al-ice.ai

The Lab Was Hardened, the Back Office Was Not: Cathedral’s Agents Reached Anthropic’s Transcripts, Salaries and Slack in Under 12 Hours

Agent & Supply Chain Security by al-ice.ai Editorial

On 26 October 2026 the Washington Post reported that Cathedral, a months-old cybersecurity startup founded by former Department of Government Efficiency staffers, told Anthropic its AI agents had found paths into the company’s internal systems in under 12 hours — reaching meeting transcripts, salary and job-offer data, and internal Slack discussions about Anthropic’s advanced models. The agents did not break Anthropic’s models or exploit Anthropic’s own code. According to Cathedral’s draft report, reviewed by the Post, they got in by exploiting vulnerabilities in unnamed third-party business software used for administrative and sales work. Anthropic confirmed the intrusion happened and says it took place inside its program for outside researchers — an authorized test, not a criminal attack — while accusing Cathedral of violating that program’s disclosure rules.

What was reached, and what was not

Anthropic confirmed to the Post that Cathedral accessed a “limited set” of sales, human-resources, and IT systems, holding business contact information for some customers and partners along with basic user account records. The company drew the boundary explicitly: customer prompts and Claude responses, source code, and model weights were not accessed. That boundary is the story’s load-bearing fact. Model weights and source code are the assets whose theft would constitute lab espionage; what the agents reached instead was the corporate nervous system — who is paid what, who is being hired, what was said in meetings, what the sales pipeline looks like. For a company whose product is trusted by governments and enterprises, that material is damaging in a different register: leverage, not replication.

Anthropic also says its own defenses partially worked. Its monitoring tools flagged some of Cathedral’s actions before the startup reported them, the company ended the access the same day, disabled the affected business software, and restored it only after the vendors confirmed fixes were ready. It says it found no evidence anyone outside Cathedral used the weaknesses, and the affected vendors were notified while their names and the exact flaws were withheld. Read plainly: detection fired, containment completed same-day, and the disclosure stayed coordinated. The embarrassment is not that the response failed — it is that the path existed at all, inside a company that writes the industry’s reference material on securing agentic systems.

The dispute that matters more than the breach

The two sides disagree about the rules of the engagement. Anthropic says Cathedral did not fully follow its bug-bounty rules because it failed to disclose all of its activity inside company systems, and notes the researchers had spent several days unsuccessfully trying to breach Anthropic’s software directly before the under-12-hours run succeeded. Cathedral says it kept data access to the minimum needed for responsible research. This is the part of the story worth sitting with, because it is the same dispute now recurring across every agentic-security exercise we have covered this month: the METR/Redwood red-team of OpenAI’s monitoring, OpenAI’s own rogue-agent sandbox work, and the Hugging Face intrusion now heading to court in Lassiter v. OpenAI all turn on where authorized testing ends and the lab’s obligations begin. When the tester is an autonomous agent chaining flaws across connected SaaS at machine speed, “disclose the full extent of your activity” is a rule written for human-paced engagements applied to something that can take hundreds of actions between check-ins. Expect this specific argument — over scope, pacing, and what counts as disclosure — to become the standard post-engagement fight, and expect programs to start writing agent-specific rules of engagement rather than stretching human ones.

Why the back office is the attack surface

The technical shape of this breach is one our readers will recognise: the model infrastructure held, and the connected HR, sales, identity, and collaboration tooling provided the path around it. A frontier lab can isolate weights, sandbox training, and gate deployments, and still be one OAuth grant or one unpatched SaaS integration away from an agent walking laterally through the business. The same month gave us the mirror image in unvetted agents holding customer bank credentials and the product-layer answer in Claude Duet’s credential isolation — the industry simultaneously discovering that agents plus standing enterprise access is the combination that breaks, and that the fix is removing the standing access rather than trusting the agent. Cathedral’s run is the red-team confirmation of that thesis from the other direction: the agents were the auditors, and the standing access belonged to the business software.

Two contextual facts, carried with attribution since we did not independently verify them. First, the company: Cathedral was co-founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein; Kliger served as the Pentagon’s chief data officer, and the company reportedly raised $160 million at a $1.4 billion valuation led by Andreessen Horowitz and Sequoia Capital. Second, a senior Trump administration official told the Post that three federal agencies had contracted with Cathedral and that the government was working with the startup on hostile-AI scenarios, with the official framing the findings as a warning that the same enterprise-software weaknesses could be abused by state actors. That framing is political, but the underlying technical claim needs no politics: ordinary SaaS flaws compromised the infrastructure of one of the most security-conscious organizations in the industry, which is exactly what should worry everyone below that tier.

Our verification was read-only. The timeline, access claims, “limited set” scope, exclusion of prompts, source code and weights, same-day termination, vendor notification, and rules dispute above were read first-hand from Gizmodo’s 26 October 2026 report and Cyber Security News’ 26 October 2026 report, both attributing to the Washington Post exclusive and Cathedral’s draft report, which we did not obtain. We did not contact Anthropic or Cathedral, access any internal system, or test any third-party software. The Washington Post original sits behind access controls we did not pass; where the two secondaries agree we report the fact, and where they attribute to unnamed officials we carry the attribution. Brave Search was used for discovery only.

Sources: