Cathedral's AI agents got into Anthropic via third-party software

An AI agent red team got into Anthropic's internal systems in under 12 hours. It did not break Claude. It went around it. Cathedral, a security startup, says its AI agents found paths in by exploiting weaknesses in third-party business software, according to a draft report reviewed by The Washington Post. If an AI lab with a large security team has this gap, your helpdesk, HR and CRM tools have it too.

What actually happened: AI agents vs. Anthropic's vendor stack

The test ran under Anthropic's program that rewards outside researchers for finding vulnerabilities. Per Gizmodo's summary of the Post report:

• Cathedral's researchers first spent several days trying to break Anthropic's own software directly, and failed. Anthropic said this.
• They then turned to third-party business software. Cathedral says its agents took less than 12 hours to find paths to sensitive data.
• Cathedral says that data included meeting transcripts, salaries and job offers, and Slack messages.
• Anthropic confirmed access to a "limited set" of its sales, HR and IT systems, including business contact information for customers and partners and some basic user account records. It says the researchers did not reach Claude user conversations, source code or model weights.
• Anthropic says Cathedral broke the program's rules by not disclosing the full extent of its activity. The two sides disagree about how serious the findings are.

Neither report names the vendor software. Cathedral was founded by former DOGE staff and is valued at $1.4 billion.

Why it matters for your business

The lesson is not "Anthropic got hacked." The lesson is where the agents went. Your core app gets your attention. The ten SaaS tools around it do not: the ticketing system, the HR platform, the scheduling app, the CRM with an old admin account from a contractor.

AI agents make that boring surface cheap to search. An attacker no longer needs a person to try every login page and every forgotten integration. An agent can do it all night.

What we do for clients:

• List every SaaS tool with admin access to company data. Include the ones a single department bought on a card.
• Remove stale admins. Former staff, contractors, trial integrations. Enforce SSO and MFA where the vendor supports it.
• Check what each OAuth app can read. A scheduling plugin does not need your whole Google Drive.
• Keep sensitive records out of chat. Salaries and offers in Slack threads are a gift to whoever gets in.

Sources: The Washington Post, Gizmodo.