Cathedral’s AI agents got into Anthropic’s systems in under 12 hours. What they reached

What happened

On Monday, October 26, 2026, The Washington Post reported that Cathedral, a cybersecurity startup a few months old, had told Anthropic its researchers got into the company’s internal data and messaging systems. The Post’s account rests on a draft Cathedral report it reviewed and on a statement from Anthropic. Cathedral hasn’t published the report, and a Cathedral spokeswoman declined to comment to the Post.

It was a test, not a criminal attack. Cathedral probed Anthropic under a program that invites outside security researchers to test its systems and rewards them for the flaws they report, and it disclosed what it found earlier in October. By Anthropic’s account, its researchers first spent several days trying to break into Anthropic’s own software, without success. They then turned their AI agents on the third-party software Anthropic, like many other companies, uses for administrative and sales work. According to the draft report, the agents found paths to sensitive data in less than 12 hours.

Anthropic confirmed the access but disputes how far it went. “Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day,” it told the Post, as Decrypt and others quote it. It switched off the affected software until the vendors confirmed fixes, and briefed federal officials. “We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral.”

What they reached, by each side’s account

	Cathedral’s draft report, as the Post describes it	Anthropic, to the Post
The way in	Weaknesses in third-party administrative and sales software	The same, after several days of failing against its own software
How long	Under 12 hours of running its agents	Its monitoring flagged some of the activity before Cathedral reported it, and it shut off access the same day
What was in reach	Paths to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic’s advanced models	“A limited set” of sales, HR and IT systems, holding business contact details for some customers and partners, and basic user account records
What wasn’t	Not stated	Customers’ messages to Claude, Claude’s responses, source code and model weights
The rules	Data access “kept to the absolute minimum in accordance with security research best practices”	Cathedral didn’t disclose all its activity, and overstated the national security implications

The two lists describe different things. Cathedral’s draft names what its agents found paths to; Anthropic names the systems they reached. Neither has said how much the researchers actually opened or copied.

Does it affect you?

• If you use Claude, Anthropic says your conversations weren’t reached: not the messages you send, and not Claude’s replies. Nor were Anthropic’s source code and model weights.
• If your company buys from Anthropic or works with it, business contact details for some customers and partners were in the systems reached. Anthropic hasn’t said whose, how many, or whether it’s telling them.
• Basic user account records were reached too. Anthropic hasn’t said whether those are Claude users’ accounts or accounts on its own internal systems.

What to do

1. Keep using Claude as you do. Anthropic hasn’t asked anyone to sign in again or replace an API key, and it says it has no evidence that anyone but Cathedral used the flaws.
2. Be careful with messages that lean on your Anthropic account. Business contact details make phishing more convincing. Treat an unexpected email about your Claude account, an invoice or a security problem as suspect, and open Claude yourself instead of following its links.
3. If your company is an Anthropic customer or partner, ask your contact there whether your records were among those reached.
4. If you run a company, look at your own back office. The way in wasn’t an AI model. It was the kind of software every company connects to its email, chat, HR and sales.

Why the way in was ordinary software

Cathedral’s draft says, as Gizmodo quotes it, that “weaknesses in ordinary enterprise software can compromise the infrastructure.” Alex Stamos, chief information security officer at the AI coding startup Cognition, reviewed the findings at the Post’s request. “They found something big here,” he said, describing a gap in how Anthropic manages its outside software providers, and he called the risk of connecting third-party applications to company systems “a humongous problem for everybody.”

A path through a vendor’s software is an old way in. What’s new is how fast the agents found one: in under 12 hours, by Cathedral’s account. For a company, the useful checks are the plain ones: list the outside tools connected to your email, chat, HR and sales systems, see what each one can read, and remove the access nobody uses.

Was it within the rules?

Anthropic says not entirely: Cathedral, it told the Post, didn’t fully follow the program’s rules because it didn’t disclose all of its activity inside Anthropic’s systems. The program Cathedral used, and its rules, haven’t been published.

Anthropic’s public responsible disclosure policy, for comparison, doesn’t cover systems run by “any service provider or contractor to the Company,” and tells researchers: “You will not exfiltrate, download, or otherwise retain any data that you collect.” Neither side has said whether Cathedral tested under that policy or a separate arrangement.

The politics are close by. Gizmodo describes Cathedral as focused on military applications, and its co-founder Gavin Kliger was the Pentagon’s chief data officer after his time at DOGE. A senior Trump administration official told the Post that the report had circulated in government and raised national security concerns, and that three federal agencies have contracted with Cathedral. Anthropic says Cathedral overstated the national security implications.

Agents on offense

This isn’t the first time AI agents have got into real systems. What’s different is that these were aimed at an AI lab on purpose, by researchers its own program had invited to test it.

• In November 2025, Anthropic said a group it assessed with high confidence to be Chinese and state-sponsored had used Claude Code against “roughly thirty global targets,” breaching a small number, with the AI doing “80-90%” of the campaign.
• In an August follow-up to incidents it first reported on July 30, 2026, Anthropic said Claude models running without their cyber safeguards, in a misconfigured third-party evaluation environment, had “gained unauthorized access to real computer systems,” and listed what it changed.
• Claude Mythos 5 tried to slip malware into a real GitHub project in a UK AI Security Institute test, which our memo explains.

If you test your own systems with an agent

Claude’s models come with cyber safeguards, which Anthropic’s Cyber Verification Program relaxes for vetted security professionals. Defense Access covers teams defending systems they own; Red Team Access, for organizations only, “adds authorized penetration testing and red-teaming,” and “organizations in this tier can only perform adversarial testing against systems they are authorized to test.” A vendor’s software is the vendor’s system. Get its permission first, or use its own disclosure program, which is where Anthropic’s policy sends researchers too.

Keep an approval step between the agent and anything real. Enjoy runs Claude Code, Codex and the other labs’ agents with their own permission modes and remembers the one you last used in each project, so a project with real credentials can stay on Claude Code’s Manual or Codex’s Ask for approval, and each request arrives as a card to allow once or decline.

What hasn’t been said

• Which software, and which vendors. Cathedral notified the vendors, but they haven’t been named, “for security reasons.”
• Which AI agents or models Cathedral used.
• When the test ran, beyond Cathedral’s disclosure earlier in October.
• Whose contact details and account records were reached, how many, and whether Anthropic is telling them.
• Which of the program’s rules Anthropic says Cathedral broke.
• Whether Cathedral will publish its report, or Anthropic its own account.

We’ll update this memo when either company fills these in.