Open Executive integrates with Slack, Notion, and Google Workspace to replicate a company’s leadership team using Anthropic’s Claude models, but a shared-workspace design could put employee credentials and confidential documents at risk, according to Cybernews.
A new open-source project that lets companies deploy AI-generated “digital twins” of their executive leadership is drawing scrutiny from security researchers over how it isolates customer data.
Open Executive, built by Sente Labs, uses Anthropic’s Claude Sonnet 5 and Claude Opus 5 models to simulate the voices of nine senior executive roles, including a chief financial officer, chief HR officer, and board communications director, according to a report published by Cybernews. The tool is designed to act as a “digital twin” of a company’s CEO and leadership bench, with the ability to approve spending within configured thresholds, schedule meetings, draft routine correspondence, and, according to its developers, operate autonomously in directing staff and shaping company strategy.
To do that, Open Executive connects directly into the communication and document platforms companies already rely on, including Slack, Discord, Telegram, email, Google Workspace, and Notion, giving the AI system broad visibility into internal conversations and files.
That level of access is exactly what concerns Cybernews information security researcher Rasa Jurgutytė. In the Cybernews report, Jurgutytė warned that the project “has the potential to sacrifice security for more autonomy of AI agents,” and pointed to a specific architectural weakness: Open Executive currently runs in a single shared workspace with no per-user data isolation.
“If, for example, five different companies using the same tool could accidentally access each other’s data through it, it would expose confidential company information,” Jurgutytė said, adding that whether this actually occurs depends on how authorization is configured and enforced.
The concern is notable given how much sensitive material the tool is designed to ingest. Onboarding Open Executive reportedly requires companies to share their business model, revenue figures, and strategic priorities, with the option to upload financial documents directly. Combined with live access to internal chat platforms and document repositories, that creates a wide attack surface if credentials or session data were ever exposed or misconfigured, according to the report.
Sente Labs has pushed back on the characterization that the system is inherently insecure. The company says customer data remains on local machines or within an organization’s own cloud environment, with only API prompts sent to Anthropic for processing. Sente Labs also says it offers the option to deploy Open Executive entirely on a company’s own infrastructure and points to its use of cryptographic signatures and policy languages, including Rego and CEL, alongside configurable authorization and logging controls, as safeguards against the scenario Jurgutytė described.
Alex Cohen, who leads change management and transformation at Sente Labs, has described the tool’s more modest use case as functioning like a standard executive assistant, “scheduling meetings and handling basic responses,” rather than an autonomous decision-maker, even as the project’s marketing leans into the more ambitious “digital twin” framing.
The project has attracted significant attention in its short time on GitHub, where its repository has passed 4,800 stars, reflecting strong developer interest in agentic AI tools built on top of large language models. That popularity is also part of what makes the security question timely: the more organizations that adopt a shared-infrastructure tool like Open Executive without fully vetting its authorization model, the larger the potential blast radius if a data-isolation flaw were ever exploited.
The Cybernews report lands amid a broader industry debate over how much autonomy AI agents should be given over sensitive business systems, and how vendors should be verifying tenant isolation before marketing multi-company deployments. As more startups build executive-replica or agentic-assistant tools on top of foundation models like Claude, questions about data segregation, credential handling, and default security posture are likely to follow each new release.
Leave a Reply