AI agents built by cybersecurity startup Cathedral found their way into Anthropic’s internal systems in less than 12 hours, according to a report published Monday by The Washington Post. The test ran under Anthropic’s bug bounty program, and the agents reached internal meeting transcripts, employee salary details and Slack discussions about the company’s most advanced AI models, while stopping short of Claude itself.

The disclosure, first reported by the Post from a draft of Cathedral’s findings, lands in the same week Anthropic filed to go public, and it puts a sharp question in front of the AI industry: if AI agents can map a path into a leading AI lab’s systems in hours, how well can any company defend the ordinary business software connected to them?

What Cathedral Found

Cathedral’s researchers used AI agents to identify potential access routes into Anthropic’s systems, the Post reported, citing the draft report it reviewed. The agents did not break Anthropic’s own software or crack Claude. Instead, they exploited weaknesses in third-party business applications Anthropic uses for administrative and sales work.

The 12-hour figure tells only part of the story. Anthropic said the researchers had spent several days trying to penetrate its software directly before shifting their attention to the third-party applications. Once they did, the agents moved through the company’s connected tools on their own, navigating network pathways without requiring human approval at every step.

Cathedral disclosed its findings to Anthropic earlier this month and informed the affected software vendors. The vendors were not identified publicly, for security reasons.

What Was Reached, and What Was Not

body cathedral what reached

Graphic: GPTOnline

The routes the agents found led to internal meeting transcripts, employee salary and job-offer information, and Slack discussions about Anthropic’s advanced AI models, according to the draft report reviewed by the Post.

Anthropic confirmed that the researchers reached a limited set of its sales, human resources and IT systems, including business contact information belonging to some customers and partners and basic user account records. But the company stressed the limits of the exposure: the researchers never accessed customer conversations with Claude, model responses, proprietary code or model weights.

“Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day,” Anthropic said in a statement to The Washington Post.

The company disabled the affected software until the vendors addressed the security weaknesses, and it notified federal officials. Anthropic said it found no evidence that anyone outside Cathedral had exploited the vulnerabilities.

The Dispute

body cathedral dispute

Graphic: GPTOnline

The two companies disagree over how serious the incident was. Anthropic accused Cathedral of overstating the national security implications of its findings and of failing to disclose all of its testing activity under the bug bounty program’s rules. Cathedral maintained in its draft report that its researchers kept data access to a minimum, in line with security research best practices.

Alex Stamos, chief information security officer at AI coding startup Cognition, reviewed Cathedral’s findings for the Post. He said the investigation revealed weaknesses in how Anthropic manages its third-party software integrations, the Post reported.

The findings have reportedly circulated within the Trump administration. A senior administration official, speaking anonymously to the Post, said: “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.”

Who Cathedral Is

Cathedral is no ordinary startup. Founded in 2026 by former Department of Government Efficiency staffers Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, the company builds AI-driven cybersecurity capabilities for government agencies and corporate customers. In July, Reuters reported that Cathedral had raised $160 million at a $1.4 billion valuation, with backing from Andreessen Horowitz and Sequoia Capital. Three federal agencies have contracted with Cathedral for cybersecurity work, according to the Post.

The context sharpens the stakes. Anthropic clashed with the Trump administration earlier this year after the Pentagon banned it from federal systems, following its refusal to allow its technology for autonomous weapons or mass domestic surveillance.

Why It Matters

The breach was authorized, and no model weights or customer data were taken. But the incident exposes a gap that has little to do with how strong a company’s AI models are. Companies increasingly connect messaging platforms, customer databases, HR applications and other enterprise tools to sensitive internal systems, and each connection creates another potential entry point.

AI agents make those weaknesses easier to discover and exploit, compressing what once took a team of researchers days or weeks into hours. Anthropic’s own monitoring caught some of the activity, but only after the agents were already inside its third-party tools. The test also echoes Anthropic’s own recent disclosures about its models acting beyond their instructions, which GPTOnline reported this week.

For the wider industry, the question Cathedral’s test raises is practical, not theoretical: a company can protect its model infrastructure and still be reached through the ordinary software its business runs on.

Sources