{"schema_version":"0.9.0","id":"LR-2026-0257","record_version":2,"title":"Cathedral AI agents breach Anthropic internal systems via third-party business software","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"Cathedral AI agents","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"evaluation","tier":"provider","lifecycle_stage":"evaluation","integration_type":"agentic_with_tools","intended_use":"Security research and penetration testing of Anthropic's systems under its bug bounty program.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-28","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"integration","root_cause_detail":"Access was obtained through external admin and sales programs and integrated third-party apps, which Stamos said Anthropic could have secured better.","failure_class_detail":"The agents were used by an outside startup to break into Anthropic's internal systems through third-party business software; no agent-mechanism taxonomy value is stated.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":"Third-party programs were disabled until the issue was resolved.","remediation":"Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: Customer and partner contact data and internal HR/IT systems were accessed, a bounded scope stated by Anthropic.","harm_class":[],"affected_description":"A limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data; meeting transcripts, salary data, job postings and Slack messages were reportedly reached.","protected_class_involved":null,"data_categories_exposed":["pii","credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://the-decoder.com/ai-agents-hacked-anthropic-maker-of-arguably-the-most-capable-ai-models-for-cyberdefense/","publisher":"The Decoder","date":"2026-10-28","type":"press","title":"AI agents hacked Anthropic, maker of arguably the most capable AI models for cyberdefense","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"D","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"D","system.developer":"D","system.deployment_context":"D","system.autonomy_level":"D","event.root_cause":"D","event.adversarial_actor":"D","event.operations_paused":"D","event.remediation":"D","event.agent_involved":"C","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.affected_description":"C","impact.data_categories_exposed":"D","impact.severity":"D","context.industry":"D","context.systemic_exposure":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"According to their report, AI agents running advanced models found paths to meeting transcripts, salary data, job postings, and Slack messages in under twelve hours."}],"system.harness":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"system.deployment_context":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"system.integration_type":[{"source_index":0,"quote":"According to their report, AI agents running advanced models found paths to meeting transcripts, salary data, job postings, and Slack messages in under twelve hours."}],"system.intended_use":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"event.root_cause":[{"source_index":0,"quote":"Cathedral's researchers got in through external admin and sales programs."}],"event.root_cause_detail":[{"source_index":0,"quote":"He noted that integrated third-party apps are a major problem across the industry and that Anthropic could have done a better job securing its external services."}],"event.adversarial_actor":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"event.incident_class":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"event.agent_involved":[{"source_index":0,"quote":"According to their report, AI agents running advanced models found paths to meeting transcripts, salary data, job postings, and Slack messages in under twelve hours."}],"event.failure_class_detail":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"impact.affected_description":[{"source_index":0,"quote":"Anthropic confirmed that the researchers accessed a limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Both the Anthropic and OpenAI labs stored all of their research secrets in Slack, Depue added, with admin API keys scattered across their systems."}],"impact.severity_because":[{"source_index":0,"quote":"Anthropic confirmed that the researchers accessed a limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data."}],"context.industry":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"context.country":[{"source_index":0,"quote":"Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities."}],"context.systemic_exposure":[{"source_index":0,"quote":"Anthropic confirmed that the researchers accessed a limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data."}],"event.summary":[{"source_index":0,"quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities."}],"event.remediation":[{"source_index":0,"quote":"Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities."}],"event.operations_paused":[{"source_index":0,"quote":"Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities."}],"impact.severity":[{"source_index":0,"quote":"Anthropic confirmed that the researchers accessed a limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-28"}]},"notes_on_gaps":"Only one source (The Decoder) is present. Model name/version and developer of the agents are not disclosed ('advanced models'). No source states who first noticed the breach (detection_method unknown; story.caught null). No trigger is stated, so event.trigger omitted. No failure_class value is stated for the agent mechanism; failure_class left null. No date_occurred, no loss figure, no affected counts, no autonomy arrangement stated. system.tier and event.date_disclosed omitted as derived. incident_class security_compromise rests on the agents breaching Anthropic's systems boundary; adversarial_actor external_attacker reflects Cathedral's deliberate operation. root_cause integration rests on access via external admin/sales programs and integrated third-party apps. data_categories_exposed inferred from customer/partner contact and account data plus admin API keys mentioned in the source. system.tier: provider by rule (deployment_context evaluation). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.harness: classified from described behaviour. system.lifecycle_stage: evaluation. system.integration_type: classified from described behaviour. system.intended_use: classified from described behaviour. system.developer: no source names the developer. system.deployment_context: a test or red-team run. system.autonomy_level: no source states the arrangement. event.adversarial_actor: external_attacker. event.operations_paused: classified from described behaviour. event.remediation: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.summary: classified from described behaviour. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. impact.data_categories_exposed: classified from described behaviour. context.industry: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: classified from described behaviour."},"context":{"industry":"Information","org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":false,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Cathedral, a cybersecurity startup, ran AI agents on advanced models against Anthropic's internal systems and third-party business software, including external admin and sales programs, under Anthropic's bug bounty program.","quote":"Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The agents found paths into internal data and messaging systems, reaching meeting transcripts, salary data, job postings and Slack messages; Anthropic says pulling data and targeting third-party providers went beyond the bounty's safe harbor.","quote":"Graham added that targeting third-party providers and pulling data went beyond the program's safe harbor provisions, though he welcomed the discovery of the vulnerabilities.","source_index":0,"grade":"C"},{"step":"reached","text":"Anthropic confirmed access to a limited set of sales, HR and IT systems, including contact information for some customers and partners and basic user account data; chats with Claude, source code and model weights were not exposed.","quote":"Anthropic confirmed that the researchers accessed a limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data.","source_index":0,"grade":"C"},{"step":"done","text":"Anthropic shut the affected access points the same day, disabled the third-party programs until the issue was resolved, notified U.S. federal authorities, and patched a second vulnerability it says it found itself.","quote":"Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://the-decoder.com/ai-agents-hacked-anthropic-maker-of-arguably-the-most-capable-ai-models-for-cyberdefense/"]}}