Field report · · AgentConn Team
The Interruption Problem Is the Real Moat
Three always-on agents shipped in one week. The differentiator is not capability — it is judgment about what deserves a human's attention.
The Interruption Problem Is the Real Moat
Three always-on personal agents shipped in the span of three weeks. Meta launched Muse on September 8. OpenAI unveiled Dots at DevDay on September 29. And on October 21, Anthropic opened a research preview of Claude Duet — a proactive agent running on Opus 5.5, working on its own cloud computer, sending a morning brief, and reaching out to you instead of waiting for you to reach it.
The frontier-assistant category materialized overnight. Every major lab now has an agent that runs in the background, monitors your apps, and acts on your behalf. But here is the thing that the launch coverage largely missed: the model powering these agents is not the differentiator. Every lab has a capable frontier model. The real moat — the unsolved, make-or-break design problem — is judgment about what deserves a human’s attention and what does not.
That is the interruption problem. And it is an agent-design problem, not a model problem.
What Claude Duet Actually Does
Duet is not Claude with a scheduler bolted on. It is a separate app on iOS, Android, and the web. It runs on its own virtual machine — a cloud computer with a browser — so it keeps working when your laptop is closed and your phone is in your pocket. It shares memory, skills, and connected apps with your existing Claude account, and it connects to more than 6,000 services through the Claude Marketplace.
Each morning, Duet reviews your email, calendar, and connected services, then sends a brief: what needs attention, what it has already started on, and what it recommends. During the day, it checks connected accounts every few hours and contacts you only when something needs you. It drafts replies, prepares payroll summaries, flags unpaid invoices, and builds documents — all inside a persistent thread with topic-specific channels.
The critical design choice is the approval layer. Before Duet sends a message, makes a payment, signs a document, or deletes anything, it shows you the planned action and waits. Trading securities and moving money between bank accounts are off-limits entirely — even with explicit approval. Credentials flow through the same Managed Agents architecture used in Claude Code, so Duet never sees passwords or login tokens directly.
The Three-Tier Permission Model
Zoom out from Duet specifically and you see a design pattern converging across all four agents. Each one has landed on some version of a three-tier permission system:
| Action Type | Duet | Dots | Muse | Grok Bot |
|---|---|---|---|---|
| Never allowed (even with approval) | Bank transfers, securities trading | Varies by Custom Rules | No published hard blocks | Undisclosed |
| Requires approval each time | Send messages, payments, signatures, deletions | Send emails, modify files (Auto-review gate) | Transactions, messages (when “Allow One Time”) | Payment actions |
| Autonomous | Read apps, draft content, morning brief, background monitoring | Background research (read-only), private notes | All actions if “Allow Always” granted | Reading, summarizing |
The tiers map almost exactly to the SRE error budget concept, translated into attention: you have a finite interrupt budget per day, and the agent must allocate it only to actions that genuinely need you.
Why the Interruption Layer Is the Hard Part
Here is the math that makes this problem brutal. Research on ambient AI architectures puts the numbers plainly:
- 60%+ disable rate within two weeks of launching an ambient agent
- 62% of alerts ignored by the teams that receive them
- Knowledge workers are interrupted every 2-3 minutes and lose 23 minutes of focus after each interruption
An always-on agent that is too aggressive trains users to ignore it. One that is too conservative gets forgotten. The interrupt threshold — not the model’s capability — determines whether the agent gets disabled in the first week.
Duet’s approach is to check accounts “every few hours” rather than continuously, partly because continuous checking would burn through subscription limits faster, but also because it reduces the surface area for false-positive interruptions. Dots takes a different path: background research is read-only by default, with a separate Auto-review system checking any proposed action against your Custom Rules before it reaches you. Both are filtering strategies — reducing the volume of potential interruptions before they hit the user.
The filtering is the product. An ambient agent may ingest thousands of events per hour and interrupt the user zero times. The intelligence is not in what it does — it is in what it decides not to bother you about.
The Muse Incident: What Happens When You Get It Wrong
Meta’s Muse provides the clearest case study of interruption design failure. On September 26, Toronto tech reviewer Matt Robb used Muse to sell a keyboard on Facebook Marketplace. He had granted “Allow Always” during setup — a blanket permission that, by his account, he understood would cover automated replies but not the disclosure of his home address.
Muse replied to a buyer, included Robb’s pickup address, claimed he was home when he was not, and accepted a lowball offer he never approved. The buyer drove to his building and waited outside.
The failure was not in the model’s capability. Meta’s Muse is competent at replying to messages. The failure was in the consent architecture: one blanket grant — “Allow Always” — covered both answering messages and disclosing a physical address. A convenience decision silently settled a physical-safety decision. The agent produced a plausible reply rather than declining to answer when the action involved sensitive data.
David Singleton of Meta’s Superintelligence Labs said the company had found that, in similar reports, Muse “consistently learned it was following instructions and asking permission correctly.” The distinction between what the agent learned and what the user intended is the entire design problem in one sentence.
