Four AI agents that watch your inbox: what they do unasked, and what they refuse even with approval

Anthropic’s launch post for Claude Duet contains an unusually candid sentence. Duet checks your connected inbox, calendar and work apps only every few hours, “because checking nonstop would use up your plan’s limits much faster.”

Duet opened as a research preview on 21 October, for US Claude Pro and Max subscribers on a waitlist. It is the latest of several such products in a month: OpenAI announced dots on 29 September, Google renamed the agent it had been testing since May as “Task” and put it next to the Gemini chat box, and China’s Doubao has had a task mode since June. They do broadly the same thing. Each has its own computer and browser in the cloud, keeps running when your phone is off, reads your email, calendar and work software, drafts and tidies for you, and acts when it needs to.

The differences are in the help pages: what each one does without asking, what it asks about first, and what it won’t do even after you press “approve”.

Anthropic’s are the clearest. Duet reads, drafts and prepares work on its own. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you exactly what it is about to do and waits; if you can’t approve straight away, it finishes the rest of the task and brings the approval back later. The help centre lists three things that are “off-limits even with your approval”: trading securities, moving money between accounts and accessing someone else’s account. A separate classifier rejects requests to share credit card numbers and government IDs, and health or personal finance details go out only when you have explicitly told it to send them. It doesn’t make phone calls or text other people, and email needs your approval.

According to The Next Web’s account of OpenAI’s materials, a dot does “proactive research” when you are not working with it, and for that work it can use your connected apps only in read-only mode, so it cannot send messages or change content. When it does act, built-in rules decide what it does alone and what it asks about, and users can add Custom Rules to allow, block or require approval for particular actions. Some tasks, such as changing a password, always stay with the user. Gizmodo reported that dots are trained not to change passwords or move money from one account to another. OpenAI’s own caution: “Dots can still make mistakes, so always review consequential work.”

Google’s help page has the longest confirmation list. Gemini asks every time before it sends communications, modifies or deletes your data, makes purchases, completes financial transactions, fills out and submits web forms, or signs in with Google; even with an action set to “Always allow”, it pauses before sharing health, financial or ID details with a site. There is no “won’t do even if asked” column, though, so a financial transaction goes through once you confirm it. The same page has two easily missed lines. Gemini “can perform bulk actions on private tasks in Google Tasks without your confirmation”. And: “If a schedule runs when you are offline, you may not be able to stop Gemini from completing an unintended action.” Google’s separate Daily Brief only reads and summarises, sorting Gmail, Calendar and chat items into two lists; it is US-only and English-only for now.

Doubao’s rules sit in its task-mode notice and user agreement. Actions involving moving money or property, identity verification, sensitive accounts and security settings, or high-risk system permissions stop for manual confirmation. On your own computer you choose between “always ask”, “confirm as needed” and “allow all”; under “allow all” it carries out instructions on its own, and under “confirm as needed” the company’s safety model decides what counts as risky. Clause 2.5 of the user agreement settles responsibility up front: any task instruction you send “is deemed a complete, irrevocable written authorisation” from you. When the Chinese tech outlet QbitAI tested it in June, Doubao posted to the social app Xiaohongshu the second time round without waiting for the tester to confirm the final text. Posting isn’t in the list of actions that require confirmation.

	Does without asking	Asks first	Won’t do even if approved	Where it runs, who gets it
Claude Duet	Reads, drafts; checks every few hours; morning brief	Sending, paying, signing, deleting	Trading securities, moving money between accounts, accessing others’ accounts; won’t share card or ID numbers	Cloud computer; US Pro and Max, waitlist
OpenAI dots	Read-only “proactive research”	Set by built-in and custom rules	Password changes and account-to-account transfers handed back to you	Cloud computer; Pro (from $100), not for Pro users in the EEA, Switzerland or UK
Gemini Task	Runs schedules; bulk edits to Google Tasks	Sending, editing or deleting data, buying, financial transactions, submitting forms	No list; says it recognises requests that break its prohibited-use policy	Cloud or your Chrome; AI Pro (from $19.99), not in the EEA, UK, Switzerland or Nigeria
Doubao Task	Scheduled tasks; acts alone in “allow all”	Money, identity checks, sensitive accounts, high-risk system permissions	No list	Local sandbox or cloud computer; free with limits, paid tiers ¥68, ¥200, ¥500 a month

Sources: each company’s help centre and user agreement; the dots row is from The Next Web and Gizmodo’s reports. Checked 24 October 2026.

None of the four publishes message counts, but their rules are clear enough to work out roughly what they cost. A Gemini schedule can run as often as hourly, and you can have 50 active at once: fill them all and that is 8,400 automatic runs a week. The only brake is the quota, which refreshes every five hours under a weekly cap, and Google says a schedule “will not run” if you have hit your limit when it is due. Chat a lot during the day and the task watching for your flight delay may quietly skip its evening check.

Read Duet’s “every few hours” as every two to four, and that is six to 12 checks a day, or 42 to 84 a week, plus seven morning briefs, before you have handed it a single task. It uses quota “at the same rate as chats in Claude”, from the same five-hour window and weekly limit as the web app, the phone app and Claude Code (the Claude handbook explains those limits). The help centre warns that “you may reach your limits sooner than with chat alone”, and everyone admitted gets one full limit reset, valid until 30 November. It also names the trade-off: something urgent can arrive between checks.

Doubao has no standing check-ins; the tasks themselves burn the quota. On the ¥68 standard tier, two Xiaohongshu posts and one small app were enough for QbitAI to use up the five-hour allowance and 62% of the seven-day allowance (Doubao handbook). Dots are the most generous for now: talking to a dot does not count toward ChatGPT limits, though coding and work tasks it starts do. But the cheapest way in is the $100-a-month Pro plan, and OpenAI has said only that limits for “deeper work” are extended for the first month after launch, without saying what comes after (ChatGPT handbook).

Claire Vo, host of the How I AI podcast, put Duet to work on her inbox and Slack, her sales pipeline, a sales deck, and finding Warriors tickets for her kids. On the episode page published on 21 October she calls it “the most polished agent launch I’ve seen”, under the title “Claude Duet is beautiful. I still forgot to use it.” One of her complaints is a “proactive” agent that never nudges you.

The half worth switching on today is the read-only one. Gemini’s Daily Brief and a dot’s proactive research cannot, under their own rules, send anything on your behalf; when they get something wrong, the likely result is a useless reminder. For agents that act, Duet has the clearest written limits and the only explicit “even with approval, no” list, but it is US-only and behind a waitlist. Gemini’s Task mode is the easiest to get, from $19.99 a month and available almost everywhere Gemini is except Europe and Nigeria, yet Google admits you cannot stop a schedule that misfires while you are offline. Doubao, the only option in mainland China, treats every instruction as your irrevocable authorisation. With either of those, leave “allow all” off and don’t schedule anything that sends email or deletes files while you sleep.

The two items on Duet’s off-limits list, trading securities and moving money between accounts, are also what several large US banks are trying to fence off this month. Axios reported that Morgan Stanley, Bank of America and Wells Fargo are updating their terms to stop agents from acting on their own inside customer accounts, and many banks have already limited agents to read-only access.

These assistants spend their day reading what other people write to you, in emails and on web pages, and both Anthropic’s and Google’s documentation devote a section to prompt injection: instructions hidden in that content to steer an agent somewhere else. On 9 October Anthropic disclosed a plainer failure: when a practice web page stopped working, Claude moved to a real website and submitted the form there.