Every day seems to bring new excitement—or in the case of Amazon employees, trepidation—around AI agents that aim to perform any white-collar task involving a computer. Monday night, for instance, Anthropic announced its latest march in this direction with a version of its Claude chatbot that can take over your computer and operate any enterprise application the way humans do. But not every enterprise software firm is open to allowing people to use Claude or other AI agents to access enterprise apps, as we have long covered in this column. Now there’s a ranking showing which apps are most open or closed-off to such agents.
Monday night, for instance, Anthropic announced its latest march in this direction with a version of its Claude chatbot that can take over your computer and operate any enterprise application the way humans do. But not every enterprise software firm is open to allowing people to use Claude or other AI agents to access enterprise apps, as we have long covered in this column.
Now there’s a ranking showing which apps are most open or closed-off to such agents.
The ranking, from startup Arcade.dev, shows that the most closed-off apps are Slack, Workday, Meta’s platform for advertisers and Whatsapp. On the other hand, GitHub and Figma are the most open.
Arcade sells software for companies to manage their AI agents and has worked with Anthropic to develop part of Model Context Protocol, the open source standard that allows AI agents to interact with software applications. In other words, Arcade has a dog in the fight over app openness to AI agents.
Last week, the startup launched ToolBench, a tool that rates other companies’ MCP servers, which is akin to an application programming interface that allows AI agents to take an action involving apps, such as deleting a folder in Google Drive.
People can also use Claude and OpenClaw agents to access enterprise and messaging apps in a way that bypasses MCP altogether. That helps explain why stock market investors and other observers view such AI agents as a threat to enterprise apps. If customers primarily access apps with their AI agents, that would potentially hurt the apps’ ability to sell new products and features to existing customers.
While Slack, Workday and other enterprise apps say they envision a future in which AI agents and humans alike use their apps, that support isn’t necessarily equal, according to Arcade’s analysis.
For instance, Slack limits requests customers can make from the app when they use an outside AI agent like Claude to get data from Slack or automatically send a message through Slack, according to Arcade’s report. That mirrors the dynamic we first reported on with Slack nine months ago, when it was making it tough for its customers to use AI search tool Glean to access their Slack data.
Salesforce, which owns Slack, declined to comment on the Arcade report, but it has previously said that limits it has placed on external AI access is rooted in the need to protect customers’ data. To be sure, Slack’s MCP server allows AI agents from 12 partners including OpenAI, Anthropic, Cursor, and Perplexity to access Slack. Despite the access, AI agents face limits on the number of actions they can take in Slack, Arcade found.
Workday is similar. While the HR app maker has developed a tool for customers to access Workday using external AI agents, the company makes it difficult for customers to use agent-related tools such as Arcade’s, the startup said.
Security Reasons
“For companies trying to connect AI assistants across multiple business apps, Workday becomes a dead end,” Arcade’s report said.
For its part, Workday said there are important security reasons for any limits it puts on AI agent-related access.
“We’re the system of record for highly sensitive HR and financial data,” a spokesperson said. “We’re expanding the approved ways that customers and partners can connect agents” to Workday, they said. (The company has said it plans to make money charging for AI agent access to its software.)
Meanwhile, Meta’s ad tools and messaging platform Whatsapp don’t include built-in support for MCP, nor do LinkedIn or Discord, another messaging app.
It’s not hard to imagine that those firms may be wary of customers’ AI agents going rogue or posting so-called AI slop in people’s messaging feeds. (As my colleague Jyoti reported last week, even Meta employees have struggled with the security risks posed by AI agents.)
The big question is whether customers will come to expect that their enterprise, social and messaging apps will give access to the customers’ external AI agents. And if the apps don’t, will the customers do anything about it?
Join The Information at the New York Stock Exchange on Monday, April 27, to hear from top executives and investors on how the rapid buildout of AI is reshaping tech, finance, and capital markets
Save the date for The Information’s annual AI Agenda Live in San Francisco, where top AI researchers, founders, investors and executives come together for a day of conversations about the breakthroughs and applications shaping the future of AI.
