AI Startup Cathedral Claims It Used Autonomous Agents to Breach Anthropic Systems

An AI startup named Cathedral reported that it used autonomous agents to breach Anthropic's systems within 12 hours by exploiting vulnerabilities in third-party business software. According to published reports, the incident exposed limited internal data.

What Happened

• The Attack Method: Cathedral stated its human researchers initially struggled for days before deploying AI agents, which found an entry point in under 12 hours.
• Data Accessed: Anthropic confirmed that a limited set of human resources, sales, and IT systems were accessed, compromising basic user account records and contact information for certain customers and partners.
• What Remained Safe: Anthropic reported that source code, AI model weights, and employee conversations with Claude were not exposed during the incident.

Response and Controversy

Anthropic stated that its monitoring systems flagged some of Cathedral’s activities before the startup officially reported them through the HackerOne bug bounty program, and access was reportedly shut off on the same day.

However, reports indicate that Anthropic accused Cathedral of violating the program rules by failing to fully disclose the extent of its activities. Industry observers noted that the incident underscores ongoing security risks associated with third-party software integrations.

Verification and Next Steps

Because this event is based on reported disclosures and statements from the involved parties, readers should consult official announcements from Anthropic and updates via HackerOne to verify the status of the bug bounty and security mitigations.