Introduction
In a serious discovery that clearly highlights the inherent security risks of increasing reliance on autonomous artificial intelligence tools within corporations, cybersecurity startup Tugo AI revealed on Monday that Anthropic’s Claude Tag tool—the native and direct integration tool for the Slack platform launched in beta for users just last month—can be easily exploited to run and execute dangerous, completely unauthorized corporate actions. This alarming development has triggered a wave of new and fundamental questions about the security posture of AI agents being rapidly and increasingly integrated into workplace tools and sensitive internal enterprise networks. The Tel Aviv-based tech company, which specializes primarily in building advanced access control platforms dedicated to AI agents, explained that this deep software vulnerability allows the Claude Tag tool to be activated via entirely unintended inputs, casual text, or random messages within Slack channels, which could ultimately lead the AI to take unintended and destructive actions across all enterprise systems connected to the network, thereby bypassing traditional firewalls and controls.
- Growing attack surface and excessive autonomy
- Enterprise AI security under the microscope
- Frequently asked questions
Growing attack surface and excessive autonomy
The Claude Tag tool, officially launched by Anthropic on June 23 as an AI-powered co-worker available around the clock for the Slack platform, acts as a shared and highly effective agent within authorized channels. This advanced tool features a consistent identity, scoped memory for the channel it operates in, and direct, deep connections to various enterprise tools and databases. Users can simply invoke this tool by typing the “@Claude” mention in the chat bar, allowing it to instantly read and analyze complex conversations, break down requested tasks into execution steps, and proactively and independently flag updates across the organization without even being explicitly asked to do so.
The tool’s broad access and autonomous, proactive behavior create what security researchers clearly described as a distinct and entirely new threat surface. Unlike passive AI assistants that execute literal commands only, Claude Tag can chain multiple tool invocations, interact directly with sensitive production systems via connected Model Context Protocol (MCP) servers, and retain precise organizational context over time to build a complete picture of workflow. The serious and documented findings by Tugo AI indicate that these advanced and powerful capabilities can be triggered through unintended prompts or disguised malicious text, bypassing the usual human-initiated workflow path that administrative systems typically assume governs the agent’s behavior, sets its permissions, and prevents overreach.
Enterprise AI security under the microscope
This technical and security disclosure comes during a turbulent and difficult period for Anthropic’s credibility among major corporations and enterprises. In late June, security researchers discovered a covert tracking mechanism embedded within the company’s Claude Code tool, which had quietly and silently monitored and analyzed users’ work environments for nearly three consecutive months without any prior disclosure or transparent notification. That unfortunate and controversial incident prompted e-commerce giant Alibaba to make a decisive decision to ban all employees from using the Claude Code tool to protect corporate data from any potential leaks.
Security researchers have increasingly and continuously warned of the grave risks and dire consequences of deploying AI agents with high privileges and unrestricted access across enterprise IT infrastructure. A recent technical analysis of the MCP protocol ecosystem—the primary protocol used by Claude for seamless connectivity with enterprise tools—found that 7.2 percent of running servers contain public security vulnerabilities, and 5.5 percent displayed concerning malicious behaviors technically known as tool poisoning.
Tugo AI, which proudly describes itself as building «the first native access control platform for AI agents», is part of a growing group of innovative startups focused primarily on governing and regulating autonomous AI systems in work environments. This latest disclosure underscores a broader, industry-wide challenge: as digital assistants transition from simple helpers to autonomous actors capable of decision-making, legacy security models built around human behavior are no longer sufficient to provide necessary protection. As of this writing, Anthropic has not publicly responded to Tugo AI’s security disclosure, and the Claude Tag tool remains available for download in customer beta, keeping information security officials in a state of anticipation and caution.
Frequently asked questions
Question: What tool was found to contain the serious security vulnerability?
Answer: The vulnerability was discovered in the Claude Tag tool developed by Anthropic and specifically integrated into the Slack messaging app.
Question: How can this vulnerability be exploited to strike enterprise security?
Answer: The tool can be triggered via unintended texts and words in conversations to execute unauthorized actions and access sensitive production systems and confidential data.
Question: Which tech entity discovered this vulnerability?
Answer: The Tel Aviv-based cybersecurity firm Tugo AI discovered this deep vulnerability and issued a detailed report warning of its consequences.
Question: Was the tool’s operation stopped after the direct disclosure of the vulnerability?
Answer: No, the developer has not officially responded yet, and the tool remains available as a beta version for users, requiring caution from IT departments.
