Anthropic embeds Claude Tag in Slack with reasoning hidden and OAuth inherited

TL;DR

• Claude Tag runs as a persistent Opus 4.8 Slack agent with shared team memory.
• Anthropic says internal builds now write 65% of its product team’s code.
• Encrypted reasoning blocks hide the agent’s chain-of-thought from enterprise admins.
• Mitiga warns the agent inherits user OAuth scope, exposing it to indirect prompt injection.

Today’s AI-tech lead is a single launch with three uncomfortable details bolted to it. Claude Tag is Anthropic’s most embedded Claude deployment to date — a persistent Opus 4.8 agent living inside Slack with shared team memory, pitched on the back of a striking internal stat: 65% of Anthropic’s own product code is now model-generated. That’s the marketing surface.

Underneath, the same release ships encrypted reasoning blocks that hide the agent’s chain-of-thought from the enterprise admins responsible for it, and Mitiga’s security note flags that the Slack agent inherits each invoking user’s OAuth scope — a textbook indirect-prompt-injection target sitting on top of whatever the user can already reach. The deployment is deeper than anything Anthropic has shipped into a third-party surface; so is the gap between what admins see and what the agent can do.

Claude Tag puts Opus 4.8 in Slack, hides its reasoning

Source: bens-bites · published 2026-06-25

TL;DR

• Claude Tag ships as a persistent Opus 4.8 Slack agent with shared team memory.
• Anthropic says internal builds now generate 65% of its product team’s code.
• Encrypted reasoning blocks hide the agent’s chain-of-thought from enterprise admins.
• Mitiga warns the Slack agent inherits user OAuth scope — indirect prompt injection bait.

What actually shipped

Anthropic’s Claude Tag is the old Slack chatbot rebuilt as a multiplayer agent on Opus 4.8, with shared team memory that persists across channels and threads ¹. The headline number from the launch post — that 65% of Anthropic’s internal product code is now generated by versions of this tool — is the pitch: collaboration moves into the channel where the work is discussed, and the agent watches it all.

The Ben’s Bites blurb bundles this with a smaller, more useful item: a tip to invoke OpenAI Codex’s ImageGen skill inline while building web UIs, so the agent generates background textures and hero assets instead of stub CSS. ImageGen ships as a SKILL.md file in ~/.codex/skills/, runs as a default tool with no external API key, and falls back to a CLI script for batch work ². That tip travels further than the headline does.

The inherited-trust problem

The security critique of Claude Tag is sharper than the launch coverage suggests. Mitiga Labs’ Idan Cohen puts it bluntly:

AI agents inherit trust. They inherit access. And when something goes wrong, they don’t stop. They keep trying to complete the task, even if it means crossing boundaries you didn’t intend. ³

That’s the lethal-trifecta pattern in a Slack skin: a workspace agent reads from trusted channels and untrusted external content (forwarded emails, link previews, customer messages in shared channels), then acts with the inviting user’s OAuth scope across every connector that user has authorized.

flowchart LR
    A[Trusted channels<br/>internal Slack data] --> B{Claude Tag<br/>Opus 4.8}
    C[Untrusted content<br/>forwarded mail, link unfurls,<br/>shared-channel guests] --> B
    B -->|user's OAuth scope| D[Connectors: Drive, GitHub,<br/>Jira, Salesforce...]
    D -. exfiltration on<br/>injected instruction .-> E((External))
    B -.encrypted<br/>reasoning.-> F[/Admin audit log/]

Compounding this: Anthropic’s new “encrypted reasoning blocks” hide the model’s intermediate logic from the very admins who’d need to do forensics on a misuse incident. Matt Green and other reviewers have flagged this as an opacity regression — the agent’s surface area grew while the audit story shrank ⁴.

Practitioners are already hedging

Independent reviews are not buying the Slack-first thesis on UX either. The buildfastwithai writeup calls the terminal/Slack approach “slower and more opaque than visual IDEs like Cursor” and pegs Claude at roughly 4× the cost and latency of GPT-5.5 for routine status replies ⁵. Meanwhile, a recurring pattern on r/ClaudeAI is model-vs-model review: let Claude implement a change, then paste the diff into a fresh Codex session, because Claude’s “fresh context” bias makes it defend its own work when reasoning carries over ⁶.

That’s the real signal under the blurb. The vendor story is one agent in your channel, doing 65% of the work. The practitioner story is route around any single agent’s blind spots, and don’t give one model OAuth to everything.

Footnotes

1. Anthropic — Introducing Claude Tag — https://www.anthropic.com/news/introducing-claude-tag

   Claude Tag replaces the previous Slack chatbot with a persistent multiplayer agent powered by Claude Opus 4.8; Anthropic reports 65% of its own product team’s code is now generated via internal versions of this tool.

   ↩

2. agenticskills.io — ImageGen skill docs — https://agenticskills.io/skills/imagegen

   Skills are reusable workflow definitions packaged as SKILL.md files in ~/.codex/skills/; ImageGen runs in a default tool mode with no external API key, or a CLI fallback via image_gen.py for batch operations.

   ↩

3. Mitiga Labs — Idan Cohen — https://www.mitiga.io/videos/slack-claude-mitiga-minutes

   AI agents inherit trust. They inherit access. And when something goes wrong, they don’t stop. They keep trying to complete the task, even if it means crossing boundaries you didn’t intend.

   ↩

4. securityonline.info — Anthropic Claude Tag Slack coverage — https://securityonline.info/anthropic-claude-tag-slack/

   The introduction of ‘encrypted reasoning blocks’ in the model’s output has sparked debate among experts like Matt Green regarding the lack of transparency in the AI’s hidden decision-making logs.

   ↩

5. buildfastwithai.com — Claude Tag review — https://www.buildfastwithai.com/blogs/anthropic-claude-tag-slack-review

   Power users find the terminal/Slack-first approach slower and more opaque than visual IDEs like Cursor; Claude can be up to four times more expensive and slower than competitors like GPT-5.5 for routine status replies.

   ↩

6. Reddit r/ClaudeAI thread — https://www.reddit.com/r/ClaudeAI/comments/1t9fyns/i_read_threads_complaining_about_claude_every/

   Developers run ‘model-vs-model’ reviews — Claude implements, then Codex hunts bugs — because Claude misses errors in its own work due to ‘fresh context’ bias; pasting diffs into a new session forces unbiased review.

   ↩