends a message, makes a payment, signs a document or deletes a file. According to Inc42, trading securities and moving money between accounts are blocked even with approval, and passwords and sign-in tokens are kept out of the agent's direct view.

Anthropic is also candid about the limits. It says Duet may misread a thread, misjudge what is urgent, or miss something that arrives between check-ins. And it is not alone: MacRumors positions Duet as a rival to OpenAI's Dots and Meta's Muse, which chase the same always-on idea.

The Real Question Is Not What It Can Do

Duet is not on Team or Enterprise plans yet, so most leaders will file this under consumer news. That is the wrong reaction.

Picture a sales director on a personal Pro plan who connects her work inbox, the shared drive and the CRM on a Sunday evening. By Monday morning, an agent your IT team never reviewed has read your pipeline, your pricing threads and a draft contract.

Approval prompts protect the final click. They do not decide what the agent reads on the way there. An agent that works from an outdated discount policy, or pulls a customer file it should never have seen, has done the damage before any approval screen appears.

What You Should Do Before It Reaches Your Team

The better alternative is to decide what an agent may know before you decide what it may do.

Building that boundary starts with trusted enterprise context. DataManagement.AI helps organizations create that foundation by unifying metadata, lineage, governance, business glossaries and knowledge assets into a single intelligence layer. It automatically discovers metadata, maps lineage across the modern data stack and identifies downstream dependencies, so you know which data is sensitive, who owns it and which agents should ever be allowed to read it.

The Tool Holding Your AI Keys Just Got Backdoored. Again.

If your developers call more than one AI model, there is a good chance LiteLLM sits in the middle. It is a gateway that lets apps reach OpenAI, Anthropic, Azure and other providers through one interface, and it often stores the keys for all of them.

On October 21, LiteLLM confirmed that its release pipeline was compromised and that version 1.107.0 went out to PyPI and Docker registries carrying malware that steals credentials and loads remote-code execution tools. Chainguard calls it the second LiteLLM compromise in seven months.

Two Hours Was Enough

By LiteLLM's own timeline, the poisoned package was live on PyPI for about 1 hour 43 minutes, and on Docker Hub for about 2 hours 33 minutes, including the latest tag. Chainguard counts more than 100 million PyPI downloads in the last month and over 2,000 packages that depend on LiteLLM, so plenty of teams run it without ever choosing it.

According to Wiz, the malware went after:

Wiz says the attacker started testing stolen AWS credentials about 4.5 hours after the data left, from CI runners and Kubernetes nodes in multiple environments.

The Source Code Was Clean

Here is the detail that should worry you most. The official v1.107.0 code on GitHub did not contain the malware. It was added at build time, after three engineers' GitHub accounts, apparently through stolen CLI tokens, were used to change, run and approve the release workflow.

Why This Is Bigger Than One Package

Most leaders will treat this as an engineering cleanup. That is the wrong reaction.

An AI gateway is the one place where every model key and provider account meets. That makes it the most valuable target in your AI stack, yet it is often installed by one team, updated automatically and owned by nobody in particular.

The better alternative is to run AI infrastructure the way you run payments infrastructure: inventoried, owned, monitored and rehearsed.

Google And Amazon Just Made Leaving Nvidia A One-Line Change

For years, one of the biggest costs in AI never showed up as a line item. Your models were written in PyTorch, and PyTorch ran best on Nvidia.

This week, two of the largest cloud providers went after that lock-in within a day of each other. Amazon released TorchNeuron, an open-source PyTorch backend for its Trainium chips. On October 20, Google open-sourced TorchTPU, which it says moves PyTorch apps to its TPUs with "a simple configuration change and no rewriting of their apps."

Why PyTorch Is The Battleground

PyTorch is the toolkit most teams use to build, train and run models. By some accounts, TechCrunch notes, it sits under 85% of AI apps. Whoever runs PyTorch best wins the workloads.

Amazon says moving a model to Trainium takes a one-line device change, and it is pushing code into the main PyTorch project to decouple features from Nvidia's chips. Google is shipping a TPU agent suite to help developers migrate apps and fix errors along the way.

The Number That Matters

Voice AI company Deepgram says that in its own benchmarks, Trainium processes about 60% more input audio seconds per dollar than its existing GPU baseline. That is one customer on one workload. It is also exactly the kind of number your finance team should be asking for.

Read The Fine Print

Portability is not finished. Amazon's own test report shows roughly 22,000 upstream PyTorch tests skipped because operators do not have native support yet, and features such as sparse tensors and dynamic shapes are left out of the first release. TechCrunch also expects developers will not abandon Nvidia en masse.

The Wrong Reaction Is A Hardware Migration

Cheaper chips tempt teams to plan a big move. That is the wrong reaction. The better alternative is to make portability a standing capability, then move one workload at a time when the numbers say so.

Know Your Inference (KYI) is becoming a core enterprise capability. By understanding how every inference affects cost, latency, accuracy and governance, you can see what each workload really costs on each chip, and move it when the evidence says so, not when a vendor's sales cycle does.

Your opinion matters!

Hope you loved reading our piece of newsletter as much as we had fun writing it.

Share your experience and feedback with us below 'cause we take your critique very critically.

Thank you for reading

-Shen & Towards AGI team