AI agents breach Anthropic internal systems in 12 hours

Key Takeaways

• AI agents from cybersecurity startup Cathedral successfully breached Anthropic’s internal business systems.
• The breach, part of an authorized security test, exposed sensitive business data including meeting transcripts and HR details, but did not compromise core AI models or customer prompts.
• The incident highlights significant supply chain risks posed by third-party software in AI companies and demonstrates the accelerated capabilities of AI-driven security testing.
• Anthropic quickly contained the access and disabled affected systems, although a disagreement exists regarding full disclosure compliance during the test.

A cybersecurity startup leveraging artificial intelligence agents successfully infiltrated the internal business systems of prominent AI firm Anthropic in under 12 hours. The incident, conducted by Cathedral, underscores the increasing speed and efficacy with which automated security tools can identify and exploit vulnerabilities across interconnected services.

Authorized Security Test Reveals Third-Party Weaknesses

The penetration test was carried out under Anthropic’s external researcher program, making it an authorized security assessment rather than a malicious cyberattack. According to reporting from The Washington Post, Cathedral’s AI agents did not target Anthropic’s core AI models or proprietary code. Instead, the entry point was through identified weaknesses in unnamed third-party software utilized for administrative and sales functions.

Upon gaining internal access, Cathedral researchers were able to retrieve sensitive information, including meeting transcripts, salary and job offer specifics, and internal Slack discussions pertaining to Anthropic’s advanced AI models.

Scope of Compromise and Anthropic’s Response

Anthropic confirmed to The Washington Post that Cathedral accessed a restricted set of sales, human resources, and IT systems. These compromised systems contained business contact information for certain customers and partners, alongside basic user account records. Crucially, customer prompts, Claude responses, source code, and model weights—among an AI company’s most valuable assets—remained unaccessed.

Anthropic stated that its internal monitoring systems detected some of Cathedral’s activities before the startup formally reported them. The company swiftly terminated the unauthorized access on the same day, disabled the affected business software, and only restored it after receiving confirmation from the respective vendors that necessary fixes were implemented. Anthropic further reported that no evidence suggested any entity outside Cathedral had exploited these vulnerabilities.

A point of contention arose between the two parties regarding the test’s execution. Anthropic asserted that Cathedral did not fully adhere to its bug bounty guidelines by failing to disclose all activities within the company’s systems. Conversely, Cathedral maintained that it minimized data access to only what was essential for responsible research. The vendors of the vulnerable software were notified, but their identities and the precise flaws were withheld to mitigate potential misuse.

Implications for AI Security and Automated Testing

This incident vividly illustrates the critical importance of third-party application security for AI laboratories. Even with robust protections around core model infrastructure, connected HR, sales, identity management, and collaboration tools can create alternative pathways to sensitive business data. The case highlights the necessity for comprehensive security strategies that encompass the entire software supply chain.

Furthermore, the rapid breach demonstrates the transformative potential of AI agents in security testing. These automated systems can scan environments, test exploit paths, execute tools, and analyze results with significantly reduced latency between stages. Previous reports by Cyber Security News have detailed how AI agents can automate elements of the cyber kill chain and how AI models like Claude have exploited software flaws in controlled environments. While AI agents accelerate the process, human researchers remain indispensable for defining scope, evaluating findings, and managing disclosure.

About Cathedral

Cathedral, a relatively new entrant to the cybersecurity landscape, has quickly garnered significant attention. The company was co-founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein, all former staff members of DOGE. Kliger previously served as the Pentagon’s chief data officer. In July, Reuters reported that Cathedral secured $160 million in funding at a $1.4 billion valuation, with Andreessen Horowitz and Sequoia Capital leading the investment round. A senior official from the Trump administration informed The Washington Post that multiple federal agencies have contracted with Cathedral, collaborating with the startup on scenarios involving hostile AI.

What You Should Do

• Map Your Software Supply Chain: Identify and document all third-party applications and services used across your organization, especially those connected to sensitive internal systems.
• Implement Least Privilege: Limit application permissions and review OAuth tokens regularly to ensure they only have the necessary access to perform their functions.
• Monitor for Anomalous Behavior: Deploy robust monitoring solutions to detect unusual account activity, unauthorized access attempts, or atypical data transfers within your network.
• Regularly Review and Revoke Access: Conduct periodic audits of user and application access, promptly removing any permissions or accounts that are no longer required.
• Prioritize Vendor Security: Evaluate the security posture of all third-party vendors and ensure they adhere to stringent security standards and patch management protocols.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.