AI agents reportedly reached Anthropic business systems in 12 hours

What happened

According to The Washington Post, a cybersecurity startup called Cathedral used AI agents to find paths into Anthropic's internal business systems in less than 12 hours. The Post's account relies on a draft Cathedral report it reviewed. Cathedral was founded by four former staffers of the US Department of Government Efficiency, according to Decrypt's summary of the Post report. The work was reportedly carried out under Anthropic's vulnerability disclosure programme for outside researchers, which Anadolu Agency describes as a programme that lets independent researchers check the company's systems.

The agents did not break into Claude. According to the Post's reporting as summarised by Decrypt, the way in was third-party administrative and sales software of the kind many companies use to track customers and manage staff. The draft report says the routes exposed meeting transcripts, salary and job-offer details, and Slack messages about Anthropic's advanced AI models.

Anthropic confirmed to the Post that the researchers reached a limited set of sales, HR and IT systems. Those systems held business contact details for some customers and partners, along with basic user account records. Anthropic says customer chats, Claude responses, source code and model weights were not reached. It also says its monitoring flagged some of Cathedral's activity before the startup reported it, that it shut off access the same day, and that it closed the access paths and informed federal officials.

Where the two sides disagree

Anthropic says Cathedral overstated the national security implications and did not disclose all of its testing, according to Decrypt. Cathedral says it kept its data access to the absolute minimum. Gizmodo reports that Anthropic said the researchers had earlier spent several days trying without success to breach its software directly. Anthropic's published Responsible Disclosure Policy states that it does not cover systems owned or run by third-party service providers, which is the category at the centre of this case. Anthropic also says it found no evidence that anyone other than Cathedral exploited the flaws. That does not show whether others could have.

Why it matters for businesses that automate work

Most automation projects connect a set of ordinary business apps: a CRM, a payroll or HR tool, a shared chat workspace, and a set of accounts that let software read and write data. Each connection is a door. In this case the agents did not need a flaw in the core product. They needed a flaw in one connected tool and a route from there into other systems. Automated agents can test many routes faster than a person, which is why the speed of 12 hours stands out.

What changes in practice

A business of any size can apply the same checks without waiting for a headline. The steps below are general good practice, not a fix for this specific flaw, which has not been named publicly.

1. List every software tool that connects to your email, chat, file storage, HR or sales records.
2. Remove access for former staff, unused tools and old test accounts.
3. Limit each connected app to the data it needs. A reporting tool rarely needs write access.
4. Review the permissions that connected apps hold, including the tokens that let one app act on another's behalf.
5. Ask each software vendor how it handles security updates and whether it has published a way to report flaws.
6. Set alerts for unusual logins or bulk data exports from any connected account.

Automation can run these checks on a schedule and produce a list of changes for an owner to approve. It cannot patch a vendor's product. The business can only restrict access, remove tools and press the vendor for a fix.

What to watch next

Three things will show how serious the findings were. The first is whether Cathedral publishes its final report, since the Post reviewed only a draft. The second is whether the vendors behind the affected software confirm fixes. Anthropic says it kept affected business software offline until vendors confirmed fixes, according to Superpower Daily's summary. The third is whether Anthropic and Cathedral resolve their dispute over scope and disclosure, which the public record does not yet settle.