AI agents hacked Anthropic through third-party business software

Cybersecurity startup Cathedral used AI agents to access Anthropic internal systems through third-party business software during the AI lab's bug bounty program. Cathedral says agents found Slack messages, salary data, and other internal records within hours, while Anthropic says attempts lasted several days and source code and model weights were never exposed. The incident highlights how AI agents can probe corporate networks around the clock at low cost.

Cathedral's reported access

Cathedral, founded by former employees of DOGE, sells AI-powered security tools to government agencies and businesses. Its draft report, reviewed by The Washington Post, says researchers entered through external admin and sales programs. AI agents running advanced models found paths to meeting transcripts, salary data, job postings, and Slack messages in under twelve hours. Anthropic confirmed limited access to sales, human resources, and IT systems, including some customer and partner contact information and basic user account data. Chats with Claude, source code, and model weights were never exposed. Anthropic shut down affected access points the same day, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities.

Dispute over data and duration

Cathedral says the incident took less than twelve hours. Anthropic says the attempted attack stretched over several days, and that Cathedral pivoted to third-party software only after days of probing Anthropic's own systems, according to red teamer Logan Graham. Anthropic says Cathedral found two vulnerabilities in third-party software but reported only one, patching the second itself. Anthropic also accuses Cathedral of violating bug bounty rules through incomplete disclosure and says targeting third-party providers and pulling data went beyond safe harbor provisions. Cathedral maintains it followed standard security research practices. Former OpenAI employee Will Depue claimed Anthropic is downplaying the incident, saying reliable sources told him Cathedral gained full admin access to the Slack workspace, could read every message, and could log into any user account. Depue added that both Anthropic and OpenAI stored all research secrets in Slack, with admin API keys scattered across systems. Jacob Coxon, an Anthropic employee who left in September 2026, had previously criticized Anthropic for running dangerous AI research on office software like Slack. Graham pushed back, saying Depue's sources were wrong, while confirming the broader concern that the industry must reinvent security every year. Depue pressed for details and blamed the pace of the AI race, where executives prioritize speed over security. Alex Stamos, chief security officer at Cognition, told The Washington Post he considered the findings significant and said integrated third-party apps are a major industry problem.

AI agents and defense

After months of warnings about AI-powered cyberattacks and its own accidental security incidents, Anthropic is now on the receiving end. Graham warned that attackers already run AI agents around the clock, targeting external dependencies. Even models half a generation to a full generation behind the current frontier are capable enough, he said, and future adversaries will have more powerful systems. Graham's answer is continuous in-house penetration testing and rebuilding software with formal verification, which AI now makes economically viable. He wrote that companies probably want to red team themselves all the time because current models are very creative. He did not address how Cathedral penetrated so deeply despite Anthropic having access to what are arguably the world's most powerful AI models for cyberdefense.

Sources: The Decoder