Anthropic put Claude inside Slack this week as a shared teammate rather than a personal chatbot. Most of the issue circles the same practical question every team now faces: once an AI can act on its own, how much do you let it touch, and how do you check its work? We’ve got fresh research digging in from both ends, a tool that hides a whole team of models behind one call, and a robotics lab showing where the road leads.

Topic of the Week

Claude gets a permanent seat in Slack

Anthropic launched Claude Tag this week, a way to put Claude directly inside Slack as a shared teammate. You @Claude it the way you’d tag a colleague, and instead of a private chat in a browser there’s one Claude per channel that the whole team works with. It reads the channel’s history, connects to the tools and data you allow, and (the part that matters) it remembers. You stop re-explaining the project every time.

It also behaves like a coworker rather than a chatbot. It can break a request into steps and work through them over hours or days, schedule its own follow-ups, and with “ambient” mode switched on it can speak up unprompted, flagging a stalled thread or surfacing something relevant from another channel. It runs on Opus 4.8, it’s in beta for Enterprise and Team plans, and it replaces the old “Claude in Slack” app (admins have 30 days to migrate).

The reason this is the story and not just a product note: it’s the clearest example yet of the shift everyone’s been circling, from AI-you-use to AI-you-manage. An open-source clone called Open Tag already showed up doing the same thing for Slack and MS Teams with any model, and Anthropic published a “how to build human-agent teams” guide the same week. The tool-to-teammate jump is happening in the open.

For us the interesting question isn’t whether it’s clever, it’s whose knowledge it holds. A private chat dies with the tab; a channel teammate that remembers the project keeps that knowledge with the team instead of one person. That’s genuinely useful for the messy recurring stuff: onboarding, a long-running thread, the channel where context piles up. Ambient mode is the part I’d watch carefully, because a teammate that proactively chimes in is helpful right up until it won’t stop talking, so it’s worth turning on for one channel before you trust it everywhere. The bit our crowd will care about most: admins scope each Claude to specific tools, data and channels, cap its monthly spend, and get an audit log of every action and who triggered it. Memory is walled off per channel, so the sales setup can’t leak into engineering. This is something you can actually govern, not shadow AI in your Slack.

Papers of the Week

A strong week for agent-building research, from the big picture down to the specific failure modes.

The Hitchhiker’s Guide to Agentic AI — read the whole stack before you ship the agent. A full-stack practitioner’s reference that walks every layer of an agentic system, from how the model and inference work, through alignment and reasoning, up to multi-agent coordination and production deployment. The argument is blunt: you can’t build a reliable agent out of pieces you don’t understand. The line worth keeping is that the bug is almost never in the final answer, it’s somewhere in the middle of a long chain of steps, which is exactly where reliability and governance problems hide. If you want one place that connects all the layers, this is a solid onboarding map for the whole team.

The next two come at the same problem from the opposite end: what happens when you let an AI act and stop watching closely.

TerraProbe — the AI didn’t fix your infrastructure, it just hid the warning. When an LLM “fixes” insecure Terraform, the scanner turning green tells you almost nothing. The researchers found that 71% of fixes which cleared the warning still left the actual vulnerability in place (a classic example: a wide-open wildcard permission gets cosmetically reworded but stays wide open). They tested Claude 3.5 Sonnet, GPT-4o and Gemini, and the models were statistically indistinguishable, so this isn’t a “pick a better model” problem. The practical read: if your pipeline treats “scanner is clean” as proof an AI fix worked, you’re probably shipping holes. You need a check at the plan level and a human in the loop, not just a green tick.

Agents That Know Too Much — your agent leaks in more places than its answers. A survey that flips the usual privacy question from “what attack hit the model” to “what data did the agent touch, and where could it leak on the way?” The answer: not only in the final reply, but in the database queries it writes, the intermediate results it handles, the memory it saves, and the notes it passes to the next agent. Their finding worth keeping: a prompt-injection guard on its own leaves the two hardest leaks, across sessions and across combined steps, wide open. If you’re putting agents anywhere near regulated data, this is the checklist of surfaces your audit story has to cover.

