AI Agents Breach Anthropic Internal Systems in Authorized Test
Startup Cathedral's AI agents successfully infiltrated Anthropic's internal business systems within 12 hours, accessing HR and sales data through third-party software vulnerabilities.
Cybersecurity startup Cathedral announced that its AI agents were able to breach Anthropic's internal business systems in under 12 hours, demonstrating the rapid pace at which automated security tools can identify and chain vulnerabilities across interconnected services. This penetration test was conducted under Anthropic's authorized bug bounty program, distinguishing it from malicious attacks.
The AI agents did not target Anthropic's proprietary AI models or custom code. Instead, Cathedral reported that the breaches exploited weaknesses in unnamed third-party software utilized for administrative and sales functions. Once inside, the agents accessed sensitive information including meeting transcripts, salary and job offer details, and internal communications pertaining to Anthropic's advanced AI models.
Anthropic confirmed that a limited set of sales, human resources, and IT systems were accessed. These systems contained business contact information for some customers and partners, along with basic user account records. Crucially, Anthropic stated that customer prompts, Claude responses, source code, and model weights remained uncompromised, safeguarding the company's core intellectual property.
Anthropic also noted that its own monitoring systems detected some of Cathedral's activities prior to the startup's disclosure. The company promptly terminated the access, disabled the affected business software, and only reinstated it after vendors confirmed that patches were available. Anthropic reported no evidence suggesting that any external parties exploited these vulnerabilities.
Disagreements arose between Anthropic and Cathedral regarding the specifics of the test. Anthropic contended that Cathedral did not fully adhere to the bug bounty program's rules by failing to disclose all system activities. Cathedral maintained that its data access was minimized for responsible research purposes. The vendors of the compromised software were notified, but their identities and the precise vulnerabilities were withheld to mitigate the risk of misuse.
This incident underscores the escalating importance of third-party application security for AI development companies. Even with robust protection of core AI infrastructure, interconnected HR, sales, identity, and collaboration tools can present alternative pathways into sensitive business data. Security teams are advised to meticulously map all software connections, enforce strict application permissions, regularly review OAuth tokens, monitor for anomalous account behavior, and promptly revoke unnecessary access.
The event also highlights the potential of AI agents to significantly accelerate security testing. These agents can automate the process of scanning systems, testing exploit paths, running security tools, and analyzing results with reduced human intervention and waiting times. This capability complements human oversight, which remains essential for setting test scopes, evaluating findings, and managing disclosures.
Cathedral, a relatively new company co-founded by former Pentagon Chief Data Officer Gavin Kliger and other ex-DOGE staffers, has already attracted significant attention and substantial investment. The company recently raised $160 million at a $1.4 billion valuation, with prominent venture capital firms leading the funding round. Federal agencies have reportedly engaged with Cathedral to explore scenarios involving hostile AI.