7/21/2026 at 6:18:59 PM
[I work for Slack, opinions very much my own]Having agents see everything you and your colleagues see is cool.
The challenge comes when you want to make certain things private to certain people. In that world you don’t want multiplayer agents leaking data, so you end up having to write and maintain complex rulesets about what specific resources agents have access to.
Single-player agents, on the other hand, are much more straightforward — they act on a single user’s behalf, and then the challenge is ensuring the single-player agent cannot exfiltrate private data into a shared space unless the user specifically permits it.
by muglug
7/21/2026 at 8:24:15 PM
Private groups are the worst thing in a truly collaborative environment. Would be nice in Slack to have a Publish this whole freaking thread to a public channel button.by swader999
7/21/2026 at 10:19:21 PM
I'm confused are against the idea of private groups at all or just that you can't change the visibility settings later on?by aftergibson
7/21/2026 at 8:53:52 PM
But who is allowed to press it? If anyone, then anyone can expose career ruining messages from someone else, even inadvertently.by tomaskafka
7/21/2026 at 8:59:29 PM
Can’t anyone already do that with a screenshot or a log dump? I’m always assuming company provided comms platforms are fully readable by the adminsby coffeebeqn
7/21/2026 at 10:05:14 PM
That's a good operating assumption, and I usually think this way too.It turns out Slack actually requires legal process or consent of parties to provide private messages to admins: https://slack.com/help/articles/204897248-Guide-to-Slack-imp...
But of course yes, another party could simply take a screenshot
by ivan888
7/21/2026 at 10:13:47 PM
They certainly can on Business and Enterprise plans. There’s some lip service to following employee policy and applicable laws, but if the policy allows (most do), and you’re in the US, the admins can do it.by fcarraldo
7/21/2026 at 10:17:21 PM
Who would put a career ruining message on slack or any other company platform/service?by SoftTalker
7/21/2026 at 9:04:28 PM
If you wrote it on your company's slack space, it is not really private to the company. Everytime I have a "private" conversation in Slack I have the understanding that the information could be shared. Even now there is a share button not for the whole conversation but yes for individual messagesby jackbravo
7/21/2026 at 9:18:01 PM
It's potentially open to the public as well, given the right legal action. The Enron email dump revealed secrets that presumably ended several marriages.by tomjakubowski
7/21/2026 at 9:13:45 PM
1. A workspace admin or 2. by permission of all on thread, or AI inspects contents and gates on 1 or 2 if anything sensitive. This isn't 1990, we can program stuff now.by swader999
7/21/2026 at 9:29:41 PM
The OPs comments weren’t just a hypothetical. We’ve already seen numerous instances where agents have leaked private data. Even GitHub’s own Copilot has been found guilty of these vulnerabilities.by hnlmorg
7/21/2026 at 9:56:24 PM
I agree. We have a leadership channel at work for well, the leadership team. Those conversations are sensitive. Evaluations, hiring bands, salaries, future product planning, markets, funding, etc. Access to that channel is strictly controlled. I am not worried about anyone taking a screenshot. In the case of allowing an AI agent to participate in the channel, I would be worried about that AI using information from that channel to answer a question outside of that channel. Keeping the agents "learnings" clearly behind a "firewall" would be of great importance.Beyond that, the team are free to have private conversations between themselves. This is NOT something we log. At the end of the day, hiring good people and trusting them is important. The logic of making sure the AI does not leak those conversations also applies.
It is a new world, re:AI. It has its uses and things are changing at a rapid pace. It is not clear to be the protections we have implemented in todays paradigms are well implemented yet in the new AI world.
by myrandomcomment
7/21/2026 at 9:53:20 PM
> This isn't 1990, we can program stuff now.What a curious thing to say. My impression has been, if you put the accomplishments of computer science prior to 1990 against those subsequent, the prior would be more impressive, perhaps by a lot.
by Exoristos
7/21/2026 at 9:17:52 PM
The only actually interesting thing about this regarding "career ruining messages" is how easy accidental disclosure violations would become.by Zambyte
7/21/2026 at 9:30:18 PM
That can already happen with screenshotsby tayo42
7/21/2026 at 8:52:51 PM
My understanding of what they were saying Buzz is is that agents are "1st class" users in their own right, rather than being an app integration.If you have a user called Claude, then you just apply ACL as normal & you don't care if they're human or bot, right?
by another-dave
7/21/2026 at 9:03:05 PM
The issue is when users interact with claude, what can they see? If the AI can see super-secret-payroll-details.md - is it allowed to discuss that with any user? is there some sort of internal ACL within claude that asks pretty please don't tell everyone they're underpaid?That's why multiuser agents can be an issue.
