Claude almost sent internal notes to a client — nothing was “wrong”

I’ve been testing Claude with real tools (Slack, email, etc). Ran into this: permissions were valid request looked normal no prompt injection But it was about to send internal meeting notes to a client. Nothing malicious — just wrong context. We ended up