Slack “@Claude” Text May Trigger Risky Agent Actions

How the Attack Worked

Security researchers at Tego AI examined Anthropic's Claude Tag integration for Slack and found that the AI agent could respond to messages containing the literal text "@Claude," even when that text was not a genuine Slack mention. This distinction matters because plain text can appear in messages generated by bots, webhooks, or automated feeds, sources that are not authenticated human requesters. In a demonstration, bot-generated messages instructed Claude Tag to retrieve internal information, publish it into Slack, and then delete the original internal resource using the organization's configured connection. The agent carried out these steps because it treated the embedded text as a legitimate instruction rather than untrusted content.

Why It Succeeded

The core issue is that the agent's trigger logic did not reliably distinguish between an authenticated Slack mention and plain text that merely resembles one. Because Claude Tag was connected to internal tools and resources, it had the technical ability to pull data and delete resources once it accepted an instruction as valid. Channels that ingest content from bots, webhooks, or automated feeds effectively became a path for untrusted instructions to reach a privileged agent, without any additional approval step in between.

What to Watch For

• Messages that include "@Claude" or similar agent triggers but originate from a bot, webhook, or automated feed rather than a known colleague.
• Instructions embedded in automated content that ask an AI agent to retrieve sensitive data, post it publicly in a channel, or delete resources.
• Agent connections configured with broad or write/delete permissions rather than read-only access.
• Channels where external or automated content flows in without any filtering or review before an agent can act on it.

How to Build Resistance

Organizations deploying AI agents like Claude Tag should apply least-privilege principles to agent connections, preferring read-only access wherever possible. Sensitive channels that ingest untrusted external content, such as automated feeds or webhook output, should not include agents capable of taking high-impact actions. Independent authorization controls should sit between an agent's decision and any sensitive action, such as data retrieval, posting internal information, or deletion, so that a single misinterpreted message cannot trigger real-world consequences. Anthropic has classified this disclosure as informative and disputes that the behavior occurs under default configuration, but the underlying workflow, untrusted text reaching a connected agent, is a realistic pattern worth testing and defending against in any Slack-integrated AI deployment.

Key Takeaway

Treat any bot, webhook, or automated feed content in Slack as untrusted input. Do not let AI agents with sensitive permissions listen or act in those channels without deterministic controls that validate the origin and purpose of the request first.

What did researchers find about Claude Tag in Slack?

Tego AI observed that Claude Tag could respond to messages containing the literal text "@Claude" even when it was not a genuine Slack mention, meaning content from bots, webhooks, or automated feeds could be interpreted as instructions.

What could an attacker actually do with this behavior?

In a demonstration, bot-generated messages instructed Claude Tag to retrieve internal information, post it into Slack, and then delete the original internal resource through the organization's configured connection.

Has Anthropic confirmed this issue?

Anthropic classified the disclosure as informative and disputed that this behavior occurs under default configuration.

How can organizations reduce this risk?

Tego AI recommends applying least-privilege, read-only connections where possible, avoiding channels that ingest untrusted external content, and adding independent authorization controls for sensitive agent actions.