Cathedral Anthropic hack: AI agents got inside in under 12 hours

On October 26, the Washington Post reported how AI agents from the startup Cathedral found a way into Anthropic’s internal systems in under 12 hours. Not through Claude, but through the third-party sales, HR and IT software the company uses. The Cathedral Anthropic hack was a test run under Anthropic’s vulnerability disclosure program, and now the two sides disagree about how far the agents actually got.

How did Cathedral’s agents get into Anthropic?

According to Decrypt’s report, based on a draft of Cathedral’s report obtained by the Washington Post, it went like this:

1. For several days the agents tried to break directly into Anthropic’s software, and they didn’t succeed.
2. Then they switched targets to third-party tools: admin and sales apps that plenty of other companies use as well.
3. That way, in under 12 hours, they found paths to sensitive data.

Cathedral’s agents carry out multi-step tasks without a human approving each step. The vendors whose systems they got in through haven’t been named yet.

What did they find, and what does Anthropic say didn’t happen?

This is where the accounts diverge. Cathedral’s report describes paths to meeting transcripts, salary data and job offers, as well as Slack messages about Anthropic’s most advanced models.

Anthropic confirmed access to a “limited set” of its sales, HR and IT systems, which held contact details for some customers and partners and basic user account data. According to the company, the researchers did not reach customers’ conversations with Claude, source code or model weights.

According to Anthropic, its monitoring caught part of Cathedral’s activity before the startup reported it, and the company cut off access the same day. The affected apps were taken offline until the vendors confirmed fixes. According to the company, there is no sign that anyone other than Cathedral exploited these holes.

What is the dispute about?

Two things. First, the program rules. According to Anthropic, Cathedral did not disclose all of its activity in the company’s systems, so it didn’t fully stick to the rules. The draft report, on the other hand, says data access was “kept to the absolute minimum in accordance with security research best practices”.

Second, how serious the threat is. The report is already circulating in the US administration. An anonymous senior official told the Washington Post: “If a bunch of kids who have just started a company can do this… then potentially, the Chinese aren’t far behind”. According to Anthropic, Cathedral is overstating what its findings mean for national security.

Who is Cathedral?

A very young company, founded a few months ago by four former DOGE staffers. In July it raised $160M at a $1.4B valuation (figures from Decrypt’s report). According to Digital Trends, it already has cybersecurity contracts with federal agencies.

Is this anything new in the AI world?

Getting in through leaky third-party tools is a classic. What’s new is that AI agents did the work, in a few hours, at a company that builds some of the most powerful models itself and talks a lot about securing its weights. As we know, the S-1 prospectus Anthropic published on October 26 says the company delayed pre-training a new model by more than a month precisely to strengthen weight protection (I wrote about the prospectus and Anthropic stock).

It’s also another example from the same series as the AI cyberattack built on the Cairn platform: agents find the weakest link faster than a human could get through the vendor list.

Let’s take all of this with a grain of salt. Cathedral’s report hasn’t been published, and we only know its contents secondhand. Anthropic’s version, in turn, comes from the party that has a reason to downplay the incident - hence two such different lists of what the agents “saw”.

What should we watch out for in the future?

1. The weakest point wasn’t the model, but ordinary SaaS. Anyone securing agents and API keys should review permissions in HR, CRM and IT tools just as carefully.
2. Monitoring only partly worked. According to Anthropic, its monitoring caught part of Cathedral’s activity, not all of it.
3. Agents shorten the time an attack takes. If a young startup did this in 12 hours, less friendly groups will probably be able to as well.

I covered practical steps for your own agents in the guide to AI agent security.

FAQ

Did Cathedral hack Claude?

No. According to Anthropic and press reports, the agents got in through third-party business apps, and conversations with Claude, source code and model weights were not compromised.

Was this a hacker attack?

No, it was authorized security research under Anthropic’s vulnerability disclosure program. The dispute is about whether Cathedral followed all of its rules.

Did Claude users’ data leak?

According to Anthropic, the researchers reached contact details for some customers and partners and basic account data, but not the content of conversations. The company has no evidence that anyone else exploited the same holes.