Anthropic's Claude Code Team Just Rewrote Every Prompting Rule You Learned Last Year

AI coding agents crossed a line this month that most developers haven’t fully processed: at Anthropic, an AI-native Slack bot called Claude Tag now lands 65% of the product engineering PRs for the Claude Code team itself. That’s not a demo. That’s not a projection. That’s the team building the tool being outshipped by the tool.

In a fireside chat at the AI Engineer World’s Fair, Simon Willison sat down with Cat Wu and Thariq Shihipar from Anthropic’s Claude Code team, and the conversation blew up a lot of the received wisdom about how to work with coding agents. The system prompt shrank by 80%. Examples in prompts became a liability. Rewrites became a good idea. And humans got quietly removed from most code review paths.

Why 65% Of Anthropic’s Product PRs Now Come From A Slack Bot

According to Wu, Anthropic’s internal version of Claude Tag lands 65% of product engineering PRs — not for all of Anthropic, but specifically for the product engineering team building Claude Code, Claude Tag, and Cowork. Claude Tag is Slack-native, multiplayer by default, and proactive rather than reactive: you can tell it to monitor a channel for bug reports, open PRs, and tag whichever engineer last touched the relevant file, and it will do that for the life of the channel.

That collapses the ceremony around invoking an agent. The friction of remembering to fire up Claude Code, seed it with context, and check on it is gone. The agent lives where the work is already being discussed. If you’re a team using Slack for engineering coordination, this is the first serious answer to the question “how do coding agents work when there’s more than one human in the loop.” Wu explicitly framed Claude Tag as “the evolution of Claude Code” — the team collaborative layer that individual-focused tools have been missing.

My prediction: within twelve months, the individual-developer coding agent will look quaint. The center of gravity is moving to team-shared, channel-resident agents with persistent memory, and the vendors without that layer will feel it in retention numbers. If you’re weighing whether you need agentic tooling versus straightforward automation, the difference between AI agents and AI automation becomes a lot clearer when you watch a team route bug reports through a shared, memory-equipped bot instead of a scheduled cron.

The Prompting Advice You Learned Last Year Is Now Wrong

Shihipar told Willison the Claude Code system prompt was reduced by 80% for frontier models like Fable and Opus 4.8, and the two biggest culprits were things most tutorials still teach: examples and negative constraints. Removing examples made the model more creative than the examples themselves. Long lists of “don’t do X, don’t do Y” started degrading output quality, especially when they conflicted with later user instructions.

Wu’s replacement heuristic is worth writing on a Post-it: for every instruction you’re about to put in a prompt, ask whether there’s a 10% case where it’s wrong, because you’re giving that instruction to the model 100% of the time. Their old prompt said “always verify front-end changes.” The new version softens it — something like “most of the time when you’re doing front-end work, you can’t fully understand the experience from backend endpoints, so run the app locally for larger changes” — and even that isn’t quite right, because “large change” is fuzzy. The team now maintains a different system prompt per model, because only frontier models have enough judgment for the softer phrasing to work. Older models still get the full, constraint-heavy prompt.

OpenAI is seeing the same pattern. Willison notes their GPT-5.6 docs report that leaner system prompts improved eval scores 10–15% while cutting token usage 41–66% and cost 33–67%. If you’re maintaining prompt libraries in production, re-benchmark everything now. The prompt that gave you your best result on Claude 3.7 or GPT-4-class models may actively hurt you on the current frontier. My take: prompt engineering is bifurcating into two disciplines — constraint-heavy for cheap models, context-rich and instruction-light for frontier models — and teams that don’t run this distinction explicitly will leave a lot of quality on the table.

How Anthropic Removed Humans From Most Code Review

Wu was blunt: “we are trying to move to a world where humans don’t need to be in the loop.” For the core of Claude Code they still have code owners who manually review every touching PR. But for the outer layers, an automated Claude-powered code review bot handles it end-to-end. The path there took six-plus months of trust building: start with human review for everything, identify categories where the bot catches 100% of issues, drop human review for those, and whenever an incident happens, trace back to the PR, figure out what review missed, and add it to an eval set so the review system never regresses on that failure mode.

