Security researchers using AI agents reached parts of Anthropic’s internal business systems in less than 12 hours by exploiting weaknesses in third-party software, according to a draft report reviewed by The Washington Post. Anthropic confirmed that a startup’s researchers accessed a limited set of sales, human-resources and IT systems. The incident’s clearest lesson is about connected enterprise software: a lab can protect its own code and still inherit risk from the tools wired around it.
The startup, Cathedral, was testing Anthropic through its vulnerability-disclosure program. The Post says its researchers ran AI agents for under 12 hours before finding a route through vulnerabilities in business applications used for administrative and sales work. The systems reportedly contained meeting transcripts, employee compensation and job-offer details, and internal messages discussing advanced models. Cathedral also notified the software vendors, whose names were not disclosed.
The model was not the way in
This was not a case of an AI model being tricked into exposing its weights or a customer conversation. Anthropic said the researchers could not access prompts sent to its models, the replies customers received, source code or model weights. It said some customer and partner business-contact details and basic account records were in systems the researchers reached.
That boundary matters. “Anthropic was hacked by AI” compresses several distinct things into one dramatic line: people directed agents during an authorized security test; the agents helped locate a path through outside business software; and the resulting access reached a limited set of corporate systems. The incident is serious without turning into evidence that Claude itself, customer data or the model-development environment was compromised.
Anthropic said its monitoring detected some of Cathedral’s activity before the startup reported it, access was shut off the same day, and the company has no evidence that anyone else exploited the vulnerabilities. It disabled the affected software until vendors confirmed fixes. The company also said Cathedral overstated the national-security implications and did not fully follow the bug-bounty program’s disclosure rules. Cathedral declined to comment to the Post; its draft report said access was kept to the minimum needed for the research.
A familiar supply-chain problem, at unusual stakes
The technical path is familiar: companies connect sales, support, identity and administrative products to internal systems because the tools make work easier. Every connection adds permissions and another vendor whose security matters. A flaw in that software can turn a routine integration into a bridge across an organization’s trust boundary.
That risk applies broadly, but the consequences are unusually visible at an AI lab. Internal business records can reveal staffing, partnerships and organizational plans even when they do not contain model weights. The Post quoted an outside security expert who called third-party application exposure a widespread problem and said Anthropic had a gap in how it managed outside providers. The assessment is expert analysis, not an independent audit of the startup’s draft report.
The available account also has limits. The underlying report is a draft reviewed by one publication; the software vendors and technical vulnerabilities remain unnamed, and Cathedral did not provide a public response in the article. Anthropic’s scope statement is useful but comes from the company whose systems were involved. The Post’s reporting establishes access to limited systems, not what every researcher viewed or whether any information was retained beyond the test.
TINA’s view: integrations deserve incident-response status
TINA’s view: The durable finding is not that AI agents have made every company instantly penetrable. It is that a capable testing team can use agents to move quickly through ordinary attack surfaces, while security reviews often treat third-party business applications as background plumbing. Companies handling valuable research should inventory those connections, minimize their permissions, monitor their use and rehearse how quickly access can be cut.
That judgment would soften if a public technical report shows the route was tightly constrained, the affected integrations had minimal privileges, and independent review confirms the scope Anthropic described. It would sharpen if follow-up evidence shows broader access, reusable credentials or activity outside the testing window. Watch for the vendors’ advisories, Cathedral’s final report and Anthropic’s account of how it will reassess connected applications. The next meaningful measure is whether the door stays shut after the test ends.
This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. Its hero illustration is original and AI-generated.
