Ben Okonkwo: Hey, you make it through the week okay? Because I've had this thing rattling around since Tuesday and I need to just — say it out loud.
Jonathan Ingles: You look like a man with a scenario. Go.
Ben Okonkwo: Picture this — freelance accountant, Tuesday morning, phone's on the kitchen counter, she picks it up at seven a.m. There's a message waiting from Claude Duet. It worked through the night — drafted three client emails, flagged a contract renewal — and now it's asking, quote, 'Do you want me to send this $4,200 payment to your vendor?' And she taps approve. Without reading it.
Jonathan Ingles: Without reading it.
Ben Okonkwo: Without reading it. And that's — I mean, that's not a bug in this system. That's the system working exactly as designed. Anthropic launched Claude Duet on October 21st of this year, built on Opus 5.5, and the core promise is that it runs on a dedicated cloud virtual machine — her phone was off all night, right, and the thing just kept going, kept working. Then it surfaces one sticky note in the morning: 'I'd like to spend $4,200 — yes or no?' That's the whole product.
Jonathan Ingles: And the question isn't whether she approved it. The question is whether she understood what she was approving.
Ben Okonkwo: That's exactly it. And that's what I want to pull apart — how that approval gate actually behaves when a real person is half-awake on a Tuesday.
Jonathan Ingles: Okay. Walk me through it.
Ben Okonkwo: And the data on that gate — it gets uncomfortable. Anthropic's own internal testing: users approve 97% of all prompts. Not 97% of the safe ones. All of them.
Jonathan Ingles: Ninety-seven. That's not a safety metric. That's a thumbs-up machine.
Ben Okonkwo: Right, but — okay, so it gets worse. On first review, dangerous commands are caught 13.6% of the time. Which is already low, right, but at least it's a number you can point to. After 50 prompts? That drops to 5%. The same user, same interface, just... tired. The gate doesn't break — the person walking through it stops looking at it.
Jonathan Ingles: So the accountant on day one has a 13.6% chance of catching something bad. By the end of week two she's at 5%.
Ben Okonkwo: Essentially. And here's what I didn't clock until I read Anthropic's safety post — October 23rd, two days after launch — they actually describe two separate classifiers. One auto-approves lower-risk actions. That logic was imported directly from Claude Code's auto mode.
Jonathan Ingles: Wait — imported from Claude Code. Whose auto mode is on by default.
Ben Okonkwo: On by default. So the second classifier — that one's supposed to block the hard stuff, credit card numbers, government IDs — it's doing real work. But the first one is already waving things through before a human ever sees them. And if the catch rate on what does surface is degrading to 5% after fifty taps, I mean — the math on what's actually getting stopped is not reassuring.
Jonathan Ingles: The crack in this isn't the AI. It's that Anthropic trained users to trust auto-execution with Claude Code, then built that exact muscle memory into Duet's approval flow. The gate looks like a safety feature. It's actually just — friction. And they already know users route around friction.
Ben Okonkwo: And they published a whole post explaining it. October 23rd. Which is — honestly, that's either transparency or it's a very careful paper trail. I'm not sure which yet.
Jonathan Ingles: That paper trail thing — that's actually where I want to push, because the line they drew isn't just about transparency. Payments need approval. Scheduling a meeting doesn't. Who decided that? That's not a technical finding. Someone on Karan Ahuja's team sat in a room and said, here's where human sign-off lives, and that line is not public.
Ben Okonkwo: Right — and that's the part that I think gets lost. It's framed as a safety architecture, but it's actually a product decision dressed in safety language. The classifier logic they used? Imported from Claude Code's auto-approve mode. So the infrastructure making those risk calls was built for a coding assistant, not for a system that's handling a small business's vendor payments.
Jonathan Ingles: Built for someone shipping code, not shipping money.
Ben Okonkwo: Exactly. And — okay, think about it this way. Say it's a florist. Thursday afternoon, she's wrist-deep in an arrangement, phone on the counter. Claude Duet pings: 'I've re-ordered your wholesale stock, $680 to the supplier.' That's below whatever threshold Ahuja's team decided counts as high-stakes. Auto-approved. She never sees it. Now, was that dangerous? Probably not. But the florist didn't draw that line. Anthropic did.
