Cathedral, a new cybersecurity startup, used AI agents to find routes into Anthropic’s internal business systems in under 12 hours during an authorized security test. The researchers accessed a limited set of administrative systems—sales, HR and IT tools—pulling meeting transcripts, salary and job-offer details, and internal Slack messages. Anthropic confirmed the access was limited to business applications and said its core AI assets—model weights, source code, and customer prompts—were not reached. The episode highlights how quickly automated tools can chain together weaknesses in connected services and why third-party application security matters as much as protecting model infrastructure.
How the intrusion unfolded
According to reporting, the work occurred under Anthropic’s program for outside researchers. Cathedral’s agents did not attack Anthropic’s core models or its own code; instead, they used weaknesses in unnamed third-party software used for administrative and sales work. That chain of third-party failures let the testers reach internal documents and communications that, while not model secrets, still contain sensitive business information.
What Anthropic says happened
Anthropic acknowledged that Cathedral accessed a limited group of sales, human resources, and IT systems and said its monitoring tools flagged some of the activity before Cathedral reported it. The company ended the access the same day, disabled the affected business software, and only restored systems after vendors confirmed fixes. Anthropic also said it found no evidence that anyone outside Cathedral had exploited the same weaknesses.
A dispute over disclosure and scope
The two organizations disagree about whether Cathedral fully followed Anthropic’s bug bounty rules. Anthropic contends Cathedral failed to disclose all activity inside company systems, while Cathedral maintains it kept data access to the minimum needed for responsible research. Vendors behind the affected software were notified but their names and the exact flaws were withheld to limit the risk of misuse.
Why third-party apps are a critical risk
This case illustrates a simple point: a company can harden its model infrastructure and still be exposed through HR, sales, identity, or collaboration tools. Those connected applications often carry sensitive data—contact lists, account records, internal communications—and can create alternate paths to business information if their permissions and integrations aren’t tightly controlled.
Practical defensive steps
The reporting identifies several defensive practices security teams should prioritize:
- Map every software connection and integration across the organization to spot unexpected paths.
- Limit application permissions and review OAuth tokens regularly to ensure access is scoped tightly.
- Monitor unusual account behavior and tool activity so anomalous access is detected quickly.
- Rapidly remove access that is no longer needed and coordinate patching with vendors before restoring services.
The incident also shows how AI agents can compress the timeline for security research. Agents can scan systems, attempt paths, run tools, and review results far faster than manual processes, which can be a force-multiplier for defenders and researchers alike. That speed does not remove human judgment: researchers still set the test scope, evaluate findings, and manage disclosure.
Who’s behind Cathedral and broader context
Cathedral is a young company founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein. Reuters reported that Cathedral raised $160 million at a $1.4 billion valuation, with Andreessen Horowitz and Sequoia Capital leading the round. The Washington Post noted federal agencies have contracted with Cathedral, and the startup has been involved with government work on hostile AI scenarios.
Conclusion
Anthropic’s incident underscores a shifting risk landscape: protecting model infrastructure is necessary but not sufficient. Connected third-party applications can expose sensitive business data quickly when automated agents are used for probing. The solution combines careful vendor management, strict permissioning, continuous monitoring, and clear rules for external research disclosures. As AI agents accelerate testing, organizations must pair that capability with tighter controls and rapid incident response to prevent research from turning into unintentional exposure.
Licensed under CC BY-ND 4.0 International