According to a report by The Washington Post on 10 26 and a compilation by The Decoder on 10 28: Cybersecurity startup Cathedral used AI agents to access Anthropic's internal systems through external management and sales software while participating in Anthropic's bug bounty program. Anthropic confirmed that the party accessed some sales, HR, and IT systems, including contact information and basic account data for some customers and partners, but stated that Claude conversations, source code, and model weights were not exposed.
Confidence: High (85) · Event date 2026-10-25
Reasoning
- This is an instance of "AI agents attacking an AI company": According to reports, Cathedral's agents found a path to meeting notes, salary data, job postings, and Slack messages in less than 12 hours. The entry point was not Anthropic's own systems, but the third-party software integrated with them.
- According to The Decoder's compilation, Anthropic closed the affected access points, disabled the relevant third-party applications, and notified US federal agencies on the same day.
- Logan Graham, head of Anthropic's Frontier Red Team, stated that attackers have already deployed AI agents to focus exclusively on external dependencies around the clock, and that models half a generation to one generation behind the frontier are sufficient; his recommendation is to conduct continuous self-red-teaming and use AI to rewrite software with formal verification.
Usage
- Enterprises can use this incident to audit the permissions and integration scope of third-party SaaS (admin backends, sales tools, etc.) connected to internal systems; no other actions are required.
Risks
- The two parties' accounts differ: Cathedral claims it took less than 12 hours, while Anthropic says the attempts lasted for several days; Anthropic states that the party found two vulnerabilities but reported only one, exceeding the safe harbor scope of the bug bounty program, while Cathedral claims it followed standard security research practices.
- Former OpenAI employee Will Depue cited anonymous sources claiming Cathedral obtained full Slack admin privileges; Graham responded that these claims were incorrect but did not address them point by point.
- The original Washington Post article is paywalled, and Cathedral's report has not been made public; we only read The Decoder's compilation and the beginning of Graham's response on X; the incident began on 10 26, earlier than this issue's window; the basis for inclusion in this issue is the new responses and controversy on 10 28.