A start-up says its AI agents reached Anthropic's internal systems through third-party software

Cathedral, a cybersecurity start-up, said its AI agents found a way into Anthropic’s internal business systems in under 12 hours, according to a draft report first covered by The Washington Post on 26 October. This account rests on secondary coverage: the Post piece is paywalled, and the sources read here are Decrypt, AI Weekly and Futurism, which relay it. Cathedral’s own report was not available.

According to those accounts, the agents did not get in through Claude or Anthropic’s own code but through flaws in third-party administrative and sales software that many companies use. The draft report said the access exposed meeting transcripts, salary and job-offer details, and Slack messages about advanced models. Cathedral, founded this year by four former staff of the Department of Government Efficiency, took part through Anthropic’s bug-bounty programme. The vendors were not named in the coverage.

Anthropic disputed the scale. It said the researchers reached a “limited set” of sales, HR and IT systems holding business contact details and basic user-account records, and not Claude users’ conversations, source code or model weights. It said its monitoring flagged some of the activity before Cathedral reported it, that it cut off access the same day, that it had no evidence anyone else exploited the flaws, and that it disabled the affected software until the vendors confirmed fixes. It also said Cathedral spent several days trying and failing to break into Anthropic’s own software before turning to the business tools. Anthropic’s timeline therefore differs from Cathedral’s “12 hours”, and the coverage does not reconcile the two.

The disagreement is about the rules as much as the technology. Anthropic said Cathedral did not disclose all of its activity, as the programme required, and overstated the “implied national security implications”. Cathedral’s draft report said data access “was kept to the absolute minimum in accordance with security research best practices”. An anonymous senior Trump administration official told the Post that “if a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.”

Futurism reported that experts saw the episode as exposing a gap in how AI developers manage third-party software providers. It came a day before Anthropic published its own account of an unreleased model building exploit chains against widely used software.