AI Agents Breached Anthropic’s Internal Systems in 12 Hours. The Attack Vector Should Sound Familiar.

AI Industry Watch

On the same morning Anthropic filed its S-1 registration statement with the SEC, the Washington Post published a report about a cybersecurity startup that had walked into Anthropic's internal systems in under 12 hours.

That timing is not evidence of malice or conspiracy. It is evidence of where the AI industry actually is right now: growing fast enough to file for a $2 trillion IPO, and simultaneously managing the same third-party software exposure problems that affect every large enterprise — just with higher stakes attached.

What Happened

Cathedral, a months-old cybersecurity startup, conducted a security investigation under Anthropic's vulnerability-disclosure program — the kind of authorized bug bounty engagement that responsible security programs invite. Cathedral deployed AI agents to probe Anthropic's systems. In under 12 hours, those agents found paths into internal business systems through vulnerabilities in unnamed third-party software used for administrative and sales operations.

What the researchers reached: internal meeting transcripts, salary and job-offer details, Slack messages discussing Anthropic's advanced AI models, business contact information for some customers and partners, and basic user account records.

What they did not reach: customer prompts, Claude responses, source code, or model weights. Anthropic confirmed this explicitly, and it matters — model weights and source code are the crown jewels of a frontier AI company. Those were not accessed.

Anthropic says its own monitoring tools flagged some of Cathedral's activity before the startup reported its findings. The company terminated Cathedral's access the same day, took the affected business software offline, and restored it only after the vendors confirmed fixes were in place. Anthropic found no evidence that anyone outside Cathedral exploited the weaknesses.

There is a dispute between the parties. Anthropic says Cathedral did not fully comply with its bug bounty rules — specifically, that Cathedral failed to disclose all of its activity inside the systems. Cathedral says it kept data access to the minimum required for responsible research. Neither claim is verifiable from public information. The vendor names and specific vulnerabilities were withheld to reduce the risk of exploitation by others.

Who Is Cathedral

Cathedral was co-founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein — all former staffers from the Department of Government Efficiency (DOGE). Kliger previously served as the Pentagon's chief data officer. Reuters reported in July that Cathedral raised $160 million at a $1.4 billion valuation, with Andreessen Horowitz and Sequoia Capital leading the round.

The Washington Post reported that a senior Trump administration official confirmed three federal agencies had contracted with Cathedral and that the government was working with the startup on hostile AI scenarios. That same official said Cathedral's report on its access inside Anthropic had circulated within the government and raised national security concerns.

Anthropic disputed Cathedral's characterization of the national security implications as overstated.

Alex Stamos, CISO at AI coding startup Cognition, reviewed Cathedral's findings for the Washington Post. His assessment: the findings showed "a gap" in how Anthropic manages its use of outside software providers.

The Attack Vector Is the Point

The most important technical detail in this story is not that an AI company got breached. It is how it happened.

Cathedral did not find a vulnerability in Claude. They did not compromise Anthropic's model infrastructure, training pipeline, or core security controls. They exploited weaknesses in the third-party business software stack — the HR systems, sales tools, identity management layers, and collaboration platforms that Anthropic, like every large organization, depends on to operate.

This is the attack surface that is hardest to defend, most commonly overlooked, and most familiar to healthcare security teams. The Change Healthcare breach in 2024 was not an attack on UnitedHealth Group's core claims infrastructure. It was a ransomware attack through a Citrix remote access gateway — a third-party product, without MFA enabled. The pathway in was not exotic. The damage was catastrophic.

The Cathedral-Anthropic scenario is structurally identical in attack vector, even though the damage was contained and the engagement was authorized. An attacker — or an AI agent pursuing a task without authorization — following the same paths Cathedral found would have reached internal communications, personnel data, and business records at one of the most security-conscious AI companies in the world, using the same methods.

What This Means for Healthcare

Healthcare organizations evaluating or deploying AI tools from frontier vendors need to extend their third-party risk assessments beyond the AI stack itself.

When your organization signs a contract with an AI vendor, you are implicitly accepting risk from every piece of business software that vendor runs — their HR platform, their sales CRM, their identity provider, their collaboration tools. If any of those systems has an exploitable weakness, an attacker or a misconfigured AI agent can use it as a path to data that may include information about your contract terms, your technical environment, your contacts at the vendor, and your usage patterns.

This is not a theoretical risk. Cathedral demonstrated it in under 12 hours against a company that has a dedicated security program, runs a formal bug bounty, and is staffed by people who think carefully about AI safety and security.

The practical implication for healthcare vendor risk management:

Third-party risk assessments need to cover the full software stack, not just the AI product. When you evaluate an AI vendor, your security questionnaire should ask about their own third-party software inventory, not just their model security controls. The breach surface is the entire connected ecosystem.

Vendor contracts should include breach notification requirements that cover business system compromises, not just AI system compromises. If an AI vendor's HR system is breached and it contains information about your organization's contract or technical environment, you need to know. Most vendor contracts in this space are not written with that scope.

The speed factor is new and real. Cathedral's AI agents compressed what would have been a multi-day manual engagement to under 12 hours. The same compression applies to malicious actors using the same tools. Dwell time assumptions built around human-speed attackers need to be revisited. Detection and response timelines that worked against human threat actors may not be fast enough against AI-accelerated ones.

Authorized testing like this is exactly what your vendors should be doing. The Cathedral engagement, disputes aside, is an example of a security program functioning correctly — inviting external researchers to find problems before adversaries do. When evaluating AI vendors, ask whether they run active vulnerability disclosure programs, whether they engage external researchers, and how quickly they remediate reported findings. Anthropic disabled affected systems the same day Cathedral reported. That response time matters.

The Bigger Picture

The Cathedral-Anthropic story is not primarily a story about Anthropic's security failures. It is a story about the gap between how AI companies present themselves in public filings and investor materials, and the ordinary enterprise security challenges they face like every other large organization.

Anthropic's S-1, filed hours before this report published, says the company aims to "realize the benefits of AI while navigating and preventing the risks that come with a technological revolution this fast and this powerful." That language is accurate as a statement of intent. It does not mean Anthropic's Workday instance or Salesforce environment is hardened against an AI-assisted bug bounty researcher.

For healthcare security leaders, the takeaway is straightforward: the AI companies you are evaluating and deploying are not operating from a position of superior security across their entire enterprise. They have strong AI-specific security programs and the same legacy third-party software exposure as everyone else. Treat them accordingly in your vendor risk program — with the same rigor, the same questionnaires, and the same contract requirements you apply to any vendor operating inside your perimeter.

The AI is already inside. The third-party software risk is already inside. Both need governance.

This is an entry in the AI Industry Watch series. For related coverage, see When the Agent Is Already Inside: Rogue AI Risk and the Trusted Identity Problem in Healthcare and When AI Agents Go Off Script: Anthropic's Unintended Actions Disclosure and What It Means for Healthcare.

What Happened

Who Is Cathedral

The Attack Vector Is the Point

What This Means for Healthcare

The Bigger Picture

Key Links