Cybersecurity startup Cathedral says AI agents it deployed found a way into Anthropic’s internal business systems through third-party software. Anthropic confirmed that researchers accessed a limited set of sales, human resources and IT systems, including contact details for some customers and partners and basic account data.
Anthropic says the breach did not expose Claude conversations, source code or model weights. It shut off the affected access points on the day it discovered the breach, disabled the third-party programs while it worked on the problem, and notified U.S. federal authorities. The company has not publicly specified exactly what records the researchers viewed or how many people were affected.
Cathedral sells AI-powered security tools to businesses and government agencies. Its researchers said in a draft report reviewed by The Washington Post that their agents reached material including meeting transcripts, salary information, job postings and Slack messages in under 12 hours. Those claims sit alongside Anthropic’s narrower account of the data accessed; the two sides disagree about the incident’s duration and reach.
What the two sides dispute
Cathedral describes the incident as taking less than 12 hours. Anthropic says the overall effort lasted several days: its red teamer Logan Graham said the researchers spent days probing Anthropic’s systems before turning to third-party software. Cathedral found two vulnerabilities there, Anthropic says, but reported only one; the company says it independently found and fixed the other.
Anthropic also says Cathedral’s actions breached the rules of its bug bounty program, which pays or recognizes researchers for reporting security flaws. Graham said targeting third-party providers and pulling data went beyond the program’s safe harbor protections. Cathedral maintains that it followed standard security research practices. Graham welcomed the discovery of the vulnerabilities but declined to give more detail about what was accessed, citing the sensitivity of the matter.
The most expansive claims remain contested. Former OpenAI employee Will Depue said sources he considered reliable told him Cathedral had full administrator access to Anthropic’s Slack workspace and could read every message and log in as any user. Graham said Depue’s sources were wrong. Anthropic has not provided a public accounting that resolves the disagreement, so those claims should not be treated as confirmed findings.
How we got here
The reported entry point was not Claude itself, but external sales and administrative software connected to Anthropic. That distinction matters: the company says its AI chats and model assets remained untouched, while the incident still exposed some business systems and information. Security executive Alex Stamos, of AI company Cognition, told The Washington Post that integrated third-party apps are a significant problem across the industry and that Anthropic could have better secured its external services.
The incident also shows how security testing tools can be used to find weaknesses quickly. Graham said attackers already run AI agents continuously and target outside dependencies, and that systems well behind the newest models can still be capable enough for this work. These are his assessments, not evidence that every AI agent can break into a company’s network. Cathedral’s account describes a specific effort that found vulnerabilities in linked business software.
What happens next
Anthropic says it disabled the affected third-party programs until the issue was resolved and patched the vulnerability it found itself. The company has not announced a public account of all the records Cathedral accessed, and the competing descriptions of the breach remain unresolved. The Decoder reports that Graham’s proposed response is continuous internal penetration testing—authorized attempts to find weaknesses—and rebuilding software with formal verification, a method for checking that software follows specified rules.
For other companies, the practical lesson is to examine the outside services connected to internal systems, not just the security of their own products. But the available details do not show whether Cathedral’s findings point to a flaw shared by particular vendors or a setup unique to Anthropic. Nor do they establish that customer data beyond contact information was accessed.
Why it matters
For companies that connect sales, HR or other business apps to internal systems, the incident is a reminder that those connections can expose data even when a core AI product is not breached. Anthropic says Claude chats and model assets were not accessed, but confirms some business information was. The extent of the access is still disputed, and Anthropic has not publicly detailed exactly what records were viewed.
