[I work for Slack, opinions very much my own]
Having agents see everything you and your colleagues see is cool.
The challenge comes when you want to make certain things private to certain people. In that world you don’t want multiplayer agents leaking data, so you end up having to write and maintain complex rulesets about what specific resources agents have access to.
Single-player agents, on the other hand, are much more straightforward — they act on a single user’s behalf, and then the challenge is ensuring the single-player agent cannot exfiltrate private data into a shared space unless the user specifically permits it.
I'm from Asana so I'm probably biased too :) and I agree single-player agents are easier, but multi-player agents that understand end to end workflows etc. are very powerful. That's what we've built and yes it took a lot of thought and time to built it in a way that it would be privacy conscious and not leak the wrong thing to the wrong people etc. I haven't player with Buzz yet but signed up and admire them for thinking differently and trying to build something interesting.
Private groups are the worst thing in a truly collaborative environment. Would be nice in Slack to have a Publish this whole freaking thread to a public channel button.
But who is allowed to press it? If anyone, then anyone can expose career ruining messages from someone else, even inadvertently.
Can’t anyone already do that with a screenshot or a log dump? I’m always assuming company provided comms platforms are fully readable by the admins
That's a good operating assumption, and I usually think this way too.
It turns out Slack actually requires legal process or consent of parties to provide private messages to admins: https://slack.com/help/articles/204897248-Guide-to-Slack-imp...
But of course yes, another party could simply take a screenshot
They certainly can on Business and Enterprise plans. There’s some lip service to following employee policy and applicable laws, but if the policy allows (most do), and you’re in the US, the admins can do it.
It is. Firm I worked at had AI summarized chats delivered to admins and upper level management.
If you talk shit about your superiors, it will get back to them. Same with "anonymous" surveys.
love how we have technology that would have made Beria nut in his pants, now available to every pointy-haired boss
i'm thinking of moving to a cabin in the woods outside Lincoln, Montana
If you wrote it on your company's slack space, it is not really private to the company. Everytime I have a "private" conversation in Slack I have the understanding that the information could be shared. Even now there is a share button not for the whole conversation but yes for individual messages
It's potentially open to the public as well, given the right legal action. The Enron email dump revealed secrets that presumably ended several marriages.
Well the Enron dump was in the early 2000s, a lot of that stuff (irrelevant to the litigation) would get sealed these days. There were things like social security #s and bank accounts in there.
Every thread participant should check [_] I agree before the thread is published.
An inappropriate message may not be about something unsavory but about something private. Information about a contract which is not yet public. A discussion of a candidate who is then hired, and reads it. Etc.
consent in a company managed chat app doesn’t exist
Who would put a career ruining message on slack or any other company platform/service?
Seemingly benign and/or entirely work-related messages can turn out to be career-ending when weaponized by the company.
Or a coworker with an ax to grind.
1. A workspace admin or 2. by permission of all on thread, or AI inspects contents and gates on 1 or 2 if anything sensitive. This isn't 1990, we can program stuff now.
The OPs comments weren’t just a hypothetical. We’ve already seen numerous instances where agents have leaked private data. Even GitHub’s own Copilot has been found guilty of these vulnerabilities.
I agree. We have a leadership channel at work for well, the leadership team. Those conversations are sensitive. Evaluations, hiring bands, salaries, future product planning, markets, funding, etc. Access to that channel is strictly controlled. I am not worried about anyone taking a screenshot. In the case of allowing an AI agent to participate in the channel, I would be worried about that AI using information from that channel to answer a question outside of that channel. Keeping the agents "learnings" clearly behind a "firewall" would be of great importance.
Beyond that, the team are free to have private conversations between themselves. This is NOT something we log. At the end of the day, hiring good people and trusting them is important. The logic of making sure the AI does not leak those conversations also applies.
It is a new world, re:AI. It has its uses and things are changing at a rapid pace. It is not clear to be the protections we have implemented in todays paradigms are well implemented yet in the new AI world.
> This isn't 1990, we can program stuff now.
What a curious thing to say. My impression has been, if you put the accomplishments of computer science prior to 1990 against those subsequent, the prior would be more impressive, perhaps by a lot.
I programmed back then too so cheekiness applied mostly to me.
The only actually interesting thing about this regarding "career ruining messages" is how easy accidental disclosure violations would become.
Your Slack admin can read all messages regardless of where it was posted via SIEM
That can already happen with screenshots
Publishing "career ruining " messages on a company managed chat app is probably a bad idea in general.
Pretty sure slack enterprise has this feature for turning private chats into public channels.
Edit: verified. You can do this but takes an extra step of converting to private channel first then swapping the channel mode.
Pretty sure slack enterprise has this feature for turning private chats into public channels.
