Researchers Use AI Agents to Breach Anthropic’s Internal Systems in Just 12 Hours

Cybersecurity startup Cathedral says its AI agents found routes into Anthropic’s internal business systems in less than 12 hours, exposing how fast automated security tools can find and chain flaws across connected services.

The work took place through Anthropic’s program for outside researchers, making this an authorized security test rather than a criminal attack, according to The Washington Post.

Anthropic Internal System Breach

According to reporting from The Washington Post, the agents did not break Anthropic’s core AI models or exploit the company’s own code. Instead, Cathedral said they used weaknesses in unnamed third-party software used for administrative and sales work.

Once inside, researchers reached meeting transcripts, salary and job-offer details, and internal Slack talks about Anthropic’s advanced AI models.

Anthropic confirmed in a statement to The Washington Post that Cathedral accessed a limited group of sales, human resources, and IT systems. Those systems held business contact information for some customers and partners, along with basic user account records.

However, customer prompts, Claude responses, source code, and model weights were not accessed. This limit matters because model weights and source code are among an AI company’s most sensitive assets.

Anthropic also said its monitoring tools flagged some of Cathedral’s actions before the startup reported them. The company ended the access on the same day, disabled the affected business software, and restored it only after the vendors confirmed that fixes were ready.

Anthropic said it found no evidence that anyone outside Cathedral had used the weaknesses. The two sides disagree on parts of the test. Anthropic said Cathedral did not fully follow its bug bounty rules because it failed to disclose all activity within the company’s systems.

Cathedral said it kept data access to the minimum needed for responsible research. The vendors behind the affected software were also notified, but their names and the exact flaws were withheld to reduce the risk of misuse.

The case shows why third-party application security is now a major concern for AI labs. A company may protect model infrastructure while connected HR, sales, identity, and collaboration tools create other paths into sensitive business data.

Security teams should map every software connection, limit application permissions, review OAuth tokens, monitor unusual account behavior, and quickly remove access that is no longer needed.

It also shows how AI agents can compress security testing. Agents can scan systems, test paths, run tools, and review results with less waiting between steps.

Cyber Security News has previously reported how AI agents can automate the cyber kill chain and how Claude exploited software flaws during controlled evaluations. These cases do not mean humans are removed. Researchers still set the scope, judge findings, and control disclosure.

Cathedral is only months old, but it has gained attention. The company was co-founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein, all former DOGE staffers. Kliger served as the Pentagon’s chief data officer.

Reuters reported in July that Cathedral raised $160 million at a $1.4 billion valuation, with Andreessen Horowitz and Sequoia Capital leading the round. A senior Trump administration official told The Washington Post that three federal agencies had contracted with Cathedral and that the government was working with the startup on hostile AI scenarios.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Researchers Use AI Agents to Breach Anthropic’s Internal Systems in Just 12 Hours appeared first on Cyber Security News.