Cathedral, a cybersecurity company only a few months old, says its AI agents found a path into Anthropic's internal business systems in under 12 hours, reaching meeting notes, payroll and offer information, and employees' Slack messages about frontier models. Anthropic later confirmed that some sales, HR and IT systems were indeed accessed, but said that customers' prompts to Claude, Claude's responses, source code and model weights were not touched.
The test was run under Anthropic's vulnerability bounty framework for outside researchers, which makes it authorized testing rather than a criminal intrusion. The story was first reported by The Washington Post, which based its account on a draft of Cathedral's report.
The way in was through vendors
According to what has been made public, Cathedral's agents did not go after Anthropic's own code and did not touch its models. They targeted several third-party commercial applications the company uses for administration and sales. Neither side has said which vendors are involved or what the specific vulnerabilities were, citing a wish to prevent anyone from reusing them; the vendors concerned have been notified.
Anthropic's account of its response runs as follows: its monitoring systems had already flagged some of the activity before Cathedral reported it; on the day the report arrived it cut off access and took the affected business software offline, and it re-enabled the tools only after the vendors confirmed fixes. The company also said it found no sign that anyone other than Cathedral had exploited the weaknesses.
Two versions that do not match
The disagreement centers on two points. Anthropic argues that Cathedral overstated the national-security implications and did not fully disclose everything it did inside the systems, as the bounty rules require. Cathedral replies that it followed standard security-research practice and limited its data access to the minimum necessary.
The two sides also describe the contents of the affected systems differently. Cathedral's draft lists meeting minutes, compensation and Slack discussions; Anthropic describes business contact details and basic account records for some customers and partners. Outsiders cannot currently verify which version is closer to the truth, and Cathedral's report has not yet been finalized or published.
Where the company comes from
Cathedral's four co-founders, Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all worked at DOGE, and Kliger also served as chief data officer at the Pentagon. Reuters reported in July that the company had raised $160 million at a valuation of $1.4 billion, led by a16z and Sequoia, with a focus on AI cyber-warfare tools for the US military that work for both offense and defense. A senior government official told The Washington Post that three federal agencies have already signed contracts with it.
Put the timeline together: money in July, and by October a public case against a leading AI lab. Outsiders cannot know what Cathedral weighed in choosing its target, but the fact that Anthropic took the trouble to rebut the "national-security impact" claim suggests it does not want the test to be read as a major breach.
A check for companies in China
The lesson for Chinese companies is direct. Most enterprises also run HR, CRM, collaboration and single sign-on on external SaaS, with permissions often granted in full and OAuth tokens rarely revoked. The route Cathedral demonstrated is one in which an agent compresses "find a weaker vendor and follow the chain of authorization inward" into half a day.
The fixes are not complicated: inventory which outside applications are connected to internal data, reconfigure them to least privilege, periodically audit long-lived tokens, and set alerts for abnormal account behavior. It was the last of these that let Anthropic spot some of the activity ahead of the report this time.
Sources: The Washington Post, Cyber Security News, CocoLoop, Reuters; Cathedral's funding and valuation follow Reuters reporting, and the scope of access was checked against both Anthropic's statement and the description in Cathedral's draft report.