AI agents breached Anthropic's internal systems in under twelve hours

Cybersecurity startup Cathedral used AI agents to break into Anthropic's internal systems and reach Slack messages, salary data and meeting transcripts in under twelve hours. The target was Anthropic itself — the maker of arguably the most capable AI models for cyberdefense — and the breach ran through ordinary third-party business software, according to a draft report reviewed by The Washington Post.

The attack wasn't a rogue operation. Cathedral ran it inside Anthropic's own bug bounty program, which pays researchers to find vulnerabilities. Cathedral, founded by former employees of DOGE, the U.S. government efficiency agency, sells AI-powered security tools to government agencies and businesses. The company's researchers got in through external admin and sales programs, and their AI agents found paths to meeting transcripts, salary data, job postings and Slack messages within half a day.

Anthropic confirmed that the researchers accessed a limited set of sales, human resources and IT systems. That included contact information for some customers and partners, plus basic user account data. Chats with Claude, source code and model weights were never exposed, the company said. Anthropic shut down the affected access points the same day it discovered the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities.

Why the two companies can't agree on what happened

The basic timeline is in dispute. Cathedral says the whole thing took less than twelve hours. Anthropic says the attempted attack stretched over several days. Anthropic red teamer Logan Graham said Cathedral spent days probing Anthropic's own systems before pivoting to third-party software, where it found two vulnerabilities — but reported only one. Anthropic says it discovered and patched the second on its own.

Anthropic also accuses Cathedral of breaking the bug bounty program's rules through incomplete disclosure. Graham said targeting third-party providers and pulling data went beyond the program's safe harbor provisions, though he welcomed the discovery of the vulnerabilities. Cathedral maintains it followed standard security research practices.

The dispute over disclosure matters because bug bounty programs only work if researchers and companies trust each other. If a company can declare a legitimate finding out of bounds after the fact, researchers have less reason to report honestly.

How deep did the access actually go?

That's the question that won't go away. Former OpenAI employee Will Depue has claimed that Anthropic is downplaying the incident. He says several sources he considers highly reliable told him Cathedral gained full admin access to the Slack workspace, could read every message, and could log into any user account.

Depue added that both the Anthropic and OpenAI labs stored all of their research secrets in Slack, with admin API keys scattered across their systems. Jacob Coxon, an Anthropic employee who left the company in September 2026, had previously criticized Anthropic for running dangerous AI research on office software like Slack.

Graham pushed back, saying Depue's sources were wrong. Citing the sensitivity of the matter, he declined to get into specifics — but he confirmed Depue's core concern: the industry now has to reinvent its security every year. Depue pressed for details about exactly which claims were false and called on Anthropic to disclose what Cathedral actually accessed. He also blamed the problem on the pace of the AI race, where executives prioritize speed over security.

Outside voices add weight to the concern. Alex Stamos, chief security officer at the AI startup Cognition, which uses Anthropic's models, told the Washington Post that he considered the findings significant. He noted that integrated third-party apps are a major problem across the industry and that Anthropic could have done a better job securing its external services.

What does this say about AI-driven attacks?

The breach landed after months of warnings about AI-powered cyberattacks and after Anthropic's own accidental security incidents. Now the lab is on the receiving end. AI agents are changing how cyberattacks work, and this incident shows how fast the shift is happening.

The uncomfortable detail is the identity of the victim. If Anthropic — likely the company best equipped to defend itself against AI-led attacks — can't keep AI agents out of its Slack workspace, the same technique works everywhere. Attackers no longer need rare skills or expensive teams. They need software that runs around the clock at minimal cost.

Graham used the moment to warn that attackers already run AI agents continuously, specifically targeting external dependencies. Even models half a generation to a full generation behind the current frontier are capable enough for these attacks, he said — and future adversaries will inevitably have more powerful systems at their disposal.

His answer is continuous in-house penetration testing, plus rebuilding software with formal verification, a technique AI now makes economically viable. "You probably want to red team yourself all the time. Current models are very creative," Graham wrote.

What he did not address is the obvious follow-up question: how did Cathedral penetrate this deeply when Anthropic has access to what are arguably the world's most powerful AI models for cyberdefense? The lesson for the rest of the industry is that owning the best defensive tools isn't the same as using them on every external admin panel and sales portal — and the companies selling AI security to governments just demonstrated exactly that gap.