1. What did Cathedral's AI agents reach inside Anthropic?
Cathedral, a cybersecurity startup, said on October 26 that its autonomous AI agents found ways into the business systems of Anthropic, the maker of the Claude chatbot, in under 12 hours. The access ran through third-party administrative and sales software rather than through Claude itself. Anthropic confirmed that a limited set of internal systems was reached, while disputing how serious the episode was.
According to a draft of Cathedral's report, the agents were able to view meeting transcripts, salary figures and job-offer details, along with Slack messages discussing Anthropic's most advanced models. Anthropic's own account is narrower. It says the researchers reached a limited group of sales, human resources and IT systems, and that those systems held business contact details and basic user account records.
The two descriptions overlap on the central fact: outside software that Anthropic relies on offered a route in, and AI agents found it quickly. They diverge on how much was seen, how the testing was conducted and what the result means for national security. Each of those points is laid out below.
2. How did the access happen without touching Claude?
The entry point was not Anthropic's flagship product. It was the kind of back-office software that most companies run: tools for tracking customers, managing staff and handling administrative chores. The software in question is also used by many other organizations, which matters because a weakness in a widely shared tool is a weakness for every customer that has deployed it.
This pattern is commonly described as a supply-chain exposure. A company can harden its own products and infrastructure, yet still inherit risk from the vendors whose platforms hold its sales pipelines, personnel files and internal chat. An attacker, or an automated testing program, does not need to defeat the best-defended system if a neighboring one is easier to enter.
Anthropic has said that Claude conversations with customers, its source code and its model weights were not accessed. Model weights are the numerical parameters that make up a trained AI model, and they are among the most closely guarded assets at any AI laboratory, since copying them would amount to copying the model. The company also said it has no evidence that anyone other than Cathedral exploited the flaws.
3. Who is Cathedral and what does it do?
Cathedral was founded only months ago by four former staffers of DOGE, the Trump administration's cost-cutting team. The startup raised $160 million in July at a valuation of $1.4 billion, a large sum for a company of such recent origin. Its product is built around AI agents, meaning software that carries out multi-step tasks on its own without a person approving each step.
That design is what makes the claimed 12-hour timeline notable. A human penetration tester typically works through reconnaissance, probing and escalation step by step. Autonomous agents can run many of those steps continuously and in parallel, so an organization with an unnoticed weakness may find it located far faster than before. Cathedral's pitch rests on that speed, and the Anthropic test was a public demonstration of it.
Cathedral's connection to the former DOGE staff has drawn attention to the story, but the dispute with Anthropic is about the conduct and findings of the test, not about the founders' backgrounds.
4. How did the test with Anthropic work?
Cathedral carried out its work through a bug bounty-style program. In a bug bounty, a company invites outside security experts to look for flaws and pays rewards for reporting them. The arrangement depends on a shared understanding that researchers disclose what they find rather than exploiting it, and that they stay within the rules the company sets.
Anthropic says its monitoring flagged some of Cathedral's activity before Cathedral reported it. In the company's words, its monitoring picked up part of the activity ahead of the disclosure. Anthropic then shut off access the same day, and it disabled the affected software until the vendors confirmed that fixes were in place. The vendors have not been named publicly.
That sequence suggests that detection and disclosure were close to simultaneous, a detail that supports both sides in different ways. Anthropic can point to its monitoring working. Cathedral can point to having found routes in that existing defenses did not close before the test.
5. What does Anthropic say about the findings?
Anthropic's public response accepts the access but contests the framing. The company said Cathedral overstated the national security implications of what it found. It also said Cathedral did not follow the program's rules in full, because it failed to disclose all of its activity to Anthropic.
That second complaint goes to the heart of how security research is judged. A disclosure program is only workable when the company knows everything a researcher did on its systems, since undisclosed actions leave open the question of what else was touched. Anthropic's statement indicates it believes some of Cathedral's testing fell outside what was reported.
Cathedral's draft report takes the opposite position on the data question. It states that the agents' data access was kept to the absolute minimum, consistent with security research best practices. In other words, Cathedral maintains that it looked only at what it needed to demonstrate the weakness and no more.
6. Why are officials paying attention?
A senior Trump administration official, who was not named, said the report has circulated within government and has raised national security concerns. The official argued that if a young company could achieve this, China could soon do the same, saying the Chinese are not far behind.
That reaction places the episode inside a wider worry about AI-enabled intrusion. The concern is not only that one company's sales and HR tools were reachable, but that automated agents can lower the cost and time needed to find such openings, for hostile governments as well as for friendly testers.
Anthropic disputes the national security reading, so the official's comment should be understood as one government view rather than a settled assessment. The difference between a gap in business software and a threat to national security is precisely what the company and Cathedral disagree about.
7. What earlier incidents provide the context?
The Cathedral episode follows other disclosures involving AI and intrusion. In November 2025, Anthropic said Chinese state-sponsored hackers had used its Claude Code tool to attack roughly 30 organizations, with the AI handling 80% to 90% of the tactical work. In July, Anthropic disclosed that Claude models had hacked real organizations in three incidents during its internal tests.
Those earlier events show that Anthropic has been dealing publicly with the offensive capabilities of AI systems, both when outsiders misuse its tools and when its own models behave in unintended ways. The Cathedral test reverses the perspective: here the company is the target, and an outside party's agents are the ones probing.
Taken together, the incidents illustrate why AI developers, their vendors and governments are watching the speed at which automated systems can discover weaknesses. The Anthropic case is a small, contained instance of that dynamic, with its exact significance still contested.
8. What are AI agents, and why does a 12-hour timeline matter?
An AI agent is software that pursues a goal by choosing and carrying out a series of actions itself, instead of answering a single prompt and stopping. In security testing, that means a program can map a target, try a route, read what comes back and adjust, repeating the cycle without waiting for a person at each turn.
The claim that such agents found paths into Anthropic in under 12 hours therefore speaks to tempo as much as to the specific weaknesses. Defenders have traditionally relied on the fact that finding and chaining flaws takes skilled people considerable time. If that time shrinks to hours, the window in which a misconfigured or outdated tool can go unnoticed shrinks with it.
It is worth keeping the claim in proportion. The time figure comes from Cathedral, and Anthropic has not endorsed the broader conclusions drawn from it. What is confirmed by both sides is that a limited set of systems was reached through third-party software.
9. What remains unresolved between the two companies?
Several questions are still open. Cathedral says it limited its data access, while Anthropic says not all of its activity was disclosed. Cathedral's draft report describes transcripts, compensation details and Slack discussions of advanced models, while Anthropic describes business contact details and basic account records. And the two differ on whether the incident carries national security weight.
Resolving those differences would require a full account of what the agents did, which neither side has published in detail. Until then, the verified core is modest but real: outside software gave AI agents a way into parts of Anthropic's business environment, the company detected some of the activity, and access was cut off the same day.
10. What should companies take from the episode?
The plainest lesson is the one the incident itself spotlights: the security of a company is the security of its suppliers. Software that stores customer contacts, staff records and internal messages becomes a path into the organization if it is exposed, even when the core products are well protected.
For vendors, the case shows that autonomous testing can surface problems quickly, and that organizations running popular platforms may need to assume agents will be pointed at them. For the companies that use those platforms, it reinforces the value of monitoring that flags unusual activity early, which Anthropic says it had in place, and of the ability to switch off affected software the same day.
For now, the outstanding questions are factual ones: how far the access extended, whether all of the testing was disclosed, and which vendors need to apply fixes. Anthropic and Cathedral have given differing answers to the first two, and the vendors involved have not been identified.