AI agents got into Anthropic through ordinary business software

Less than twelve hours. That is how long it took Cathedral's artificial intelligence agents, according to Cathedral, to find paths to the internal data of Anthropic, the company behind the Claude AI. They did not attack the AI models or the company's code. They exploited flaws in third-party administrative and sales management software, used by Anthropic as by many other companies.

The story was revealed on October 26 by the Washington Post, which reviewed a draft Cathedral report. According to the document, the researchers reached meeting transcripts, information on salaries and job offers, and internal Slack discussions about Anthropic's advanced AI models. Cathedral submitted its findings earlier this month through Anthropic's bug bounty program, which rewards vulnerability reports.

Former DOGE staffers at the helm

Cathedral is only a few months old. Its cofounders, Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all passed through DOGE, the federal spending-cut unit associated with Elon Musk. Gavin Kliger later served as the Pentagon's chief data officer and, according to Reuters as cited by Gizmodo, was reportedly involved in the dispute between the Department of Defense and Anthropic. Valued at $1.4 billion, the startup sells AI-based cybersecurity tools to the government and to businesses. A senior Trump administration official, speaking anonymously, told the paper that the report had circulated within the government and raised concerns: if young founders can do it, "potentially, the Chinese are not far behind."

Anthropic confirms the access but disputes its scale

According to Anthropic, Cathedral reached a "limited set" of commercial, HR and IT systems, containing business contact details for some customers and partners and basic information on user accounts. Customer prompts, Claude's responses, source code and model weights were reportedly not affected. The company says its monitoring spotted part of Cathedral's activity before the report was submitted, that access was cut off the same day, and that it has no sign of exploitation by anyone else. It accuses Cathedral of not disclosing all of its activity, contrary to the rules of its program, and of exaggerating the national security consequences. Cathedral says it limited its access to data to the strict minimum.

An outside view qualifies that defense. Asked by the Washington Post, Alex Stamos, chief security officer at the startup Cognition, said Cathedral "found something important" and that Anthropic "could have done much better" in managing its vendors.

The lesson applies to every company

No AI model was hacked: the way in was business management tools of the kind most organizations use. A few habits follow:

• keep an inventory of the online applications connected to email, HR or sales management, and of what they can access;
• reduce their permissions to the strict minimum and revoke unused integrations;
• monitor their activity as you would a user's: it is thanks to its monitoring that Anthropic says it spotted part of Cathedral's activity.

The software involved has not been named; Cathedral says it has notified the vendors. As long as they remain unknown, there is no way to tell how many other companies share the same flaws.