Anthropic launched Claude Tag this week, and the warning is worth getting out first. Adopt it the way most firms will and it quietly learns how your company actually works, then keeps that where you can't lift it out and run it elsewhere. And it charges you by the activity to keep using it. As other commentators have pointed out, that is the shape of renting your own company back from the people who sold you the model. The product is genuinely good, and we implement Claude for a living, so weigh the bias accordingly. But this is the cleanest example yet of the trap I flagged earlier this month, and for regulated firms it is the sharpest: adopt AI in a way that feels like an unambiguous win, and the part that compounds, the part that was meant to be your edge, ends up owned by someone else. The firm that tagged Claude in is left locked in. That is the joke in the name: tag, and your firm is it.
First, what it actually is. You tag @Claude into a Slack channel and it works there like a colleague rather than a tool you open: anyone tags it in, it follows the thread, learns how the work gets done, picks up tasks, and in ambient mode it acts without being asked, chasing the loose ends nobody got back to. It is in beta for Team and Enterprise customers, it runs on Opus 4.8, and it replaces the old Claude-in-Slack app. The point isn't that it's weak. The point is that it's strong enough that firms will pour real work through it, which is exactly what makes where that work ends up living the question that matters.
Give it its due
The warning only earns its place because the product is this good, so here is the fair version. Tag is multiplayer: a whole channel works with one Claude and picks up where the last person left off, and it carries channel memory, so people re-explain less over time. Anthropic says tagging @Claude is now one of the main ways things get done internally, with 65% of its product team's code coming from their own version of it. And it is not a black box: a channel's Claude won't read your private channels, access and memory are scoped by your admins, and you can see what it remembers and correct or delete it. The engineering is careful and the thing is useful. The problem isn't what it does. It's where the valuable part ends up.
One caveat for readers here, because it changes the scope rather than the argument. Plenty of the firms we work with have never run on Slack; for better or worse most of the corporate world, and most regulated firms in New Zealand and Australia, run on Microsoft Teams. That doesn't make this a Slack story. Anthropic has been plain that the goal is to tag @Claude in the other places work happens, and Teams is the obvious next one. So read "Slack channel" below as shorthand for wherever your firm actually does its talking. The surface is the point: this is Claude moving into the room where the work gets discussed, not an app you remember to open.
The part that compounds is the part it keeps
Earlier this month I wrote, off the back of Satya Nadella, that a firm's durable IP isn't the model it picks but the learning loop it builds on top, the layer where its people and its AI compound each other's work. His test for whether you actually own that loop was simple: you should be able to swap a generalist model and keep the company veteran your firm has built. Claude Tag is the most natural way yet to fail that test, just from the other side. The model stays swappable. It's the veteran that moves out. Much of what makes Tag more valuable over time, the exception path, the unwritten owner of a process, the customer promise nobody documented, the reason a renewal is handled the way it is, accumulates inside a vendor's product, in a form you can't lift out and run somewhere else. That isn't model lock-in; you could change the model tomorrow. It's context lock-in, and the line doing the rounds for it fits: you end up renting your own company back from the people who sold you the intelligence.
It's tempting to say it outsources the entire loop. The fair version is narrower, and the narrow version is the one that bites. It doesn't take everything. It takes the single part that was meant to be yours: the place your people's judgment and your firm's way of working were supposed to pool and stay. And it only really takes it if you let the channel become where the work lives. Used as one execution surface among many, that's a fair trade. Used as the system of record for how the firm thinks, you've handed over the one layer you most needed to keep.
A colleague is a salary. This one runs a meter.
The lock-in argument has been made well by plenty of people. The bill has had less attention, and for a regulated firm running this across real work it may be the part that bites first. A colleague is roughly a fixed cost: a salary that doesn't climb on the busy weeks. Claude Tag is metered. It runs on usage, on Opus 4.8, and in ambient mode it acts without being asked. So the better it gets the more of your work flows through it, and the more of your work flows through it the larger the bill, with no natural ceiling unless you set the spend caps and stay on top of them. The pricing quietly changes what you're buying. A lot of software you pay for by the seat; Tag you pay for by the activity, which means the vendor's revenue tracks how much work your firm pushes through it, not how many people you employ, unless you hold it down. That can still be worth it. But "very useful" and "very expensive" arrive here on the same curve, and the thing that makes it stick is the thing that makes it cost.
For a regulated firm, the record is the catch
There's a sharper version of all this for an insurer, a bank or a broker. Tag doesn't only remember; in ambient mode it interprets work and acts on it. When one of those actions is later questioned, and in this industry it will be, the question is the one we keep coming back to: can you show what the AI did, how it was checked and who signed off? With Tag, much of the working context and the record of what it did sits inside a vendor's product, on the terms of your plan. That's a thin place to stand in front of a board, an auditor or the FMA. None of CoFI, APRA's CPS 230 or the incoming Contracts of Insurance Act is an AI law, but they push the same way: regulated work has to be something you can account for afterwards, from records you hold. Renting the teammate is fine. Renting the record is the problem.
Rent the teammate. Own the loop.
The answer isn't to ban it, which is the kind of advice that ages badly, and our own bet runs the other way: we stopped building our own product and went all in on implementing Claude precisely because the model is the part you should rent from whoever is best this year. The discipline is about what you keep. Use Tag for the execution, which genuinely is better as a shared teammate. But keep the durable knowledge and the workflow in systems you control and another tool can read, and keep a retained, business-readable record of what the AI did in your own estate, not trapped inside the tool. Take the teammate as swappable. Own the layer above it. That's the useful version of owning the loop, and Claude Tag is what makes the trade-off concrete.
I have an obvious stake in arguing this, so weigh it accordingly. But the core holds even if you discount the source: Claude Tag is worth hiring, and you still shouldn't let it become the place your company's memory lives. If that's a conversation worth having, hello@airclerk.ai reaches me directly.