AI agents working for security startup Cathedral found their way into Anthropic’s internal business systems in under 12 hours, the Washington Post reported on Monday, October 26, 2026 — not by breaking Claude, but by exploiting flaws in third-party administrative and sales software. Why it matters: the weakest link around a frontier AI lab turned out to be the ordinary business software every company runs, and AI agents are now fast enough to find those gaps at machine speed.
October 26, 2026
What happened
Cathedral, a cybersecurity startup founded months ago by four former staffers of the Department of Government Efficiency (DOGE), tested Anthropic under the company’s bug bounty program, which invites outside researchers to probe its systems and report what they find. According to a draft of Cathedral’s report reviewed by the Post, its AI agents found routes to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic’s advanced models. Cathedral disclosed the findings to Anthropic earlier this month and also notified the affected software vendors, whose names were withheld for security reasons.
What Anthropic confirms — and disputes
Anthropic confirmed that the researchers reached a limited set of its sales, HR and IT systems, holding business contact details for some customers and partners and basic user account records. It said its own monitoring flagged some of Cathedral’s activity before the report arrived, that it shut off the access the same day, and that it has no evidence anyone else exploited the flaws. Crucially, Anthropic says Claude user conversations, model responses, source code and model weights were not accessed, and it disabled the affected software until the vendors confirmed fixes.
The two sides disagree on the framing. Anthropic says Cathedral overstated the national-security implications and did not disclose all of its testing activity, as the bug bounty rules require. Cathedral’s draft says its researchers kept data access to the absolute minimum, in line with security-research practice. Anthropic also notes the researchers spent several days failing to get into its own software directly before turning to the third-party applications.
Why it matters
Strip away the dispute and the core fact stands, confirmed by Anthropic itself: autonomous agents chained together weaknesses in common business tools and reached sensitive internal data at one of the world’s leading AI labs in hours. That is the offensive-capability story of 2026 in miniature — the same dynamic behind Anthropic’s own past disclosures about AI-driven hacking campaigns, now pointed at an AI company. For any business rolling out agents, the lesson is unglamorous: your exposure is your whole software stack, including the sales and HR tools nobody thinks of as attack surface, and agent-speed offense means slow, periodic security reviews no longer match the threat.
Frequently asked questions
Did Cathedral hack Claude itself?
No. Both sides agree the entry point was third-party administrative and sales software Anthropic uses, not Claude or Anthropic’s own model systems.
What data was reached?
Cathedral’s draft says meeting transcripts, salary and job-offer details, and Slack messages about advanced models. Anthropic describes a more limited set: sales, HR and IT systems with business contact details and basic user account records — and says no user conversations, source code or model weights were touched.
Was this an illegal break-in?
No — the test ran under Anthropic’s bug bounty program for outside security researchers, though Anthropic says Cathedral did not fully follow the program’s disclosure rules, which Cathedral disputes in substance.
Sources: The Washington Post (via Decrypt), TechStartups