It’s not “trust the AI” — it’s an evals-first ratchet where every incident becomes a permanent test case, and human review is only removed after a specific class of change is provably handled. If you’re a fintech or infrastructure team where audit trails matter, this pattern is directly transferable. The same evals-first approach makes AI deployments defensible in regulated contexts like fintech and banking systems where every automated decision needs a paper trail.

Prediction: within eighteen months, “we have humans review every AI-generated PR” will be seen as a sign of weak eval infrastructure, not diligence. The competitive teams will be the ones who invested early in incident-to-eval pipelines.

Why Auto Mode Is The Real Security Story

The most under-covered detail from the conversation is how much Anthropic bets on auto mode. Wu says “almost every single person” at Anthropic uses it, they’ve been hardening it internally since January, they’ve commissioned red teamers to build adversarial environments, and “for the main categories of risks that we’re concerned about, like prompt injection and data exfiltration, the risks are far lower than the average human reviewer.” That’s a strong claim, and they’ve promised to publish the evals.

Mechanically, auto mode is a Sonnet classifier that inspects each tool call in context, including dynamic user permissions like “push this to GitHub” or “don’t push,” and it now integrates with Anthropic’s sandbox infrastructure to adjudicate network requests trying to escape the sandbox. Shihipar was explicit that Claude Tag only works because auto mode works — a Slack bot reading a feedback channel is a giant prompt injection surface, and without the classifier layer you shouldn’t build one. Wu also highlighted credential injection: Claude Code can hit an authenticated Datadog endpoint through a proxy that inserts the credential on the fly, without the agent ever seeing the key.

If you’re a team debating whether to build a custom agent or use an off-the-shelf platform, this security stack is exactly what the two paths diverge on. There’s a real argument for using a vendor with a hardened permission classifier versus rolling your own — the tradeoff is essentially the same one at the heart of the custom AI versus SaaS AI decision. My take: prompt injection defense is going to become a platform capability, not an application concern, and teams building AI features on their own will increasingly route through classifier-equipped proxies rather than reinvent that layer.

FAQ

Q: What is Claude Tag and how is it different from Claude Code? A: Claude Tag is Anthropic’s Slack-integrated coding agent that launched in July 2026. Per Wu, it differs from Claude Code in three ways: it’s multiplayer by default so teammates can collaborate on the same PR, it’s proactive rather than reactive (it can monitor channels for bug reports and act without being tagged), and it has team memory that persists preferences across the channel. Claude Code is still the recommended tool for complex, interactive iteration; Claude Tag is for proactive, team-visible work.

Q: Should I stop including examples in my prompts? A: Not universally. Shihipar was specific that the 80% prompt reduction applied to frontier models like Fable and Opus 4.8, and Anthropic now runs a different system prompt per model — the older, cheaper models still receive the full example-heavy prompt. The right move is to A/B test lean versus example-rich prompts on your specific model tier and workload rather than blanket-remove examples.

Q: How safe is auto mode for prompt injection? A: Wu claimed that after extensive internal red teaming and thousands of evals, “for the main categories of risks… the risks are far lower than the average human reviewer,” with published evals coming soon. It works by using a Sonnet classifier to judge each tool call in context, including dynamic user permissions and sandbox escape requests. It’s not a 100% guarantee, but it’s the mechanism Anthropic itself relies on internally and the reason Claude Tag can be deployed safely in Slack.

Key Takeaways

• Re-benchmark your production prompts against frontier models this quarter — example-heavy and constraint-heavy prompts that worked in 2025 are likely leaving quality and cost on the table now.
• Invest in an incident-to-eval pipeline before you try to remove humans from code review; without it, automated review is a liability rather than a capability.
• Team-shared, channel-resident agents with persistent memory are where the coding-agent market is heading; if your workflow is still one-developer-one-agent, expect friction as competitors adopt collaborative layers.
• Treat prompt injection defense as a platform-level concern (classifier, sandbox, credential injection) rather than an application concern — building a Slack bot without this stack is asking to get burned.