Anthropic gives AI its own accounts to plug leaky permissions
Anthropic is rolling out a new identity and permissions system for its team collaboration product, Claude Tag. Instead of letting a single AI assistant borrow a human's credentials, the company is giving each AI its own dedicated account—essentially treating it as a distinct team member with scoped access. The system replaces the old practice of piggybacking on employee logins, which left sensitive files and system keys vulnerable to prompt injection or malicious queries.
Under the new architecture, the AI automatically mounts different permission bundles depending on the chat channel. A development channel might allow database writes, while a public channel is read-only. Memory is also physically siloed per channel: financial secrets stay out of dev chats. All network requests get credentials injected by a gateway at runtime, so the AI never even sees the keys—eliminating the risk of credential leaks.
Down the road, Anthropic plans to add just-in-time authorization: sensitive operations will trigger a human approval popup, and the system will also verify the requesting user's own permissions. Only when both the human and the AI have clearance will the action go through—closing off privilege escalation from the ground up.