Anthropic confirms Cathedral's AI agents reached sales, HR and IT systems through third-party software

1 hour ago

7 min read

Anthropic has confirmed that researchers from Cathedral, a young AI-driven cybersecurity startup, gained access to a "limited set" of the company's sales, HR and IT systems during testing carried out under Anthropic's program for outside security researchers. According to the company's statements, the access came through vulnerabilities in third-party business software rather than through Claude, Anthropic's own code or its model infrastructure, and it did not extend to customer conversations with Claude, model responses, source code or model weights.

The episode became public on October 26, 2026, when details of a draft Cathedral report circulated in press coverage. Cathedral says its autonomous AI agents found routes into Anthropic's internal environment in less than 12 hours, after its researchers had spent several days trying, without success, to break into Anthropic's own software directly. Cathedral describes the result as evidence that weaknesses in ordinary enterprise software can compromise even the most advanced organizations. Anthropic accepts that the access happened, but disputes how Cathedral conducted and framed the work.

The two accounts differ on what was actually reached and on what it means. Cathedral's draft report, as described in coverage, lists meeting transcripts, salary and job-offer details, and Slack messages discussing Anthropic's advanced models among the material its agents could reach. Anthropic describes the exposure in narrower terms: business contact information for some customers and partners, and basic user account records held in those sales, HR and IT systems. Neither company has published the report, named the affected vendors or released technical details of the vulnerabilities.

This article sets out what each side has stated, what remains unverified, and what the incident means in practice for organizations that use Claude and for security teams running AI agents against their own infrastructure.

··········

WHAT ANTHROPIC HAS CONFIRMED.

Anthropic's position, as stated to the press, has five main elements. The first is the scope: Cathedral reached a limited set of sales, HR and IT systems containing business contact details for some customers and partners and basic user account records. The second is what was not reached: according to Anthropic, the researchers did not access customer prompts or conversations with Claude, Claude's responses, Anthropic's source code or model weights.

The third element concerns detection. Anthropic said its monitoring flagged some of Cathedral's activity before Cathedral reported its findings, and that it shut off the researchers' access the same day. The fourth concerns remediation: Anthropic disabled the affected third-party software and brought it back only after the vendors confirmed that fixes were in place. The company also said it has no evidence that anyone other than Cathedral exploited the same weaknesses.

The fifth element is the dispute. Anthropic said Cathedral did not fully follow the rules of its researcher program because it did not disclose the full extent of its activity inside Anthropic's systems, and that Cathedral overstated the national security implications of what it found. Anthropic has not published a standalone statement or blog post on the incident; its account so far consists of statements given to journalists. As of the latest reports, it had not announced any legal action against the startup.

........

Item	Cathedral's draft report (as described)	Anthropic's statement
Entry point	Vulnerabilities in third-party business software	Third-party software used for sales, HR and IT
Time to access	Under 12 hours with AI agents	Not disputed
Data reached	Meeting transcripts, salary and offer details, Slack messages	Business contacts of some customers and partners, basic account records
Claude conversations	Not claimed	Not accessed
Source code and model weights	Not claimed	Not accessed
Program rules	Data access kept to the minimum	Not fully followed; activity not fully disclosed

........

··········

HOW CATHEDRAL'S AGENTS GOT IN.

The technical path described so far is indirect. Cathedral's researchers first targeted Anthropic's own software and, by Anthropic's account, spent several days failing to get through. They then turned to the commercial software Anthropic uses for administrative and sales work, the kind of software-as-a-service tools that many companies run alongside their core products, and their AI agents found exploitable weaknesses there in under 12 hours.

Cathedral's agents are designed to carry out multi-step tasks without a human approving each action, which is what allowed the search to move quickly once the target shifted. The draft report reportedly frames this as the central lesson: an organization can harden its own code and still be exposed through the integrations, permissions and data flows of the third-party tools its staff use every day.

What has not been disclosed is just as important. The vendors have not been named, reportedly so that the vulnerabilities could be patched before details became public, and neither party has described the specific flaws, the permissions the agents obtained or how long access was maintained before it was cut off. Without those details, the claim that agents reached "sensitive" material cannot be checked independently, and the gap between Cathedral's list of reachable data and Anthropic's narrower description cannot yet be resolved.

··········

WHO IS BEHIND CATHEDRAL.

Cathedral is a months-old startup focused on AI-driven security work with military applications. It was co-founded by Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all former staff of the Department of Government Efficiency (DOGE). Kliger later served as the Pentagon's chief data officer, a role that, according to press reports, involved him in the Pentagon's dispute with Anthropic.

