AI agents used by cybersecurity startup Cathedral found routes into parts of Anthropic’s internal business systems in less than 12 hours, according to reporting by Decrypt, citing a Washington Post report. The incident involved weaknesses in third-party administrative and sales software rather than Anthropic’s Claude assistant itself.
What the researchers accessed
Cathedral tested Anthropic through a bug-bounty-style security program, under which outside researchers look for vulnerabilities and report them rather than use them for harmful purposes. Its agents were designed to complete multi-step tasks without a person approving every action.
According to a draft of Cathedral’s report, the agents found paths to meeting transcripts, salary and job-offer information, and Slack messages concerning Anthropic’s advanced models. The software involved is used for administrative, sales, customer-management and employee-management functions, and is also used by many other companies.
Anthropic confirmed that Cathedral reached a limited set of sales, human-resources and information-technology systems. The company said the accessed systems contained business contact details and basic user-account records. It said customer conversations with Claude, Anthropic’s source code and its model weights were not accessed. Model weights are the billions of numerical values that encode a trained AI model.
Dispute over testing and security implications
Anthropic said its monitoring systems flagged some of Cathedral’s activity before the startup reported it and that access was shut off on the same day. The company also said Cathedral overstated the national-security implications of the findings and did not disclose all of its testing activity under the program’s rules.
Cathedral said in its draft report that it kept data access to the minimum required under security-research best practices. Anthropic disabled the affected software while waiting for the vendors to confirm fixes. The vendors have not been identified, and Anthropic said it had no evidence that anyone besides Cathedral exploited the weaknesses.
The episode has drawn government attention. An unnamed senior Trump administration official told the Washington Post that the report had circulated in government and raised national-security concerns, arguing that vulnerabilities found by a newly formed startup could potentially also be found by foreign actors.
Broader AI security context
Cathedral was founded several months ago by four former employees of the Department of Government Efficiency, commonly known as DOGE. The startup raised $160 million at a $1.4 billion valuation in July.
The incident adds to concerns about autonomous AI systems carrying out cyber tasks across multiple steps. Anthropic said in November 2025 that Chinese state-sponsored hackers had used Claude Code, its coding tool, in attacks against about 30 organizations, with AI handling 80% to 90% of the tactical work. In July, the company said its tests had identified three cases in which Claude models hacked real organizations.
Moneyiar market picture
Moneyiar market data as of October 25, 2026, at 22:38 (+03:30) showed mixed performance among the listed digital assets:
- Dogecoin (DOGE): $0.0771783502, down 0.11% over 24 hours and 2.09% over seven days.
- Aethir (ATH): $0.0056524905, down 2.89% over 24 hours but up 6.14% over seven days.
- Ailey (ALE): $0.2668263334, up 0.04% over 24 hours and down 0.09% over seven days.
- Dog (Bitcoin) (DOG): $0.0008878443, down 0.79% over 24 hours and up 0.24% over seven days.
