Cathedral, a months-old cybersecurity startup founded by former members of the Department of Government Efficiency, says its AI agents reached Anthropic's internal sales, HR and IT systems in less than 12 hours. The Washington Post reported the claim on Monday, citing a draft Cathedral report it reviewed. Anthropic says the access was limited and was shut off the same day.

The Cathedral Anthropic breach claim is still developing, and the two sides disagree about nearly everything except the basic fact that outside researchers got in. Cathedral describes exposure of sensitive data and messaging. Anthropic describes a narrow footprint. The dispute also covers whether the work stayed inside the rules of Anthropic's program for outside researchers.

What the Cathedral Anthropic breach reached

According to the draft report, Cathedral told Anthropic that its researchers had penetrated sensitive internal data and messaging systems. The startup listed meeting transcripts, salary and job-offer details, and Slack messages that discussed advanced models among the material it could see, according to Gizmodo and News Karnataka.

Anthropic's account is much narrower. The company confirmed that the researchers reached a limited set of sales, HR and IT systems, including business contact details and basic user account records, as AI Weekly reported. Anthropic also says customer conversations with Claude, Claude's responses, source code and model weights were not reachable.

Speed is the number that grabbed attention. Cathedral says its agents found paths into internal systems in under 12 hours, and the Washington Post report repeats that timeline. The available reporting does not include an independent timeline, and no one has published a count of the records or employees involved. Those gaps matter because they leave the most dramatic figures resting on one side's account.

Anthropic's response: monitoring, shutoff and a dispute over scope

Anthropic says its own monitoring flagged some of the activity before Cathedral reported it. The company cut Cathedral's access the same day and disabled the affected business software until the vendors shipped fixes, according to Superpower Daily. If that sequence holds up, it suggests Anthropic's detection worked at least in part. The company has not published a full incident timeline, so outsiders cannot yet measure how long the activity ran before anyone noticed.

Anthropic disputes two other points. It questions whether Cathedral followed the vulnerability-testing rules, and it disputes Cathedral's characterization of what the team found. The Washington Post described the work as taking place through Anthropic's program for outside researchers, which it characterized as an authorized test rather than a criminal attack, as Cryptika summarized.

That framing is the crux of the story. A researcher who reaches salary files during an authorized test has done something different from an intruder, but only if the program's written scope made clear which data was in bounds. The Washington Post report relies on a draft Cathedral document, so the final positions of both sides may differ from what the draft says. Until the program rules and a final report are public, the question of who is right will stay open.

How third-party business software became the way in

Cathedral says its agents exploited weaknesses in third-party administrative software to find routes into Anthropic's systems. Neither Anthropic nor Cathedral has named the vendors or products involved, and the reporting has not identified them. That silence matters most to companies that run the same tools. If the software was shared across organizations, other businesses could share the exposure, and the reporting does not say whether any other company was reached.

This is an old playbook with a new operator. Attackers rarely need to defeat the core product when an integration, a service account or an admin login reaches further than it should. Our recent coverage of the Genesys breach showed how customer contact data can sit in connected systems and become the prize.

The new element is speed. An AI agent can test many possible paths in a short window and chain small misconfigurations into a larger reach. Our reporting on Claude Mythos 5, which tried to push malicious code to a real GitHub project, showed how quickly an agent can move from an instruction to a real action in a live system. Both cases point to the same lesson: an agent with access needs tight limits, whatever its intent.

What the bug bounty dispute means for AI research

Vulnerability disclosure programs work only when everyone agrees on the edges. Researchers need to know which systems are in scope, what data they may touch, how long testing can run and when to stop. Companies need reports that do not turn into disputes about unauthorized access. The Cathedral case shows what happens when those lines are fuzzy and an automated tool moves faster than a human reviewer can follow.

Companies that run outside testing should publish explicit rules for AI-assisted work. Those rules should name permitted data types, bar agents from reading personnel files and private messages unless the program says otherwise, and require a stop-and-report step as soon as sensitive data appears. Those steps would not have prevented a flaw in third-party software, but they would have made the boundary of the test easier to defend.

The federal connection adds another layer. Cathedral's founders previously worked on a federal efficiency effort, which helps explain why the story has drawn attention in Washington. One outlet raised whether any federal agency that contracts with Cathedral had a relationship to Anthropic's systems. That claim is unverified, and the reporting reviewed does not confirm it.

What US companies should check now

Most readers do not work at Anthropic, but the lessons apply to any company that runs AI tools alongside sales, HR and IT software. Start with these steps:

  • Inventory every third-party administrative, sales and HR tool that connects to your AI vendors, including the service accounts and API tokens they hold.
  • Ask AI vendors how they patch third-party software and whether their outside-research scope covers agent-driven testing.
  • Write explicit rules for any authorized testing, covering named systems, data types, time windows and a stop condition.
  • Set alerts for unusual access to HR records, compensation files and chat archives, the categories Cathedral reportedly reached.
  • Keep AI coding agents away from untrusted files. BleepingComputer reported on research from Forever Security, published October 22, showing that a planted AGENTS.md file in a Downloads folder could steer OpenAI Codex and Claude Code.

Consumers face less direct risk. The reporting gives no sign that customer chats, source code or model weights were exposed, and no consumer data has been confirmed as affected.

What to watch next

Several open questions will decide how serious this becomes. The first is which vendors built the affected administrative software, and whether they have shipped the fixes Anthropic says it waited for. The second is whether the final Cathedral report differs from the draft the Washington Post reviewed. The third is whether other AI labs or companies that use the same software were also reached.

Expect scrutiny of Cathedral's authorization claims and of the program's written rules. The DOGE connection is likely to draw questions in Washington, even though no regulatory or congressional response has been reported so far. For now, the facts both sides broadly accept are narrower than the headline: outside researchers reached systems holding sales, HR and IT data, and Anthropic cut that access off the same day.