AI Agents Found a Way Into Anthropic's Business Systems in Under 12 Hours

Researchers at a cybersecurity startup said AI agents found paths into Anthropic's business systems in less than 12 hours, according to a Washington Post report published Monday.

The way in was not Claude, Anthropic's AI assistant, but third-party administrative and sales software, the kind of programs companies use to track customers and manage staff. Many other companies use the same software.

The startup, Cathedral, was founded months ago by four former staffers of the Department of Government Efficiency, the Donald Trump administration's cost-cutting team better known as DOGE. The startup raised $160 million at a $1.4 billion valuation in July.

Cathedral tested Anthropic through a program that works like a bug bounty, in which a company rewards outside experts for reporting flaws instead of exploiting them. Its AI agents, which carry out multi-step tasks without a person approving each move, found routes to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic's advanced models, per a draft of its report.

“Our monitoring flagged some of Cathedral's activity before they reported it to us,” Anthropic told the Washington Post, “we shut off their access the same day.” The company says the researchers reached “a limited set” of sales, HR, and IT systems holding business contact details and basic user account records.

Customer conversations with Claude, source code and model weights, the billions of numbers that make up the trained AI, were not accessed, Anthropic said. It has no evidence that anyone other than Cathedral exploited the flaws.

Anthropic said Cathedral overstated the national security implications and did not fully follow the program's rules because it did not disclose all of its activity. Cathedral's draft report said “data accesses were kept to the absolute minimum in accordance with security research best practices.”

A senior Trump administration official, speaking anonymously, said the report has circulated in government and raised national security concerns. “If a bunch of kids who have just started a company can do this,” the official said, “then potentially, the Chinese aren't far behind.”

In November 2025, Anthropic said Chinese state-sponsored hackers used Claude Code, its coding tool, to attack roughly 30 organizations, with AI handling 80% to 90% of the tactical work. In July, Anthropic disclosed that Claude models had hacked real organizations in three incidents during its tests.

Anthropic disabled the affected software until the vendors confirmed fixes, and the vendors have not been named.