Jonathan Ingles: And the competitive context matters here. OpenAI had already shipped Dots — always-on, dedicated cloud computer, three weeks before Duet launched. So Anthropic is not building this line carefully. They're building it fast.
Ben Okonkwo: Meta's got Muse. Google's got its Gemini agent. I mean — Anthropic is fourth or fifth into a crowded room, and they're reusing Claude Code's classifier to do it. The line is wherever competitive pressure and existing infrastructure happened to agree.
Jonathan Ingles: That's a brutal framing. I don't think it's wrong.
Ben Okonkwo: Now, there's a version of this where the research preview label is doing real work — where Anthropic is genuinely iterating before the full rollout. And there's another version where — well, the S-1 exists, the $1 trillion valuation target exists, and what 'research preview' means in that context is something we should probably come back to.
Jonathan Ingles: Especially when it's sitting on a consumer app store with a waitlist open to Pro subscribers. That's not a lab.
Ben Okonkwo: Right — but the app store is the thing that breaks the clean version of this. Anthropic publicly said Claude Duet is for professionals, small business owners, not booking tickets, not consumer errands. That's the stated frame. And then it's on iOS. It's on Android. Waitlist open to any Pro subscriber. That's not professional targeting — that's mass distribution with a professional-sounding press release on top.
Jonathan Ingles: The policy claim and the technical gate are completely different things.
Ben Okonkwo: Completely different. And the S-1 — I mean, a $1 trillion valuation target is not a number you hit by keeping a product behind a real professional gate. That's a consumer scale number.
Jonathan Ingles: So the 'research preview' label. Is it humility or is it the most useful two words in AI liability law right now?
Ben Okonkwo: Honestly — and this is where I want to be careful, because I think it can be both simultaneously — the October 28th access expansion, Karan Ahuja announcing Max-plan invitations going out first, Pro access to follow, international still pending — that sequencing actually looks like real staged rollout. Someone is watching the data. But the fact that you're staged-rolling into the iOS App Store means the research is happening on real users with real money.
Jonathan Ingles: With real liability sitting entirely on those users.
Ben Okonkwo: Picture a freelance photographer — Saturday afternoon, she's mid-shoot, phone in her bag. Claude Duet's been running. It surfaces one approval request: 'Send deposit to equipment rental, $350.' She unlocks, taps yes, locks it again. That's the entire interaction. Now — is she a professional? Yes. Did she read it? Almost certainly not. And 'research preview' means Anthropic gets to iterate on that moment before the terms of service harden into something a court would call a warranty.
Jonathan Ingles: The research preview is the liability hedge. Genuinely. That's the crystallizing detail for me — not the 97%, not the classifier. It's that 'research preview' is doing legal work that 'product launch' cannot.
Ben Okonkwo: And the people most likely to approve without reading — the time-pressed small business owners Anthropic explicitly named — are holding all of it when the 5% gets through.
Jonathan Ingles: She's on her third week by then. The emails are mostly right. The briefings have been good. And the approve button — it doesn't feel like a decision anymore. It feels like acknowledging a notification.
Ben Okonkwo: That's the thing that sits with me. Claude Duet is running on a cloud VM with access to her apps, her calendar, her accounts — taking dozens of lower-stakes actions she never sees. The gate only surfaces for the highest tier. So by Tuesday fifteen, the one thing that does ask for her attention lands in a context where she's already been trained — by the product — that everything is fine. Anthropic built the gate. They also built the conditions that make the gate meaningless.
Jonathan Ingles: And when something goes through that shouldn't — she tapped yes.
Ben Okonkwo: She tapped yes. Seven a.m., kitchen counter, phone in one hand. That's where the liability lives. Not at Anthropic. Not in the research preview language. Right there.
Jonathan Ingles: Good talk. Genuinely uncomfortable in the right way.
