The Specific Event

This week, BBC reported that hundreds of private conversations with Anthropic's Claude chatbot were discovered to be publicly accessible online. The exposure was not the result of a sophisticated cyberattack. The conversations were simply findable. Separately, an Anthropic product executive, Dianne Penn, gave an interview describing how she uses Claude as part of her active management toolkit, embedding the chatbot into daily decisions about her team. These two stories appeared within the same news cycle, and the juxtaposition is worth examining carefully. One story describes an organization promoting AI as a managerial competency. The other describes that same organization's product leaking user data at scale. The tension between these two data points is not incidental. It is structurally informative.

Competence in the Wrong Direction

The framing of Penn's interview follows a pattern that organizational researchers should recognize immediately. A senior executive demonstrates fluency with a tool, describes specific workflows, and positions that fluency as a model for others. This is, in essence, a competence signal. The implicit argument is that AI adoption at the managerial level represents organizational sophistication. What the Claude data exposure reveals, however, is that competence in using a tool and competence in understanding what that tool is doing with your information are not the same thing. This distinction maps directly onto what Kellogg, Valentine, and Christin (2020) describe as the fundamental problem of algorithmic work: workers interact with systems whose internal logic remains opaque, and their operational fluency masks rather than resolves that opacity.

The Awareness-Capability Gap in Institutional Settings

My dissertation research on the Algorithmic Literacy Coordination framework focuses on a specific puzzle: workers who are aware that algorithms govern their outcomes still fail to improve those outcomes. Awareness does not produce capability. The Claude incident extends this logic into a different but structurally parallel domain. Anthropic's own internal executive was presumably aware that Claude processes and stores conversational data. That awareness did not translate into organizational protocols robust enough to prevent public exposure of user conversations. The gap here is not between knowing and not knowing. It is between surface-level operational awareness and genuine structural understanding of what the system does with information at the infrastructure level. Gagrain, Naab, and Grub (2024) make a related point about algorithmic media use: individuals develop folk theories about how platforms behave, but these folk theories systematically underestimate the complexity of backend processes.

What Organizational Theory Predicts Here

From an organizational theory standpoint, the Anthropic case is a fairly clean example of what happens when institutions adopt tools faster than they develop governance schemas for those tools. The managerial enthusiasm Penn describes is real and probably produces genuine short-term value. But Hatano and Inagaki's (1986) distinction between routine expertise and adaptive expertise is directly applicable. Routine expertise means knowing how to use Claude to summarize meeting notes or draft performance feedback. Adaptive expertise means understanding the conditions under which that usage creates institutional exposure, and being able to adjust behavior when those conditions change. The BBC story suggests Anthropic, as an organization, had not fully developed the second form of expertise with respect to its own product's data handling.

The Governance Schema Deficit

This is not primarily a story about a data breach. It is a story about schema deficits in organizational AI adoption. Institutions adopting AI tools are largely building procedural competence, the equivalent of knowing which buttons to push, without building the structural schemas that would allow them to reason about novel failure modes. Hancock, Naaman, and Levy (2020) argue that AI-mediated communication introduces accountability ambiguities that existing organizational structures are not designed to handle. The Claude exposure is one concrete instance of that ambiguity materializing. When an executive uses an AI tool for team management, who owns the conversational data generated in that process? What is the organization's theory of where that data lives and who can access it? The absence of public answers to those questions at Anthropic, of all organizations, is notable.

The Practical Implication

Organizations adopting AI tools for internal management need to distinguish between tool training and schema training. Teaching managers to use Claude effectively is a procedural intervention. Teaching them to reason about data residency, access permissions, and failure modes is a structural one. The ALC framework predicts that structural training produces better transfer across novel situations precisely because it targets principles rather than procedures. The Anthropic incident this week is a case study in what happens when only the procedural layer gets built out. The gap between Penn's confident managerial AI usage and the exposure of user conversations is not a contradiction. It is exactly what the awareness-capability gap predicts at the institutional level.