Category: AI Agent Security | Reading time: 3 min
Cathedral, a security startup founded months ago by four former DOGE staffers, says its AI agents found a way into Anthropic's internal business systems in under 12 hours. The way in was not Anthropic's models. It was third-party sales and admin software connected to the company. The Washington Post first reported the findings on October 26, based on a draft Cathedral report.
What Cathedral says
Cathedral tested Anthropic through Anthropic's HackerOne bug bounty program. According to the Post, human researchers tried for days, then Cathedral's agents found a path through third-party admin and sales software in under 12 hours. Cathedral's draft report describes reaching meeting transcripts, salary and job-offer details, and Slack messages. Cathedral raised $160 million at a $1.4 billion valuation in July, according to Decrypt.
What Anthropic says
Anthropic confirmed access to "a limited set" of sales, HR and IT systems containing customer and partner business contact details and basic user account records. It says Claude chats, source code and model weights were never reached. "Our monitoring flagged some of Cathedral's activity before they reported it to us... we shut off their access the same day," the company said. Anthropic disabled the third-party programs involved, notified federal authorities, and says it has no evidence anyone else exploited the flaws.
Logan Graham, who leads Anthropic's red team, said Cathedral found two vulnerabilities but reported only one, and that Anthropic patched the second. He said targeting vendors and pulling data went beyond the bug bounty's safe harbor. Cathedral disputes Anthropic's account. Former OpenAI researcher Will Depue claimed the access included full Slack admin rights; Graham says those sources are wrong. Anthropic has not named the third-party software.
Why it matters for companies running agents
Two points hold regardless of how the dispute ends. First, the entry point was the ordinary business software wired into the company, a problem Alex Stamos, CSO of Cognition, told the Post is industry-wide. Second, Graham noted that attackers can now run agents around the clock against a company's outside dependencies, and that models half to a full generation behind the frontier are already capable enough to do it. His recommendation: continuous self red-teaming.
For regulated companies, every connected tool an agent or an attacker can reach is part of the audit surface. Being able to show which actions were allowed, by whom, and when, with records that can't be quietly edited afterward, is what separates a contained incident from an argument over what happened.
Source: The Washington Post, The Decoder, Decrypt, TechRadar