A security startup's AI agents didn't need to attack Claude to get inside Anthropic. The sales, admin and HR software wired into the company's internal systems was enough. Anthropic confirms the intruders reached part of its sales, HR and IT systems; how long it took and how far they got is still being argued over.
What happened
Cathedral, a cybersecurity startup founded by former DOGE staffers that sells AI security tools to governments and businesses, took part in Anthropic's bug bounty program. According to a draft of its report reviewed by The Washington Post (published October 26, 2026), its agents, running advanced models, found paths to meeting transcripts, salary data, job offers and Slack messages in under twelve hours.
The way in wasn't Anthropic's own code but external admin and sales applications integrated with its systems. According to Logan Graham of Anthropic's red team, Cathedral spent several days probing the company's own systems before pivoting to that third-party software, where it found two vulnerabilities. It reported only one; Anthropic found and patched the second itself.
| Cathedral | Anthropic | |
|---|---|---|
| Duration | Under 12 hours | Attempts spread over several days |
| Scope | Transcripts, salaries, job offers, Slack | Some sales, HR and IT systems: customer and partner contacts, basic account data |
| Claude chats, source code, weights | — | Never exposed |
| Bug bounty rules | Standard research practice | Incomplete disclosure; targeting vendors and pulling data went beyond safe harbor |
Anthropic's response went by the book: it shut the access points the same day it found the breach, disabled the third-party apps until the issue was fixed, and notified US federal authorities.
Why it matters beyond Anthropic
The striking part isn't that an AI lab had an incident, but where it came from. Anthropic is arguably the organization best equipped to defend against AI-led attacks, and the weak link was still a set of SaaS integrations that few teams treat as attack surface. Alex Stamos, chief security officer at Cognition, put it plainly to the Post: integrated third-party apps are a major problem across the industry.
For anyone running systems, three lessons stand out:
- Integrations are production. A CRM or HR app holding a token that can read Slack or the directory has as much reach as an internal service, yet it rarely gets the same review, credential rotation or monitoring.
- Reconnaissance has become cheap. Graham warns that attackers already run agents against external dependencies around the clock, and that models half a generation to a full generation behind the frontier are good enough for the job. What once took a team weeks is now a process that runs on its own.
- Red team yourself, constantly. Graham's answer is continuous in-house penetration testing with the same models and, longer term, rebuilding software with formal verification, which he argues AI finally makes affordable. "You probably want to red team yourself all the time," he wrote.
It also raises an awkward question for bug bounty programs: what happens when the researcher is an agent that chains through vendors in hours, and the safe harbor was written for humans testing a specific domain? The fact that Anthropic and Cathedral disagree on whether the rules were followed suggests many programs will need to spell out whether connected vendors are in scope.
What we still don't know
The real scope is disputed. Former OpenAI employee Will Depue claims, citing sources he considers reliable, that Cathedral got full admin access to Anthropic's Slack and could log into any account. Graham denies it, without going into specifics given the sensitivity. The affected vendors and the specific flaws haven't been named either, which is exactly what other companies would need to check whether they run the same software.
Sources
- AI agents hacked Anthropic, maker of arguably the most capable AI models for cyberdefense, The Decoder, October 28, 2026.
- Researchers at cybersecurity start-up Cathedral got inside Anthropic, The Washington Post, October 26, 2026.