Security Startup's AI Agents Got Into Anthropic's Business Systems, and Both Sides Tell It Differently

The Decoder reported on October 28, citing a draft Washington Post report, that researchers at the security startup Cathedral used AI agents to get into some of Anthropic’s business systems. Cathedral sells AI-powered security tools to governments and companies. Its team was working under Anthropic’s own bug bounty program, which pays outside researchers who report flaws. The details are disputed, so treat everything below as reported rather than settled.

According to the report, the agents got in through third-party business software, specifically external admin and sales programs, not through Anthropic’s own AI systems. Cathedral says it found meeting transcripts, salary data, job postings and Slack messages within hours. Anthropic confirms access to a limited set of sales, HR and IT systems, including some customer and partner contact details and basic account data. It says Claude conversations, source code and model weights were never exposed. Anthropic also says Cathedral probed its internal systems for days first, found two vulnerabilities but reported only one, and that Anthropic found and fixed the second itself. Cathedral says it followed standard research practice and that it took under 12 hours.

Anthropic shut off the affected access points the same day, disabled the third-party programs until fixed, and notified US federal authorities. It argues Cathedral went beyond the program’s “safe harbor” (the protection that normally shields good-faith researchers) by targeting third-party providers and pulling data. A former OpenAI employee claims Cathedral had full admin access to Anthropic’s Slack. Anthropic’s Logan Graham says that claim is wrong but gave no specifics. Alex Stamos, a security chief at Cognition, called the findings significant and said integrated third-party apps are an industry-wide weak spot.

What’s behind it: the interesting part is less the break-in than the method. AI agents can now probe a company’s systems tirelessly, and the weakest door is often a vendor’s tool rather than the company’s own code. Graham wrote that “current models are very creative,” and recommended continuous in-house testing. Meanwhile, bug bounty rules were written for human researchers, and arguments about what counts as “in scope” are likely to get louder.

What this means for you: if you are an Anthropic customer, the company says chat content was not touched, though contact details in sales systems may have been. If you run a small business, check which third-party tools hold your data and what they can reach. Strong passwords and access limits on those tools matter as much as the main app.

Sources

• The Decoder: AI agents hacked Anthropic