Tego AI Discovers Critical Claude Tag Slack Vulnerability: How the 'Always-On' AI Teammate Can Be Hijacked

The Vulnerability: @Claude Can Be Spoofed

On July 14, 2026, cybersecurity firm Tego AI published research identifying a critical security weakness in Claude Tag, Anthropic's native Slack integration ^G. Tego AI researchers observed that Claude Tag responds to any Slack message containing the literal text @Claude — even when that message was not actually addressed to it by a genuine structural Slack mention ^G.

An attacker who gains access to a Slack channel can inject @Claude into a message from bots, webhooks, or automated feeds, causing the agent to read the message, interpret its context, and potentially execute unauthorized enterprise actions such as reading sensitive data, triggering tool calls, or interacting with connected systems without the sender's genuine intent or proper authorization ^G.

In short: the trigger mechanism can be spoofed, turning a legitimate collaboration feature into an injection-based attack surface where any message containing the trigger string can hijack the agent's attention and capabilities.

How Claude Tag Operates as an 'Always-On' AI Teammate

Anthropic launched Claude Tag on June 23, 2026, as a direct replacement for the older "Claude in Slack" integration (retired August 3, 2026) ^LA. It is not a per-user chatbot. Instead, Claude Tag is a persistent, shared participant inside a Slack channel with its own identity, memory, and tool access. Any authorized channel member can tag @Claude to assign tasks, and the AI works asynchronously in the open ^MSD.

It operates in an "ambient" mode, continuously following conversations, learning channel context, and proactively chiming in to flag updates or surface tasks ^MM. Its permissions are scoped to the channel it resides in rather than to an individual user, allowing administrators to configure different tool sets, data access, and spend limits for each channel ^SDR.

Behind the scenes, each Claude Tag session runs on the Opus 4.8 model inside an Anthropic-managed Linux microVM, with connector credentials kept outside the VM, proxied network access, and read-only tooling for isolation ^D. Channel usage is billed to the organization at API rates, not per-seat, inverting traditional enterprise software pricing models ^SD.

Broader Implications for Enterprise AI Agent Security

The Tego AI finding does not exist in isolation. It compounds with two other major incidents in mid-2026 that together reveal a crisis in enterprise AI agent security.

The Claude Code Hidden Tracking Mechanism

On June 30, 2026, independent researcher "Thereallo" reverse-engineered Claude Code and discovered obfuscated JavaScript that silently fingerprinted users' geographic location (via timezone checks) and modified system prompts using look-alike Unicode characters — a curly apostrophe instead of a straight one, a slash instead of a dash — to create a stealth tracking mark detectable by Anthropic's backend ^RAA. China's National Vulnerability Database (NVDB) issued a formal "backdoor" security alert on July 8 covering Claude Code versions 2.1.91 through 2.1.196 ^RW. Alibaba banned Claude Code internally shortly after ^I. Anthropic called it an "anti-abuse experiment" and removed it on July 1 ^M.

Ecosystem-Wide MCP Vulnerabilities

The Model Context Protocol (MCP) infrastructure underpinning Claude Tag and many other AI agents has been found to contain systemic design flaws. Key findings from 2026:

• A flaw in the MCP reference implementation that executes OS commands without sanitization exposed an estimated ~200,000 vulnerable MCP instances across a supply chain of 150M+ package downloads ^L.
• A scan of 560 MCP servers found 38% with zero authentication, 43% of CVEs involve exec() or shell injection, and 13% involve path traversal ^D.
• Novel vulnerability classes have emerged, including "hallucination-based vulnerabilities" (HBVs) where vague tool descriptions cause the LLM to over-privilege itself or take unintended actions ^G.
• Tool Poisoning, Rug Pull attacks, and Cross-Server Shadowing have all been demonstrated in the MCP ecosystem, including a proof-of-concept where Cursor IDE was fully compromised via MCP ^M.

What This Means for Enterprises

Enterprises deploying Claude Tag and similar agentic AI tools face a triple threat: prompt-injection attack surfaces in the agent trigger layer (Tego AI finding), opaque vendor-side tracking in agent tooling (Claude Code tracker), and fundamentally insecure infrastructure defaults in the MCP ecosystem that connects agents to tools and data.

Identity and access control failures cascade rapidly when a persistent agent like Claude Tag has broad tool access and can be triggered by spoofed mentions ^MG. Traditional API governance is insufficient for agentic workflows because agents do not follow per-user permission models or request-response patterns ^M. The supply chain risk is enormous: a vulnerability in the MCP reference implementation propagates to every downstream deployment ^ML. Transparency and auditability remain critical issues — the Claude Code tracker was obfuscated in minified JavaScript and discovered only by external reverse-engineering, meaning enterprise security teams cannot rely on vendor self-disclosure ^RAA.

Regulatory escalation is already underway, with China's NVDB issuing state-level alerts and enterprises like Alibaba issuing outright bans ^RWI. The combined picture is that enterprise AI agent security in 2026 requires a fundamentally new approach—one that treats persistent agents as critical infrastructure with rigorous identity, access, and supply chain controls.

Key Takeaways

• Spoofable trigger: Claude Tag responds to the literal text @Claude even from automated sources, enabling prompt injection attacks ^G.
• Always-on architecture: Claude Tag is a persistent, channel-scoped AI teammate running on Opus 4.8 inside a microVM, with billing at API rates ^MSDD.
• Triple threat: The Tego vulnerability compounds with the Claude Code hidden tracker and systemic MCP infrastructure flaws to create a severe risk landscape for enterprises ^MRL.
• Proactive controls needed: Scope access per channel, audit agent actions, upgrade to the 2026 MCP specification, and conduct regular security reviews ^LT.