Your AI assistant just stopped being private.
On 23 June, Anthropic released Claude Tag, a way to run a single shared Claude inside a Slack workspace. Until now the unit of AI collaboration has been the private one-to-one conversation: you, your prompt, your session, gone when you close the tab. Claude Tag changes the unit to the channel. In Anthropic's own words, "within a given Slack channel, there's one Claude that interacts with everyone." Anyone in the channel tags @Claude in plain language, hands it a task, and it works through that task in stages, posting threaded updates while the team gets on with other things. It can schedule its own work and carry a project over days. It is in beta for Claude Enterprise and Team customers and runs on Opus 4.8.
What actually happened
Two design choices make this more than a chatbot in a sidebar. First, it has memory of the channel. "As Claude follows along with its channel, it builds more context about the work," so it stops needing to be re-briefed every time. Second, it has standing access: an administrator grants it selected channels and connects it to whichever tools, data and even codebases they choose, while private channels are excluded from what it learns. It is, in short, a shared, persistent presence with its own memory and its own reach. The old Claude in Slack app is being retired, with a 30-day window to migrate across.
What it actually means
The headlines are calling this a virtual employee. That framing is the thing to be careful about, and we will come back to it. The genuine development underneath is quieter and more important. The thing you now have to govern is no longer a prompt. It is a surface.
A standing AI presence with memory and access is a different object from a chatbot you open and close. A private session forgets you the moment you leave. A shared channel member remembers, follows along, and acts in the gaps where nobody is paying close attention. That changes what "using AI safely" means at work. With a private assistant, the control point is the person at the keyboard: what they paste in, what they ask for. With a shared channel member, the control points move up and out. They become which channels it sits in, what it is connected to, and what it is allowed to do on its own.
The good news is those are real, administrator-level levers, and Anthropic has built them in. Access is scoped by admins. Private channels are held back. The work is to actually set those levers, deliberately, before the thing is live in a channel where it matters.
The Australian angle
For Australian professionals this gets concrete the moment you ask what flows through your channels. The channels where real work happens carry real information: customer details, case notes, commercially sensitive matters, sometimes personal and health data. Put a shared AI member into one of those channels, or connect it to a data source that holds that information, and you have made a use-and-disclosure decision under the Privacy Act 1988 and the Australian Privacy Principles. The accountability for that decision sits with your organisation, not with the tool.
For regulated entities the bar is higher again. A standing AI presence with access to your systems and data is a material service arrangement in APRA's sense, the kind CPS 230 expects you to assess and manage rather than switch on channel by channel. CPS 234 puts the security of that arrangement on the board. And for anyone working under the SRC Act or in claims, the discipline that was already non-negotiable, no real claimant information into an AI surface, gets harder to hold when the AI passively follows a channel instead of waiting for you to paste something in. De-identification has to happen before the data reaches the channel, not after. This is the same workplace privacy test the rest of your AI use already has to pass, just with a wider blast radius.
None of this is a reason to keep AI out of your team's workflow. It is a reason to treat the channel, not the chat box, as the unit you govern.
The hype check
Two cautions. First, "virtual employee" oversells it. A teammate you can tag, that works asynchronously, is genuinely useful, but it is a shared assistant, not a colleague. It holds no accountability, owns no decision, and cannot be the name on a determination, a customer outcome or a board paper. The async autonomy that makes it useful, working between your checkpoints, is exactly what means a person has to stay the decision-maker for anything that carries a consequence. The principle that AI agents need approval gates applies in full the moment the agent can act on its own.
Second, the migration deadline manufactures a false urgency. A 30-day window to move off the old app is a reason to plan the move, not to rush a shared AI into your busiest channels to beat a clock. Use the window to do the governance, not to skip it.
What to do this week
You do not need to deploy anything to get ahead of this. You need three decisions made on purpose.
- Decide which channels it can join. Default to keeping a shared AI out of channels that carry personal, health, claimant or commercially sensitive information. Opt those in only after someone has cleared it.
- Scope the access tightly. Connect it to the tools and data it genuinely needs for a defined job, nothing more. Least access, reviewed, not "connect everything and see what happens".
- Gate the consequential actions. Treat anything the AI does that produces an outcome, sends, commits, decides, as needing a human checkpoint. Async is fine for drafting and organising. It is not fine for the call.
The shift from a private assistant to a shared teammate is real, and most of the coverage will spend its energy on whether this replaces people. That is the wrong question for anyone who has to run it safely. The model is not new. The surface is. A standing, shared, memory-holding AI in your team's channels is a powerful way to work and a new thing to govern, and the difference between those two is entirely in the three decisions above. Make them before it is live, not after.
References
- Anthropic, Introducing Claude Tag, 23 June 2026. https://www.anthropic.com/news/introducing-claude-tag
- OAIC, Australian Privacy Principles (Privacy Act 1988). https://www.oaic.gov.au/privacy/australian-privacy-principles
- APRA, Prudential Standard CPS 230 Operational Risk Management, in force 1 July 2025. https://www.apra.gov.au/operational-risk-management
TheAICommand. Intelligence, At Your Command.
