Cathedral researchers accessed Anthropic systems in under 12 hours via third-party software

Anthropic confirmed that researchers at AI startup Cathedral accessed a limited set of sales, human resources, and IT systems, and Cathedral said the access took under 12 hours in 2026, using AI agents — software that can act autonomously — to exploit flaws in business software for HR, sales, IT management, and collaboration that is operated by third parties rather than Anthropic’s own code or Claude.

Anthropic said the data included meeting transcripts and pay and job-offer information. The researchers also reached internal Slack conversations about advanced models, the company said. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition, Techreport, kucoin.com, Digital Trends, Gizmodo

The company said Claude user conversations were not part of what was accessed during the exercise. Source code and AI model weights were also not accessed, the company said. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition, Techreport, kucoin.com, Digital Trends, Gizmodo

Researchers could also reach business contact information for select customers and partners. Cathedral said its draft report described the accessed data as limited and in line with security research best practices. The company raised $160 million in funding at a $1.4 billion valuation in July 2026. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition, kucoin.com, Digital Trends, Gizmodo

AI agents can scan systems on their own, test access paths, and review results while moving across enterprise software integrations at the same time. They can also link flaws across connected services to reach sensitive data far more quickly than human operators could. Sources: Tech Times, TechJuice

The companies behind the affected software and the flaws that were exploited have not been identified publicly. Anthropic disabled the affected applications after confirming the intrusion. Sources: Tech Times, TechJuice, Techreport

The test ran under Anthropic’s authorized vulnerability-disclosure program, and Cathedral shared its findings with Anthropic and the affected third-party vendors. The company said its monitoring spotted some of Cathedral’s activity before the formal disclosure. The company cut Cathedral’s access the same day. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition, Techreport, kucoin.com, Digital Trends, Gizmodo

The software came back only after vendors confirmed their patches were ready. The company said no evidence showed that anyone other than Cathedral had used the same flaws. Sources: Tech Times, International Business Times, Singapore Edition

Anthropic said Cathedral violated program rules by failing to fully describe its activity inside Anthropic systems. The company also said Cathedral overstated the national-security importance of the findings, while Cathedral’s spokeswoman declined to discuss the disagreement. The company rejected the national-security characterization for Cathedral’s specific findings, saying the accessed systems were administrative in nature. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition, Techreport, Digital Trends, Gizmodo

Cathedral said its draft report described the accessed data as limited and in line with security research best practices. Neither version has been independently settled, and Cathedral’s report is still a draft. Sources: Tech Times, Techreport

The company had not filed a legal complaint. Neither Anthropic nor Cathedral has taken legal action in the dispute. Sources: Tech Times

Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein founded Cathedral, and all are former Department of Government Efficiency staffers. Marc Andreessen and Shaun Maguire sit on its board. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition, Techreport, Gizmodo

The startup works on military and government applications and holds contracts with three federal agencies. Kliger received his appointment as Pentagon Chief Data Officer in March 2026. Reports also tied him to a Defense Department dispute with Anthropic over limits on Anthropic model use in federal systems. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition

Elez left DOGE in early 2025 after racist social-media posts appeared. Elon Musk and Vice President JD Vance publicly backed Elez, which led to his rehiring. In 2023, Farritor used AI to read text that had been unreadable in the Herculaneum papyri. That work earned him a prize in the international Vesuvius Challenge.

Sources: Tech Times, Gizmodo

A senior Trump administration official said Cathedral’s draft report had circulated within the federal government. The official said the findings raised national security concerns. The official said federal authorities were working with Cathedral on hostile AI scenarios. Sources: Tech Times, TechJuice, International Business Times, Singapore Edition, Gizmodo

Cathedral’s draft report was reviewed by Alex Stamos for The Washington Post. Stamos is Cognition’s chief information security officer and once held Facebook’s chief security officer post. Stamos said the report exposed weaknesses in how Anthropic manages third-party software integrations and described the issue as industry-wide rather than specific to Anthropic. Sources: Tech Times

An official said potential adversaries accessing frontier AI lab internals would be like obtaining material with strategic value almost equal to nuclear weapons grade material. US officials have said they worry that Chinese state-sponsored hackers might use identical AI-agent techniques across enterprise-software attack surfaces at frontier AI labs. Cathedral’s draft report warned that “weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations.” Sources: Tech Times

Supply chain attacks target weaker vendor relationships when the main target’s defenses are strong. Past examples include Target’s 2013 breach through an HVAC contractor and SolarWinds’ 2020 compromise, which affected roughly 18,000 organizations. Sources: Tech Times

Frontier AI labs invest heavily in protecting core assets such as inference infrastructure, source code, training pipelines, and model weights. The administrative software layer that connects AI labs to vendors sits outside the lab’s direct security control. An AI lab can harden its own technology but not the software it purchases. Sources: Tech Times

Vendor security hinges on each vendor’s practices, patch schedule, and response time. The 2020 SolarWinds breach demonstrated that trusted software update channels can deliver harmful code to well-defended targets. Cathedral’s 2026 exercise showed that automated agents can scan vendor relationships and find an exploitable path within 12 hours, a technique within reach of actors with fewer resources than a nation-state. Sources: Tech Times

Threat actors who speak Chinese used AI agents built on DeepSeek and Anthropic’s Claude Code against more than 1,200 e-commerce sites, including more than 100 sites in the US, Canada, Australia, and Japan. The reported total cost came to about $5,000, with roughly $50 per successful intrusion and an average of 23 hours per intrusion. Sources: Tech Times, Gizmodo

Earlier in 2026, Anthropic disclosed additional lapses, including an unsecured data store with details of an unreleased model and an internal CEO retreat. Earlier in 2026, about 512,000 lines of source code from Anthropic’s Claude Code tool were exposed by accident. Sources: Tech Times

In November 2025, Anthropic said Chinese state-sponsored hackers used its Claude Code coding tool to compromise roughly 30 organizations. Anthropic’s July 2026 disclosure described three test incidents in which its Claude models compromised real organizations. Sources: Techreport

Abdulrahman Alfozan, a Saudi national and former OpenAI engineer, was arrested on October 9, 2026. Prosecutors alleged that a member of the Saudi royal family sought to recruit Alfozan into a Saudi AI initiative. The FBI’s investigation into Alfozan remains open. Sources: Tech Times, Gizmodo

Anthropic has filed for an IPO, and SEC filings ahead may call for disclosure of material security incidents. The vendor patch process set off by Cathedral’s disclosure had not been completed as of the report date. Anthropic’s immediate priorities include finishing vendor patching, keeping up federal briefings, and navigating the public dispute with Cathedral. Cathedral submitted its findings, told affected vendors, and described the exercise as a proof of concept rather than a hostile operation.

Sources: Tech Times