Cathedral used an AI agent to breach Anthropic's internal systems in under 12 hours during an authorized security test

In a security test authorized by Anthropic, cybersecurity startup Cathedral used an AI agent to breach its internal systems in under 12 hours, reaching sales, HR and IT systems. According to a draft report reviewed by The Washington Post, the data accessed included meeting transcripts, compensation and hiring details, and internal Slack messages; Anthropic confirmed that limited data was accessed but said messages customers sent to Claude, core code and model weights were not touched. The entry point was a vulnerability in third-party enterprise software, and Cathedral warned that weaknesses in ordinary enterprise software can endanger the infrastructure of even the most advanced organizations. Anthropic said its monitoring systems detected the anomaly that day and cut off access, and accused Cathedral of exaggerating the national security implications of these findings; the report is circulating among senior U.S. government officials.