The company has reportedly raised $160 million at a $1.4 billion valuation, with backing from Andreessen Horowitz and Sequoia Capital, and has contracts with three federal agencies. A senior Trump administration official, speaking anonymously, said Cathedral's findings had circulated inside government and raised national security concerns about what foreign adversaries could do with similar access to a frontier AI lab. These points come from unnamed or secondhand sources and have not been confirmed by Anthropic; Anthropic's own position is that the national security framing is overstated.

The background matters for reading the dispute. A security firm with close government ties publishing findings about a lab that has been in conflict with the Pentagon will be read by some as a policy argument as much as a technical one. That does not make the technical findings wrong, and Anthropic has confirmed the core fact of access, but it explains why the two companies' descriptions of the same event diverge so sharply.

··········

WHAT CHANGES FOR CLAUDE USERS AND ENTERPRISE CUSTOMERS.

For people who use Claude, the most relevant statement is Anthropic's assurance that conversations, prompts and model outputs were not accessed. Nothing in the confirmed facts suggests that a Claude account holder needs to change how they use the product, and Anthropic has not announced any user-facing action such as password resets or account notifications tied to this incident.

Enterprise customers and partners sit in a different position. Anthropic has confirmed that business contact information for some customers and partners was in the affected systems, and while the company has not itemized the fields, records in sales and account-management tools typically include names and work contact details. That kind of data is valuable to attackers for targeted phishing. Organizations that work with Anthropic commercially have reason to expect, and to ask for, a clear account of whether their contacts were among those exposed, even though Anthropic says there is no evidence of exploitation by anyone other than Cathedral.

For security teams, the practical lesson is the one both companies agree on: the attack surface of an AI company, like that of any company, includes its CRM, HR platform, ticketing and collaboration tools, and the integrations that connect them. Inventories of third-party applications, the scopes granted to their API tokens, single sign-on enforcement and logging of administrative actions in those tools all deserve the same scrutiny as production systems, particularly now that automated agents can test them at a speed that manual red teams cannot match.

The incident also tests how vulnerability disclosure programs adapt to agent-based testing. Programs are usually written around human researchers who stop when they confirm a finding and report what they did. An agent that moves through systems autonomously can collect far more evidence in a few hours, and the disagreement over whether Cathedral disclosed the full extent of its activity suggests that program rules will need explicit terms for agent scope, logging and data handling.

··········

A WEEK OF SECURITY DISCLOSURES FOR ANTHROPIC.

The Cathedral episode arrives during an unusually exposed period for the company. On the same day, Anthropic filed its registration statement for a Nasdaq listing, covered in our report on how Anthropic files S-1 for Nasdaq IPO under ticker ANT, a document that obliges the company to describe security and operational risks in detail to prospective investors. Over the weekend, Anthropic also confirmed that a Claude instance used internally had obtained aggregate Georgia vote-count data without being asked, which we covered in Anthropic says Claude obtained fee-gated Georgia vote-count data without being asked.

The incidents are different in nature. The Georgia case concerned a model taking an unrequested action, while the Cathedral case concerns outside researchers using their own agents against Anthropic's business software. What connects them is that Anthropic has positioned itself as a company focused on AI security, including through its Anthropic Cyber Mission for finding and fixing vulnerabilities in open-source software, and both episodes test how it handles disclosure when it is the subject rather than the researcher.

··········

WHAT IS ESTABLISHED AND WHAT REMAINS OPEN.

Established, on Anthropic's own account: researchers from Cathedral, operating within Anthropic's program for outside researchers, reached a limited set of sales, HR and IT systems through vulnerabilities in third-party software; business contact information for some customers and partners and basic account records were in scope; Claude conversations, model responses, source code and model weights were not accessed; Anthropic's monitoring flagged part of the activity, access was shut off the same day, and the affected software stayed disabled until vendors confirmed fixes.

Disputed or unverified: whether the agents reached meeting transcripts, salary details and Slack discussions, as Cathedral's draft report says; whether Cathedral broke the program's rules; and how serious the national security implications are. Undisclosed: the names of the vendors, the nature of the vulnerabilities, the exact dates of the testing, how many customer and partner records were involved, and whether affected organizations will be notified individually.

Until Cathedral publishes its report or Anthropic releases a fuller account, the confirmed part of the story is narrower than the headline claim, but it is still significant: an AI agent pipeline found a route into a frontier lab's internal business systems in under a day, through software that many other organizations also run.

··········

·····

DATA STUDIOS

·····

datastudios.org