Cathedral says its AI agents reached Anthropic's business systems in under 12 hours

A startup called Cathedral, founded by former staffers of the Department of Government Efficiency, says its AI agents found a way into Anthropic's business systems in less than 12 hours. Anthropic has partially confirmed the exercise, acknowledging that it reached limited business systems while not endorsing the wider claim that its internal network was comprehensively broken into.

Reports in the US and Chinese tech press this week describe the agents working through weaknesses in third-party enterprise software rather than attacking the model stack directly. The material said to have been reached includes payroll records and internal Slack conversations, which is why Chinese-language headlines put employee compensation at the centre of the story.

The dispute is about scope. Cathedral is a young company with an obvious interest in showing that agentic security testing works, and its account carries that motive with it. Anthropic's confirmation is narrow by comparison. Between the allegation and the acknowledgement there is a gap that neither side has filled with published documentation.

What is not in dispute is the shape of the path. The entry point was enterprise software that Anthropic relies on, not a jailbreak of Claude. That is the pattern security researchers have warned about as companies wire agents into SaaS tools, ticketing systems and internal wikis: the agent does not need to beat the model, only to find the door a human left open.

The timing is awkward for the lab. Anthropic has spent the past year arguing that agentic systems need to be deployed carefully and that its own safety work is a differentiator. A demonstration that outside agents walked into its business systems in half a day cuts against that narrative even if the damage was limited, and it hands enterprise customers a concrete question to ask during procurement.

For buyers, the practical lesson sits in third-party surface area. Agent deployments inherit the permissions of every tool they touch, and payroll, chat and HR systems are exactly where the sensitive data concentrates. When the weak link is an integration, access reviews and least-privilege scoping decide the size of an incident more than model-level guardrails do.

What to watch next: whether Anthropic publishes a fuller account of what Cathedral actually reached, whether the startup releases technical detail that outsiders can verify, and whether regulators, already attentive to how agents behave in live environments, treat the episode as a test case.