Checked docks. You can convert any private chat into a private channel. Then swap the channel from private to public.
Lol. I'm a peasant.
I'm confused are against the idea of private groups at all or just that you can't change the visibility settings later on?
No, there's a place for private, but it should be rare and not default mode for all company business related comms.
The change is for when everyone realizes this is useful info, a decision was made, you want to share this more broadly. Very often imo.
My understanding of what they were saying Buzz is is that agents are "1st class" users in their own right, rather than being an app integration.
If you have a user called Claude, then you just apply ACL as normal & you don't care if they're human or bot, right?
The issue is when users interact with claude, what can they see? If the AI can see super-secret-payroll-details.md - is it allowed to discuss that with any user? is there some sort of internal ACL within claude that asks pretty please don't tell everyone they're underpaid?
That's why multiuser agents can be an issue.
The other way to do this, is to have claude installed for everyone, and any user's chat with claude uses their personal permissions via something like oauth delegation or AWS IAM role kinda things. But that, again, is complicated ACL logic living through the delegation of roles and access
I'm not sure the permissions problem is solved even if we assume models inherit user permissions. Imagine I'm a manager and someone contacts me about an HR incident involving one of my reports, or other sensitive information. The agent probably shouldn't have access unless I explicitly provide it.
I agree with what you are saying but this is not how we solved the issue with who can access what.
In our cloud harness we have the notion of shared and private secrets. When something is authenticated with a shared secret it is basically something that can be used in a public setting. If something is private then it can be only accessed via trusted channel. It works for slack, telegram, etc.
In fact, our slack agents are very strong this department and it is guaranteed there is zero leak of private information.
And if someone gets access to a channel that they shouldn't?
The best norms around slack channels is to have most channels be public, but have norms where not everyone is in every channel.
I have lived in organizations where under 1% of messages were made on public channels. The experience of finding information in slack, or even knowing if there's a private channel where all of this is discussed, but where nobody invited you to, is not one I wish on anyone.
No channel will disclose private information. The only way to get that to work is to DM the agent directly or to use slash commands which are ephemeral / private.
so your agents can't access any private information in public channels?
Not very useful.
Still probably better than Claude's new bot which requires a service account per channel!
Hang on a second. You think accessing private information in a public channel is a good idea?
If a tool is authenticated as personal then it can be only accessed under personal context - i.e. privately. Now if the author of the agent wants to add tools authenticated with shared secrets that is something should be considered in the threat model.
In other words:
- reading my personal emails in a public setting - not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model
> not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model
This is never secure. Some SAAS apps have automatic enrollment into company/teams based on email domain. So you can sign up with the email address of the agent and then ask for any 2fa code or other emails.
> so you end up having to write and maintain complex rulesets about what specific resources agents have access to.
Why wouldn't you simply use the group chat ID (+more) to key the conversations on?
Because there’s an unlimited number of groups with different combinations of memberships. If I am in group A but not group B and an agent is in both, what is it allowed to share with me?
I'd like to see this problem solved in such a way that your group memberships are transitively applied to your access to agents. In other words: you shouldn’t be allowed to talk to an agent at all if, at a given point in time, that agent is or was in a group that you are not or were not in at that time. Does that make sense? I don’t know how practical this restriction is, but letting the AI manage such permissions on its own seems reckless to me.
These kinds of rules never survive real world tests. For example if I create a private group just for myself and auto invite every agent in the company into it, does that mean no one can now use any of them?
Maybe this is naive or startup-brained of me: I understand not wanting HR-related things to be potentially exposed by a misaligned agent, but when it comes purely to the building of software I personally do not care at all who can read the code/discussions & engage with the process.
Totally get that for code! But there are orgs where non-code things are compartmentalised — maybe for leak reasons — that still want to employees to make use of agents.
all ingested data and all derivations of that data can link to source channel and associated ACL that syncs with the source. then search/reads/etc just join on and respect the ACL. not that complicated to manage for things like slack, meetings, etc.
The product seems to use the same 'scoping' mechanism that humans would use, so you can give agents access to whatever 'channels' you want.
The issue seems to be that they 'invented' an auth and permission protocol instead of delegating to something existing, it would be as if they thought their idea of permissions were novel.
Seems easy for Buzz to solve. I’m just happy to have an alternative to Slack.
> I work for Slack
And? Your opinions are either insightful or they aren't. Who you work for is irrelevant.
This also isn't the brag that you seem to think it is. Your client can't even keep straight "what was the last thing I read in this channel." I'm constantly having to scroll back down because slack thinks I last was in the channel a day or two ago, not 5 minutes ago. It's also hopelessly bloated, uses GPU time when nothing on the screen is changing, slow, thinks everything is a URL, and the link previewer seems perpetually down.