Cybersecurity Firm Cathedral Reportedly Used AI Agents to Access Anthropic's Internal Business Systems

Cybersecurity firm Cathedral reportedly used AI agents to exploit third-party software and access internal systems at AI developer Anthropic during invited security testing. Cathedral reported routes to personnel data and internal messages. Anthropic confirmed limited access to business systems holding contact details and basic account records, blocked access, and said Cathedral had not fully followed testing rules.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved exploiting vulnerabilities in software used by an AI developer, resulting in unauthorized access to internal systems and a data breach.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The AI agents successfully accessed non-public sensitive information, including employee salaries, job offers, and internal communications.

Causal factors

• Entity: AI
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated by Cathedral researchers intentionally deploying AI agents, which then autonomously executed actions to penetrate Anthropic's systems.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The AI system has significant implications for safety and public interests, as it was used to autonomously penetrate sensitive systems of a leading AI developer, raising national security concerns.

AI system and alleged parties

• AI system: Cathedral AI agents
• AI purpose: Threat Detection
• Behaviour type: Agent
• Alleged developer: AI agent system developers
• Alleged deployer: Cathedral, AI agent system deployers
• Alleged harmed parties: Privacy, Information integrity, Companies, Anthropic customers, Anthropic

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy violations where sensitive internal data and basic user account records were accessed.

Directly caused: Cathedral's AI agents accessed Anthropic's internal systems containing meeting transcripts, salary details, job offers, Slack messages, and business contact details for some customers and partners.

Inferred additional harm: It is likely that the personal and professional privacy of numerous Anthropic employees, job applicants, and business partners was compromised due to their sensitive data being exposed.

People affected

• Occurrences reported: 1
• People reportedly exposed: 1000

Potential causes

Management

• Insecure Communications Policy: Management allowed sensitive model discussions on conventional Slack channels.

Technology

• Vulnerable Enterprise Software: Vulnerabilities in third-party software allowed access to internal systems.
• AI-Powered Offensive Tools: Cathedral utilized AI agents to rapidly map and exploit vulnerabilities.

Data Inputs

• Unsecured Sensitive Communications: Transcripts and model details were stored on standard SaaS platforms.

Human Factors

• Hubristic Security Assumptions: Employees assumed standard business software was safe for sensitive data.

Process and Methods

• Poor Third-Party Risk Management: A gap in how the AI developer manages outside software providers.
• Delayed Monitoring Response: Internal monitoring detected the intrusion only after data was accessed.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, detailed accounts of the breach, the systems accessed, and the methods used. Both parties (Anthropic and Cathedral) confirm the core facts of the unauthorized access, though they differ slightly on the severity of the national security implications.
• Ambiguities identified: The specific names and technical architectures of the AI agents used by Cathedral are not disclosed. There is also a minor dispute regarding whether Cathedral fully adhered to the bug bounty program rules.
• Alternative interpretations: The incident could be interpreted as a standard software vulnerability exploit rather than an AI-specific safety failure, but the central role of autonomous AI agents in executing the breach justifies its classification as an AI safety incident.

A cybersecurity startup used autonomous AI agents to penetrate internal systems of AI developer Anthropic via third-party software vulnerabilities. While core AI models and customer data remained secure, the incident highlights the rising threat of AI-driven cyber operations targeting key technological firms and the vulnerabilities within AI supply chains.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Cathedral

Threat characteristics

• Imminence: Long-term. The immediate software vulnerability has been patched, but the incident highlights long-term strategic concerns regarding AI-driven cyber operations.
• Autonomy: Full autonomy. AI agents autonomously identified and exploited paths to access internal systems within a 12-hour window after deployment by researchers.
• Novelty: Evolved capability. Demonstrates an evolved capability where autonomous AI agents are actively deployed to conduct rapid, complex penetration testing on enterprise software.

Impact by dimension

• Physical security: Negligible. No kinetic attacks, critical infrastructure manipulation, or physical safety threats were reported in this incident.
• Information security: Minor. AI agents accessed sensitive internal communications, including Slack messages discussing advanced AI models, but no classified intelligence or core models were compromised.
• Sovereignty: Negligible. No core government operations, electoral systems, or sovereign decision-making processes were targeted or affected.
• Economic security: Minor. Highlights potential vulnerabilities in the supply chain of a leading AI developer, though no proprietary AI model weights or strategic technology were stolen.
• Societal stability: Minor. The breach did not threaten societal stability or civil liberties, although the personal privacy of Anthropic employees was compromised through data exposure.