A bug bounty exercise at Anthropic became a test of how AI agents can probe the business software connected to a company’s internal systems. Cybersecurity startup Cathedral says its agents found routes to sensitive records. Anthropic confirmed access to a limited set of systems, but the two organizations disagree about how long the activity lasted and what it reached.
Third-party tools opened paths to internal records
Cathedral’s researchers began with external admin and sales programs, according to the startup’s draft report reviewed by The Washington Post. The company says AI agents running advanced models found paths to meeting transcripts, salary data, job postings and Slack messages in under twelve hours.
Cathedral was using Anthropic’s bug bounty program to look for vulnerabilities. Its report says the researchers found two vulnerabilities in third-party software. Cathedral reported one; Anthropic says it found and patched the other itself.
Anthropic confirmed that researchers accessed a limited set of sales, human resources and IT systems. The exposed information included contact details for some customers and partners, as well as basic user account data. The company said chats with Claude, source code and model weights were not exposed.
The accounts differ on the timeline and scope
Cathedral describes the incident as taking less than twelve hours. Anthropic says the attempted attack lasted several days. According to Anthropic red teamer Logan Graham, Cathedral spent days probing Anthropic’s own systems before turning to third-party software.
The disagreement extends to the rules of the exercise. Anthropic says Cathedral did not fully disclose its findings and that targeting third-party providers and pulling data went beyond the bug bounty program’s safe harbor provisions. Graham welcomed the discovery of vulnerabilities while criticizing how the work was conducted. Cathedral says it followed standard security research practices.
The extent of access is also contested. Former OpenAI employee Will Depue claimed that sources he considered highly reliable told him Cathedral had full admin access to Anthropic’s Slack workspace, could read every message and could log into any user account. Graham rejected Depue’s sources as wrong, but declined to provide specifics, citing the sensitivity of the matter.
Depue also argued that Anthropic should disclose what Cathedral accessed. He said both Anthropic and OpenAI stored research secrets in Slack, with admin API keys spread across their systems. The source article reports these as Depue’s claims; Anthropic has disputed the extent of the access described.
Anthropic shut down access and notified authorities
Anthropic said it closed the affected access points on the same day it found the breach. It also disabled the third-party programs until the issue was resolved and notified U.S. federal authorities. Those steps address the routes identified by the company, though the public accounts in the source leave some questions about the data reached unresolved.
Alex Stamos, chief security officer at AI startup Cognition, which uses Anthropic’s models, told The Washington Post he considered the findings significant. He pointed to integrated third-party apps as a major problem across the industry and said Anthropic could have done a better job securing its external services.
The episode illustrates why connected services matter in security reviews. A company’s exposure can include the tools its staff use for sales, human resources, administration and messaging, not just its own core systems. If access controls or integrations in those services create a route inward, attackers may reach business records without directly compromising a company’s central technology.
AI changes the pace of security testing
Graham warned that attackers are already using AI agents around the clock to target external dependencies. He said even models half a generation to a full generation behind the current frontier are capable enough for these attacks, and that future adversaries will have more powerful systems.
His proposed response is continuous in-house penetration testing and rebuilding software with formal verification, which he said AI now makes economically viable. Graham wrote, “You probably want to red team yourself all the time. Current models are very creative,” underscoring the case for frequent testing as automated tools become more capable.
The incident also raises a practical question: how should organizations test the full chain of software and services they rely on? Anthropic’s own bug bounty effort helped surface weaknesses, but the dispute over the program’s boundaries and the amount of data accessed shows that technical testing and clear disclosure rules both matter. AI agents may make probing cheaper and more persistent; organizations still need to decide what systems are in scope, how researchers should report access and how quickly connected services can be secured.