Cathedral researchers used AI agents to reach Anthropic's internal HR, sales and IT data via third-party apps
According to a Washington Post report, cybersecurity startup Cathedral used AI agents to find entry points into Anthropic's internal systems in less than 12 hours, by exploiting weaknesses in third-party business applications rather than Claude itself. The researchers found routes to employee salary details, job offers, meeting transcripts and internal Slack conversations, and Anthropic acknowledged they accessed a limited number of internal sales, HR and IT systems. Anthropic said customer conversations, models, source code and weights were not compromised, that it blocked access and disabled the affected applications, and that it found no evidence anyone else exploited the weaknesses. The work was authorized security research, though Anthropic says Cathedral did not fully comply with its disclosure program.
What the AI did
Researchers at the cybersecurity startup Cathedral used AI agents to find potential entry points into Anthropic's internal systems in less than 12 hours. They went through weaknesses in third-party business applications rather than through Claude itself. The work was authorized security research, and it has not been reported which AI agents they used.
First reported October 26, 2026 · Added to the register November 4, 2026 · 1 source
- Deployer
- Cathedral
- Affected
- Anthropic
- When it happened
- Not stated in the sources
- First reported
- October 26, 2026
What this means for you
Could this affect you?
If your organisation relies on third-party business applications. Anthropic employees' salary, job offer, meeting and Slack data was reachable through outside sales, HR and IT applications, and any company relying on similar applications could have weaknesses found just as quickly with AI agents.
What to check
- List the third-party business applications that hold HR, sales and internal communications data.
- Test those applications for weaknesses, assuming attackers use AI agents to find entry points quickly.
- Monitor for suspicious access to those applications.
- Be ready to disable vendor applications until their weaknesses are fixed.
Areas of your AI programme this touches
Every fact and its source (6)
- Data reachableSalary details, job offers, meeting transcripts, internal Slack conversations“This included employee salary details, job offers, meeting transcripts, and internal Slack conversations”[1]
- Anthropic responseBlocked access and disabled affected applications“It then blocked access and disabled the affected applications until their vendors addressed the vulnerabilities.”[1]
- Scope limitation claimedCustomer conversations with Claude not compromised“the incident did not compromise customer conversations with Claude”[1]
- Exploitation by othersNo evidence found by Anthropic“Anthropic maintains it has found no evidence that anyone else exploited the same weaknesses.”[1]
- Disclosure compliance disputeAnthropic says Cathedral did not fully comply“Anthropic also says Cathedral did not fully comply with its disclosure program”[1]
- Time taken to find entry pointsLess than 12 hours using AI agents“The researchers used AI agents to identify potential entry points in less than 12 hours.”[1]
Sources
- Anthropic's sensitive internal data was exposed, and AI helped make it happendigitaltrends.com · October 26, 2026
How this record is classified. Severity S (3/5): real harm to one organisation, data exposed, or a containment failure. OECD level: hazard, an event that could plausibly have led to harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