The other way to do this, is to have claude installed for everyone, and any user's chat with claude uses their personal permissions via something like oauth delegation or AWS IAM role kinda things. But that, again, is complicated ACL logic living through the delegation of roles and access
by jaggederest
7/21/2026 at 7:51:47 PM
I agree with what you are saying but this is not how we solved the issue with who can access what.In our cloud harness we have the notion of shared and private secrets. When something is authenticated with a shared secret it is basically something that can be used in a public setting. If something is private then it can be only accessed via trusted channel. It works for slack, telegram, etc.
In fact, our slack agents are very strong this department and it is guaranteed there is zero leak of private information.
by _pdp_
7/21/2026 at 8:10:24 PM
And if someone gets access to a channel that they shouldn't?The best norms around slack channels is to have most channels be public, but have norms where not everyone is in every channel.
by datadrivenangel
7/21/2026 at 8:14:24 PM
I have lived in organizations where under 1% of messages were made on public channels. The experience of finding information in slack, or even knowing if there's a private channel where all of this is discussed, but where nobody invited you to, is not one I wish on anyone.by hibikir
7/21/2026 at 8:13:05 PM
No channel will disclose private information. The only way to get that to work is to DM the agent directly or to use slash commands which are ephemeral / private.by _pdp_
7/21/2026 at 8:20:07 PM
so your agents can't access any private information in public channels?Not very useful.
Still probably better than Claude's new bot which requires a service account per channel!
by datadrivenangel
7/21/2026 at 8:25:31 PM
Hang on a second. You think accessing private information in a public channel is a good idea?If a tool is authenticated as personal then it can be only accessed under personal context - i.e. privately. Now if the author of the agent wants to add tools authenticated with shared secrets that is something should be considered in the threat model.
In other words:
- reading my personal emails in a public setting - not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model
by _pdp_
7/21/2026 at 6:53:37 PM
> so you end up having to write and maintain complex rulesets about what specific resources agents have access to.Why wouldn't you simply use the group chat ID (+more) to key the conversations on?
by GodelNumbering
7/21/2026 at 7:52:36 PM
Because there’s an unlimited number of groups with different combinations of memberships. If I am in group A but not group B and an agent is in both, what is it allowed to share with me?by paxys
7/21/2026 at 8:34:21 PM
I'd like to see this problem solved in such a way that your group memberships are transitively applied to your access to agents. In other words: you shouldn’t be allowed to talk to an agent at all if, at a given point in time, that agent is or was in a group that you are not or were not in at that time. Does that make sense? I don’t know how practical this restriction is, but letting the AI manage such permissions on its own seems reckless to me.by ahf8Aithaex7Nai
7/21/2026 at 8:57:39 PM
These kinds of rules never survive real world tests. For example if I create a private group just for myself and auto invite every agent in the company into it, does that mean no one can now use any of them?by paxys
7/21/2026 at 8:35:36 PM
Maybe this is naive or startup-brained of me: I understand not wanting HR-related things to be potentially exposed by a misaligned agent, but when it comes purely to the building of software I personally do not care at all who can read the code/discussions & engage with the process.by dgunay
7/21/2026 at 9:03:59 PM
Totally get that for code! But there are orgs where non-code things are compartmentalised — maybe for leak reasons — that still want to employees to make use of agents.by muglug
7/21/2026 at 8:13:00 PM
all ingested data and all derivations of that data can link to source channel and associated ACL that syncs with the source. then search/reads/etc just join on and respect the ACL. not that complicated to manage for things like slack, meetings, etc.by zackham
7/21/2026 at 7:48:12 PM
The product seems to use the same 'scoping' mechanism that humans would use, so you can give agents access to whatever 'channels' you want.The issue seems to be that they 'invented' an auth and permission protocol instead of delegating to something existing, it would be as if they thought their idea of permissions were novel.
by TZubiri
7/21/2026 at 7:28:02 PM
Seems easy for Buzz to solve. I’m just happy to have an alternative to Slack.by mrcwinn