A cybersecurity firm called Cathedral used artificial intelligence agents to gain access to Anthropic’s internal systems by exploiting vulnerabilities in third-party business software.
The breach occurred through the company’s own bug bounty programme. Cathedral researchers accessed internal records, including Slack messages and salary data, in under twelve hours. Anthropic states the attempted intrusion spanned several days. The firm confirmed that sales, human resources, and IT systems were accessed, which included contact details for some customers and partners. However, source code and model weights were never exposed. Anthropic shut down the affected access points the same day it discovered the breach, disabled the third-party applications until the issue was resolved, and notified U.S. federal authorities.
Disputes over duration and scope
The two parties disagree on how long the incident lasted and how far it reached. Cathedral claims the access took less than twelve hours. Anthropic says the attack stretched over several days. Logan Graham, an Anthropic red teamer, noted that only after days of probing internal systems did the researchers pivot to third-party software. There, Cathedral found two vulnerabilities but reported only one. Anthropic says it discovered and patched the second on its own.
Anthropic also accuses Cathedral of violating the bug bounty programme rules through incomplete disclosure. Graham added that targeting third-party providers and pulling data went beyond the programme’s safe harbour provisions, though he welcomed the discovery of the vulnerabilities. Cathedral maintains it followed standard security research practices.
How much data was actually accessed remains disputed. Will Depue, a former OpenAI employee, has claimed that Anthropic is downplaying the incident. He told The Washington Post that several reliable sources indicated Cathedral gained full admin access to the Slack workspace, could read every message, and could log into any user account.
Both the Anthropic and OpenAI labs store research secrets in Slack, Depue added, with admin API keys scattered across their systems. Jacob Coxon, an Anthropic employee who left in September 2026, had previously criticised the company for running dangerous AI research on office software like Slack.
Graham pushed back, saying Depue’s sources were wrong. Citing the sensitivity of the matter, he declined to get into specifics but confirmed Depue’s core concern: the industry now has to reinvent its security every year.
Depue pressed for details about exactly which claims were false and called on Anthropic to disclose what Cathedral actually accessed. He also blamed the problem on the pace of the AI race, where executives prioritise speed over security.
Alex Stamos, chief security officer at the AI startup Cognition, which uses Anthropic’s models, told the Washington Post that he considered the findings significant. He noted that integrated third-party apps are a major problem across the industry and that Anthropic could have done a better job securing its external services.
Impact for developers and security teams
Anthropic is now on the receiving end of warnings about AI-powered cyberattacks it had issued for months. This breach shows how quickly the shift in attack methods is happening. It is also not just any breach, since Anthropic is likely the company best equipped to defend itself against AI-led attacks.
Graham used the moment to warn that attackers already run AI agents around the clock, specifically targeting external dependencies. Even models half a generation to a full generation behind the current frontier are capable enough for these attacks, he said, and future adversaries will inevitably have more powerful systems at their disposal.
Graham’s answer is continuous in-house penetration testing and rebuilding software with formal verification, which AI now makes economically viable. “You probably want to red team yourself all the time. Current models are very creative,” Graham wrote.
What he did not address is how Cathedral managed to penetrate this deeply despite Anthropic having access to what are arguably the world’s most powerful AI models for cyberdefense.
