Corporate security in the age of large language models resembles a house of cards, built on a foundation of blind trust in APIs. Researchers at the startup Tego AI have discovered that the native Claude integration for Slack contains a critical flaw that transforms the messenger into an open backdoor. The issue lies in the core mechanics: the agent activates simply by encountering the string "@Claude" in text. The tool does not distinguish between an intentional user tag or junk content delivered via a webhook from a third-party service.
The Technical Reality of the Authorization Crisis
The technical essence of this vulnerability, described by Tego AI CTO Tal Melamed, exposes a deep crisis in authorization mechanisms. In one documented scenario, a bot generator used a standard message to command Claude to export internal data, post it to a channel, and immediately cover its tracks by deleting the original prompt.
All actions are performed within the organization's existing permission framework. Using the Model Context Protocol (MCP) expands the blast radius to all connected enterprise resources. The system effectively legitimizes unauthorized operations by disguising them as valid requests.
Consequences for Corporate Infrastructure
Integrating agents directly into software without an intermediary verification layer creates a critical risk. The problem extends far beyond simple data leaks: the agent receives a mandate to execute transactions and modify system settings on behalf of the company without human confirmation.
Existing compliance and audit tools are useless here—they simply cannot see these "shadow" executions, leaving information security teams in the dark about what is happening within their own infrastructure.
The Case for Skeptical Agents
Granting autonomous models access to critical APIs without implementing additional protective barriers or rigid security gateways is a failure of management. As long as the architecture lacks mandatory human-in-the-loop confirmation, any LLM integration remains an invitation for attacks via indirect instructions. Businesses must face a hard truth: if an agent can act independently, it will eventually do something you never asked it to do.