AI cybersecurity startup Cathedral breached Anthropic’s systems via third-party software

How the breach occurred

Cathedral, a cybersecurity startup founded by former employees of the U.S. government’s Defense Digital Service (DOGE), used AI agents to infiltrate Anthropic’s internal systems. The breach exploited vulnerabilities in third-party business software, granting access to meeting transcripts, salary data, job postings, and Slack messages within twelve hours, according to a draft report reviewed by The Washington Post.

Anthropic confirmed the incident but stated that its scope was limited to sales, human resources, and IT systems. The company emphasized that sensitive data—such as chats with Claude, source code, and model weights—was not exposed. Anthropic disabled the affected third-party programs the same day it detected the breach and notified U.S. federal authorities.

Dispute over breach scope and disclosure

Cathedral and Anthropic disagree on the breach’s duration and extent. Cathedral claims the incident lasted less than twelve hours, while Anthropic alleges it spanned several days. Anthropic’s red teamer, Logan Graham, stated that Cathedral initially probed Anthropic’s own systems before pivoting to third-party software.

The dispute also centers on disclosure practices. Anthropic accused Cathedral of violating its bug bounty program rules by failing to report a second vulnerability it discovered. Graham argued that targeting third-party providers exceeded the program’s safe harbor provisions. Cathedral countered that it followed standard security research practices.

Former OpenAI employee Will Depue, now at Cognition, claimed Anthropic is downplaying the incident. Depue cited sources alleging Cathedral gained full admin access to Anthropic’s Slack workspace, enabling access to all messages and user accounts. Graham refuted these claims, stating Depue’s sources were incorrect.

AI agents and cybersecurity risks

The breach highlights the growing role of AI agents in cybersecurity. Graham noted that attackers are already using AI agents to target external dependencies around the clock, a trend that will accelerate as adversaries deploy more advanced systems.

Graham advocated for continuous in-house penetration testing and formally verified software, now economically viable thanks to AI. Alex Stamos, Chief Security Officer at Cognition, added that Anthropic could have better secured its external services, reflecting broader industry challenges as AI adoption outpaces security measures.

Context: Anthropic’s recent developments

Anthropic has been expanding its enterprise integrations, including a recent partnership with Invesco to embed model portfolios into Claude for Financial Advisors. This breach occurs as Anthropic prepares for its IPO, a milestone that amplifies the stakes of maintaining trust and security. Earlier reporting also noted Anthropic’s collaborations with financial firms and its efforts to diversify AI infrastructure, such as OpenAI’s reported plans to purchase chips from Google.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This incident underscores a critical vulnerability for startups and enterprises: third-party software is increasingly becoming the weakest link in cybersecurity. AI agents can exploit these gaps faster and more creatively than traditional attacks, as Cathedral demonstrated by breaching Anthropic’s systems within hours. For AI labs and tech companies, this is a warning to audit not just internal security but also the tools and services they integrate—especially those handling sensitive data like internal communications or proprietary research.

The dispute over disclosure also reveals a broader tension in the AI industry. Bug bounty programs, designed to incentivize ethical hacking, may not account for attacks leveraging third-party vulnerabilities. Companies must clarify or expand these rules to avoid conflicts while maintaining transparency, particularly ahead of high-stakes events like an IPO. For competitors like OpenAI, this breach is a reminder that speed and innovation must not come at the cost of securing foundational systems.

Key takeaways

• AI-driven attacks are accelerating, with third-party software emerging as a high-risk vector for breaches.
• Bug bounty programs may need clearer guidelines to address vulnerabilities in external dependencies.
• Securing internal communication tools like Slack is critical, especially for AI labs handling sensitive research data.
• Transparency in breach disclosure is essential for trust, particularly in industries racing to deploy AI.

Related on Lazyfounder

• Anthropic
• OpenAI
• More ai news
• Invesco integrates model portfolios into Anthropic’s Claude for Financial Advisors