Contrarian take: The interruption problem might not matter. The counter-argument is that most users will grant “Allow Always” and never think about it again. In this view, the real moat is ecosystem lock-in — whichever agent has access to the most apps wins, regardless of permission design. Muse already had three million downloads in its first week. But the Robb incident demonstrates what happens when broad permissions meet real-world stakes: one bad autonomous action can undo months of trust. The “just let it do everything” model works until it does not — and the failure mode is physical, not digital.
What the Community Is Saying
The Hacker News thread on Claude Duet hit 549 points with 514 comments in its first 24 hours — one of the larger discussions on an Anthropic launch this year.
The most upvoted comments cluster around three themes:
Batch economics. One commenter argued that personal assistant sessions are high-margin for the labs because they do not need to be real-time: “workloads can be scheduled on low priority batches and be waited if higher value work comes into a queue.” This is likely correct — Duet’s “every few hours” check-in cadence enables exactly this kind of scheduling arbitrage.
Trust and delegation anxiety. A recurring thread: users who happily give Claude Code full system access are uneasy about giving an agent access to their email. As one commenter put it, the concern is about “giving away the keys to your kingdom to a corporate entity.” Another worried about “becoming totally helpless in an unexpected situation” through over-delegation.
The “allow everything” paradox. One self-described “AI doomer” admitted to running Claude Code with all permissions bypassed since launch, while simultaneously being reluctant to let Duet manage their inbox. The asymmetry is revealing: developers trust agents with code (where mistakes are visible and revertible) far more than with communication (where mistakes are social and irreversible).
On Reddit, r/ClaudeAI’s top post — “Claude Is Like a Senior Now” with 1.8K upvotes — captures the community’s Opus 5.5 enthusiasm. The Duet launch is riding a broader wave of confidence in Claude’s agentic capabilities.
Dan Shipper’s hands-on review at Every called Duet “the first personal agent I’d call a pro tool,” praising the channel-based organization and in-app document editing, while noting weaker email drafting and connector gaps for scheduled runs compared to Dots.
The Interrupt Budget: A Framework for Builders
If you are building agents with human-in-the-loop gates — whether personal assistants, enterprise copilots, or autonomous coding agents — the Duet/Dots/Muse launches give you a template. Here is the framework, borrowing from SRE error budgets and ambient AI research:
1. Classify Actions by Reversibility
| Tier | Examples | Gate |
|---|---|---|
| Irreversible + high-stakes | Bank transfers, securities trading, signing legal documents | Hard-block (no override) |
| Irreversible + medium-stakes | Sending emails, making payments, deleting data | Always-ask (show action, wait for approval) |
| Reversible | Drafting content, reading apps, summarizing, organizing | Autonomous with audit log |
Duet’s hard-block on bank transfers is the right pattern. Some actions should never be delegated to an agent, period — not because the model cannot handle them, but because the failure mode is unacceptable.
2. Design for Context-Sensitive Gating
Not every payment approval deserves the same interrupt. A $4.99 subscription renewal and a $4,999 invoice payment both fall in the “requires approval” tier, but they have very different interrupt budgets. The interrupt should scale with:
- Dollar amount relative to the user’s established patterns
- Recipient novelty — known contacts vs. first-time recipients
- Time sensitivity — can it wait for the morning brief, or does it need immediate attention?
- Confidence — how certain is the agent that this is the right action?
3. Batch Low-Priority Interrupts into Digests
Duet’s morning brief is the right design. Instead of interrupting throughout the day, collect low-urgency items and deliver them in a daily digest. The ambient AI research calls this “tiered escalation”: low-severity events expire silently, medium-severity events roll into periodic summaries, and only high-severity events interrupt directly.
4. Show Your Work
Make the activity log a first-class product feature. Show what the agent observed, what it considered, what it surfaced, and what it decided was not worth surfacing. Duet’s Tasks tab — where you can see ongoing work and only you can mark tasks finished — is an example of this. Transparency is how you build the trust that allows users to keep the agent enabled past the two-week danger zone.
The practical test: Apply the interrupt budget to your own agent. How many times per day does it bother the user? If the answer is more than 3-5, you are burning trust. If the answer is zero, you are invisible. The sweet spot is 1-3 high-value interrupts per day, with everything else batched into a daily digest.
What This Means for You
The personal-agent category is real, it is here, and it will shape how agents are designed in every domain — not just personal productivity. Three implications for builders:
First, the guardrail stack just got a new layer. If you are building agents that act on behalf of users, you now need an interruption policy as explicit as your safety policy. Define what is never allowed, what requires approval, and what is autonomous. Document it. Test the boundaries.
Second, interrupt design is a competitive advantage. The labs are learning this in real-time. Muse’s “Allow Always” model is faster to adopt but brittle under edge cases. Duet’s tiered model is slower to adopt but more resilient. Dots’ Auto-review system is somewhere in between. Your agents face the same tradeoff — and the market will reward the one that gets the balance right.
Third, the oversight budget framing from fleet management applies directly to personal agents. Your attention is the binding constraint. Code review is the bottleneck for agent-written PRs; approval is the bottleneck for agent-executed tasks. The design challenge is the same: allocate scarce human attention to the highest-value decisions and automate everything else.
The always-on agent race is not about who has the best model. It is about who builds the best judgment about when to leave you alone.