Security investigation service
Slack's engineering team runs an agentic service that investigates security alerts. A Director agent orchestrates rounds, Expert agents gather evidence, and a Critic scores each finding for credibility. Instead of message history, three written channels carry the state between rounds.
- Company
- Slack
- Approach type
- Agent
- Work
- Security
- Human involvement
- Drafts reviewed
- Invocation
- Event-driven, Interactive
- Deployment stage
- Deployed
- Evidence strength
- Detailed primary
- Entry reviewed
How it works
Director-led investigation rounds from a security alert to a concluded report.
The Director decides what questions to ask and which Experts to engage; investigations run in rounds until the Director concludes them[Source 1]
Experts interrogate their data sources and produce findings that cite investigation artifacts[Source 1]
The Director summarizes the root cause and the recommended actions, and ends the investigation[Source 1]
Where people stay involved
People review, approve, or guide the agent’s work here.
Reported: People supervise investigations and resolve escalated issues; the service investigates and reports.
Supervision level
Work-product review
A person reviews the draft or implementation.
Level 3 of 5
- security alert → investigation report for on-call staff; owning team resolves escalated issues[Source 3]
Implementation details
- Model
- Not reportedNo model is named; the capture states only that a stronger model runs the Critic (source-1, line 174).
- Harness
- Coordinator/dispatcher: a central coordinator dispatches to expert agents and to critic agents[Source 1, Source 2]
- Sandbox
- Not reported
- Tool access
- Expert agents produce reports; critic agents evaluate them using evidence-inspection tools[Source 1, Source 2]
- Knowledge
- Not reportedNo separate knowledge store is documented; evidence lives in investigation artifacts and the channels cited under context management.
- Context management
- Three channels; Director's Journal (working memory), Critic's Review (credibility-weighted findings), Critic's Timeline (deduped chronological synthesis)[Source 1, Source 2]
- Credentials
- Not reported
- Interfaces
- Not reportedNo human-facing surface is named; the service reacts to security alerts.
Mechanisms
Structured working memory: findings, decisions, questions, hypotheses[Source 1, Source 2]
A model consolidates a timeline, removes duplicate events, and weighs conflicting findings between rounds[Source 1]
Validation and failure handling
A model critiques submitted findings, inspects cited evidence, and assigns credibility scores[Source 1]
Reported observations
These results come from the sources. Notes below each result explain what it covers and any reported limits.
Context management for security investigations spanning hundreds of inference requests and megabytes of output[Source 1, Source 2]
- Reported by
- Slack
- Scope
- Complex security investigations requiring tailored multi-agent context; qualitative workload scale
About this result
- Category
- Runtime capacity
- Evidence type
- Qualitative
- What it covers
- Security-investigation workload scale that the context channels are built to handle
Over 170,000 findings scored by the Critic; slightly over a quarter fell below the plausible threshold[Source 1]
- Reported by
- Slack
- Scope
- Critic credibility scores of Expert findings across all reviewed investigations
The source does not report the denominator of this figure.
Observed in 2026
About this result
- Category
- Effectiveness
- Evidence type
- Reported measurement
- What it covers
- Critic credibility scores across over 170,000 reviewed Expert findings
Lessons
Slack passes a director journal, reviewed findings, and a consolidated timeline between investigation rounds instead of forwarding the full message history.[Source 1]
Slack's Experts gather evidence; a Critic checks their findings and can inspect the original tool calls and results.[Source 1]
Catalog interpretation: Slack's context channels preserve information across investigation rounds, but the report does not establish recovery after a worker restart.[Source 1]