AI agents breach Anthropic: Startup gets in through third-party software

What this is about

Security startup Cathedral used AI agents to compromise internal systems at Anthropic, the developer of the Claude models. The way in wasn't through Anthropic's own core systems, but through external business software for administration and sales. It all happened under Anthropic's bug bounty program, in which outside security researchers hunt for vulnerabilities and get rewarded for them. Cathedral reported the access in a draft report that the Washington Post was able to review. Anthropic partly confirmed the incident but disputes several points.

What Cathedral reports

Cathedral sells AI-powered security tools to government agencies and companies. It was founded by former staffers of the US body DOGE (Department of Government Efficiency). According to a Chinese-language report from InfoQ, investors value the company at $1.4 billion, it has raised $160 million according to PitchBook, and investors Marc Andreessen and Shaun Maguire sit on its board. Co-founder Gavin Kliger became the Pentagon's Chief Data Officer after his time at DOGE.

According to Cathedral's report, AI agents running advanced models found paths to meeting transcripts, salary data, job offers and Slack messages in under twelve hours. These included discussions about Anthropic's advanced AI models. The researchers say they exploited vulnerabilities in commercial software used by Anthropic and many other companies. Cathedral says it also notified the affected software vendors but didn't name them for security reasons. It says it followed best practices and limited data access to the absolute minimum. The report speaks of a "serious gap": offensive capabilities are growing while defenses fail to keep up.

What Anthropic says

Anthropic admits access to a "limited" selection of data from sales, HR and IT systems: contact details of individual customers and partners, plus basic user account data. It says chats with Claude, model responses, source code and model weights (the learned parameters of the models) were not affected. Monitoring had spotted parts of the activity before Cathedral's report, and access was shut down the same day. The affected third-party software was taken offline until the vendors had fixed the flaws, and US federal agencies were informed. Anthropic says there is no evidence that anyone other than Cathedral exploited the vulnerabilities.

Dispute over duration, scope and rules

Red teamer Logan Graham said that attacking third parties and pulling data went beyond the program's safe harbor protection. (Safe harbor promises researchers legal immunity as long as they follow the rules.) He did welcome the discovery of the vulnerabilities. According to InfoQ, Anthropic also accuses Cathedral of exaggerating the "national security implications" of its findings. A Cathedral spokesperson declined to comment, according to the same report.

Rumors of full Slack access

Former OpenAI employee Will Depue claims Anthropic is downplaying the incident. Several sources he considers very reliable told him that Cathedral had full admin access to the Slack workspace, could read every message and could log in to any account. Both labs keep research secrets in Slack, he says, and admin API keys are scattered around. This is an unsubstantiated claim. Graham pushed back: Depue's sources are wrong, though he gave no details because of their sensitivity. He did endorse the underlying point that the industry has to reinvent its security every year. Depue called on Anthropic to disclose what was actually accessed and criticized the pace of the AI race.

Jacob Coxon, who left Anthropic in September 2026, had previously criticized the fact that dangerous AI research runs through office software like Slack. According to InfoQ, he called it a "bet born of hubris."

Expert views and Graham's warning

Alex Stamos, chief security officer at Cognition (which uses Anthropic models), told the Washington Post the findings were significant. Connected third-party apps are a huge problem for everyone, he said, and Anthropic could have secured its external services better.

Graham used the incident to issue a warning: attackers are running AI agents around the clock and deliberately targeting external dependencies. Models half a generation to a full generation behind the frontier are enough for that, and future attackers will have stronger ones. His advice: constant in-house red teaming (attack tests against yourself) and rebuilding software with formal verification, meaning mathematical proof of correctness, which AI is making economically viable. "You probably want to be red-teaming yourself constantly. Current models are very creative," he wrote.

Our take

The case shows that even a company with access to presumably very strong cyber-defense models is vulnerable through its supply chain. The weakest link was third-party tools, not the models. How deep the access really went remains open. Cathedral's report, Anthropic's account and Depue's rumors contradict each other, and little has been independently verified. Cathedral's own interest as a vendor of security products, and the allegations of rule violations, also need to be taken into account. It also remains unanswered how Cathedral got so far despite Anthropic's defenses; Graham didn't address that. InfoQ previously also reported on the FBI's arrest of an OpenAI employee over a recording device in the boardroom, and on a hacker who allegedly used Claude to attack OpenAI. Both are signs of how tense the security situation at AI labs is.