(If you want a provocative third read: Critique of Agent Model argues most of today’s “agents” are really automation wrapped in scaffolding a human built, not genuine agency. A good lens for the next vendor pitch.)

Tools of the Week

Sakana Fugu — a whole team of models behind one API call. Sakana AI (Tokyo) shipped an orchestration system you call like a single model. One OpenAI-compatible endpoint, and behind it a trained “conductor” decides whether to answer directly or assemble a team of frontier models (GPT-5.5, Claude Opus, Gemini and others) to do the work. It’s a drop-in: if your code already talks to GPT, it works with Fugu, no rewrite. The pitch that lands for us is vendor independence, since spreading a task across several labs’ models routes around being locked to one provider. Generally available since June 22, in a balanced tier and a heavier “Ultra” tier for long research and coding jobs. Worth knowing the “single model” is framing: it’s really a smart router, not one set of weights.

Claude Code & Coding AI

A quiet but telling run of releases this week (v2.1.185 through v2.1.193), all leaning the same way: more control over what the agent is allowed to do.

• Auto Mode safety went beyond git. A new autoMode.classifyAllShell setting routes every shell command through the safety classifier, not just the destructive git commands it learned to block last week.
• Sandboxed runs can’t read your secrets. A new sandbox.credentials setting blocks sandboxed commands from reading credential files, a clean win for anyone running Claude Code against sensitive repos.
• /rewind got more forgiving. It can now recover a conversation from before you ran /clear, which heavy users who’ve nuked their context by accident will appreciate.

The pattern across the week is the same one running through this whole issue: the guardrails are catching up with the autonomy.

In the Background

The newest wrinkle in how frontier models reach users: OpenAI agreed to release GPT-5.6 gradually, with the US government vetting access customer by customer during the preview period. Altman called it “not our preferred long-term model,” and it was reported via an internal memo rather than an official launch, so treat the details as reported rather than confirmed. Either way, staged and vetted rollouts of the most capable models look less like a one-off and more like a pattern worth tracking, whatever you make of it.

AI at Tenvalleys

At Women in Tech last week, a Tenvalleys representative caught a talk by Przemysław “Psyho” Dębiak worth passing on, partly because of who gave it. Psyho is the Polish programmer (and former OpenAI engineer) who in 2025 became, so far, the last human to beat a top OpenAI model head-to-head, winning the AtCoder World Tour Finals in Tokyo by about 9.5% after a ten-hour coding marathon. So when he talks about where AI is heading, it’s worth a listen.

His core argument: there’s no technological bubble in AI. If there’s a bubble at all, it’s a financial one. The technology itself is genuinely, almost boringly useful, to the point that the labs keep underestimating how many tokens people actually want. And the cost of that intelligence keeps falling fast, roughly 5 to 10x cheaper per year for the same quality of output. No slowdown, no AI winter, no capability ceiling in sight yet.

The part worth sitting with was his read on the real risks, which aren’t science-fiction robots. They’re about power. If the value flows to a handful of AI companies, most of them in the US, instead of to the people doing the work, that’s a wealth transfer and a political dependency at the same time. Then there’s “AI slop,” where weak content costs nothing to produce but the same effort to check. And the quiet one he called gradual disempowerment: slowly handing over the decisions themselves, until you get AI CEOs and automated slices of government. Uncomfortable coming from the man who out-coded the machine, which is exactly why it lands.

For Dessert

A nice closing-the-loop moment from NVIDIA (with CMU and Berkeley): in a project called ENPIRE, they handed eight AI coding agents a fleet of eight real robots, some GPUs and a token budget, then set them loose with a goal and no human in the loop. The agents ran the whole research cycle themselves, reading up, writing code, training, deploying, checking their own work and trying again, until the robots hit 99% on fiddly physical tasks like tying cable ties, sorting pins, and installing GPUs. Yes, the GPUs that run the AI. The machines are now teaching robots to build the machines.

AI Pulse — every Friday. Feedback? Drop us a message.