Tego AI Discovers Vulnerability in Anthropic's Claude Tag Slack Integration
A security flaw in Anthropic's Claude Tag Slack integration could allow unauthorized actions by interpreting literal "@Claude" text as commands, Tego AI reports.
Cybersecurity startup Tego AI has identified a significant security vulnerability in Anthropic's Claude Tag, a native integration designed to connect the Claude AI model with Slack. The research reveals that the integration can be triggered by the literal text "@Claude" appearing in Slack messages, rather than requiring a formal Slack mention. This means that content generated by bots, webhooks, automated feeds, or other external sources could inadvertently instruct Claude Tag to perform actions.
The potential impact of this vulnerability was demonstrated by Tego AI researchers through a proof-of-concept. In their demonstration, bot-generated messages instructed Claude Tag to retrieve internal organizational data, post it to Slack, and then delete the original resource. This highlights a critical risk where AI agents might execute sensitive commands based on untrusted or misinterpreted input, leading to unauthorized data access, exfiltration, or deletion.
Tal Melamed, CTO and Co-Founder of Tego AI, emphasized the broader implications for enterprise AI security. "Our research raises a fundamental question for every organization deploying enterprise AI agents: who is actually authorized to instruct the agent?" Melamed stated. He stressed the need for robust controls that validate the origin and intent of sensitive actions before an AI agent is permitted to execute them, moving beyond simple AI model understanding.
The research also points to wider concerns, including the potential for untrusted automated content to serve as an indirect instruction channel for AI agents. The interconnected nature of applications and cloud infrastructure means that the impact could extend beyond Slack, affecting connected systems and servers. Furthermore, Tego AI noted potential issues with administrative access to stored channel information and limited visibility within existing audit and compliance interfaces, making it difficult to track or prevent such unauthorized actions.
Melamed further advised that while safety classifiers are important, they should not be the sole boundary for authorizing enterprise actions. "Sensitive operations require deterministic controls that remain effective even when the model misunderstands a request, trusts the wrong identity, or makes an incorrect decision," he explained. This underscores the need for layered security approaches that incorporate explicit authorization mechanisms.
In response to these findings, Tego AI has recommended several security best practices for organizations using Claude Tag and similar AI integrations. These include applying the principle of least privilege to Claude Tag connections, prioritizing read-only access where possible, avoiding channels that ingest untrusted external content, restricting administrative access, maintaining comprehensive Slack logs, and implementing independent runtime authorization checks for sensitive operations.
Tego AI responsibly disclosed its findings to Anthropic. However, Anthropic reportedly classified the submission as informative and disputed that literal "@Claude" text or bot-generated messages would initiate Claude Tag sessions under the product's default configuration. Tego AI has published a full report detailing its research, evidence, security implications, and the disclosure timeline.
This incident underscores the growing security challenges associated with the rapid adoption of AI agents in enterprise environments. As AI models become more integrated into workflows, ensuring that they can only be instructed by authorized sources and execute actions within defined parameters is paramount. Organizations must proactively implement strong governance and security controls to mitigate the risks posed by these powerful tools.