Anthropic's core AI systems remained secure, but researchers found another way into the company: through third-party business software.
Researchers at cybersecurity startup Cathedral used autonomous AI agents to access internal business systems at Anthropic in under 12 hours, according to a draft report reviewed by The Washington Post. The agents reportedly exploited vulnerabilities in third-party administrative and sales tools, reaching sensitive employee and corporate information.
The reported 12-hour timeframe applied to Cathedral's efforts against third-party business applications. Anthropic said the researchers had previously spent several days attempting to access its proprietary systems directly.
Inside Anthropic’s network, the agents reached employee salary records, job offers, meeting transcripts, and Slack messages concerning advanced models. Anthropic confirmed the intrusion into a "limited set" of its sales, human resources, and IT platforms, but emphasized that core assets remained untouched.
"Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day," Anthropic told The Washington Post, noting that customer conversations, source code, and model weights were never accessed.
The illusion of perimeter defense
Cathedral’s exercise exposes a structural blind spot in enterprise defense: the gap between protecting proprietary algorithms and managing the sprawl of software as a service.
Leading tech firms spend millions securing core models, but employees coordinate via Slack, close deals through external CRMs, and process payroll on cloud-based human resources software.
"The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America," Cathedral’s draft report stated.
Alex Stamos, chief information security officer at AI coding startup Cognition, reviewed Cathedral’s findings and told The Washington Post that the reliance on third-party tools is "a humongous problem for everybody," adding that "Anthropic could have done a lot better."
Washington weighs the intelligence fallout
The incident has sparked concern inside the federal government, where officials view AI capabilities as strategic national assets.
"If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind," an unnamed senior Trump administration official told The Washington Post, adding that he was surprised by "how little time it took to get into the sensitive systems of a company that is controlling almost nuclear weapons grade material."
Anthropic countered that Cathedral overstated the national security risks and violated bug bounty rules by failing to disclose all activity. Cathedral maintained it adhered to research standards, stating "data accesses were kept to the absolute minimum in accordance with security research best practices."
Repercussions for corporate and consumer data
For Anthropic’s commercial and consumer user base, the intrusion reveals immediate operational risks.
While Claude conversations remained secure, Anthropic acknowledged that contact details for some partners and customers, alongside basic user account records, were accessible.
Everyday users do not face immediate account takeovers, but enterprise clients must confront the reality that proprietary communications shared in executive briefings or partner channels can be swept up when secondary administrative layers collapse.
Business leaders relying on frontier AI platforms must now assume that administrative SaaS platforms are active attack vectors. If internal Slack channels discussing model architectures can be exposed within half a day, unvetted third-party integrations represent an urgent vulnerability across the entire software supply chain.
Anthropic said its core AI systems and customer conversations were not accessed. However, the incident illustrates how sensitive business information can remain vulnerable even when an organization's most valuable technical assets are protected.
As autonomous AI tools become more capable, security teams may need to reassess whether existing monitoring and access controls can detect unauthorized activity across the growing number of services their organizations depend on.
In other news: A South Korean hacker allegedly used AI-assisted tools to breach 60 organizations in just 44 days, contributing to a wider campaign that compromised more than 8.2 million personal information records.