AI agents breach Anthropic via third-party vendor apps
Cathedral’s authorised bug-bounty test reached salary files, meeting transcripts and Slack chats on sales and HR tools—not Claude—before Anthropic cut access the same day.
Cathedral used AI agents to enter Anthropic’s internal business systems in under 12 hours under the company’s bug bounty programme.
Researchers reached meeting transcripts, salary data and Slack talks about advanced models via third-party admin and sales software—not Claude.
Anthropic says Claude prompts, responses, source code and model weights were untouched; it shut affected tools the same day.
Anthropic accused Cathedral of overstating national security risks and of incomplete disclosure of activity inside the systems.
Cathedral’s co-founders include former DOGE staff; the startup raised $160m at a $1.4bn valuation in July 2026.