A new security test has exposed how AI-driven offensive tools can quickly uncover weak points in high-profile tech firms’ infrastructure. In a case involving Anthropic, a third-party cybersecurity startup demonstrated that it was able to access internal business systems in fewer than 12 hours. Although the test revealed access to sensitive administrative data, core AI models and source code remained secure.
What Happened
The startup, Cathedral, conducted a bug bounty–style evaluation under Anthropic’s external researcher program. The objective was to explore whether AI agents—intelligent, semi-autonomous tools that can probe and exploit systems—could chain together vulnerabilities in services connected to Anthropic’s business operations. Cathedral claims success, having moved laterally through various administrative and sales-related third-party software to access internal communications, HR records, and meeting transcripts. However, crucial assets such as model weights, source code, and customer prompt data were not compromised.
An official statement from Anthropic confirmed that the exposure was limited to systems handling business contacts, human resources, and IT infrastructure. The systems in question stored partner and customer information, along with personnel data and internal Slack messages about advanced AI work. The firm stressed that its core model tech and user-facing product data remained untouched.
Discovery, Response, and Dispute
Anthropic reported discovering the unauthorized access through internal monitoring tools. The company says it shut down the affected business software the same day the breach was detected and only restored access after vendors confirmed the flaws had been fixed. Importantly, it asserts that there’s no evidence that anyone outside of Cathedral exploited the vulnerabilities.
Cathedral claims it acted within reasonable ethical research boundaries, confining its probing to only that data strictly necessary for the test. Some friction emerged, though: Anthropic says Cathedral didn’t fully meet its disclosure requirements, particularly in failing to report all system interactions. On the other hand, Cathedral withheld details like vendor names and specific vulnerability descriptions, citing the risk that such details could be misused.
Wider Implications and Lessons for AI Labs
This episode underscores a growing reality in AI security: organizations often protect their crown jewels—their model architectures, weights, and proprietary code—while forgetting about downstream risks. Systems supporting HR, sales, identity management, and interdepartmental collaboration can provide alternate entryways into confidential or commercially sensitive information.
To tighten security, experts suggest mapping every software link, limiting permission levels of applications, closely monitoring OAuth tokens, and maintaining strict oversight on account behavior. Also vital is the ability to quickly revoke access once it’s no longer necessary.
The speed at which Cathedral completed the breach test with AI agents carries its own warning. These tools can accelerate the entire security testing lifecycle—from vulnerability scanning to exploit chaining—highlighting how traditional, slower assessments may soon be inadequate.
Cathedral is a newly founded firm led by several former DOGE staffers. It gained notice earlier this year after raising $160 million in funding and securing contracts with federal agencies focused on hostile AI risk. The episode with Anthropic positions the startup as a rising player in the AI security domain.
Looking forward, this event represents more than just a vulnerability report—it’s a call to tighten windows of exposure and reduce slack in digital-era defenses. For AI-heavy organizations, it demonstrates that the hardest assets to protect aren’t always the ones in the data centers—they’re in the systems most deeply integrated with wider business operations.
