Severity major: Customer and partner contact data and internal HR/IT systems were accessed, a bounded scope stated by Anthropic.
Earliest source we hold 2026-10-28 · Captured by AI Risk Wire 2026-10-28 14:25 UTC
Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingCathedral, a cybersecurity startup, ran AI agents on advanced models against Anthropic's internal systems and third-party business software, including external admin and sales programs, under Anthropic's bug bounty program.
2 · What went wrongThe agents found paths into internal data and messaging systems, reaching meeting transcripts, salary data, job postings and Slack messages; Anthropic says pulling data and targeting third-party providers went beyond the bounty's safe harbor.
3 · What it reached or didAnthropic confirmed access to a limited set of sales, HR and IT systems, including contact information for some customers and partners and basic user account data; chats with Claude, source code and model weights were not exposed.
4 · What was doneAnthropic shut the affected access points the same day, disabled the third-party programs until the issue was resolved, notified U.S. federal authorities, and patched a second vulnerability it says it found itself.
What the sources state
Cause a permission, scope or wiring error
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Show every field, with its source and grade
The AI system
Software around the model
Cathedral AI agents
D inferred by us from the described behaviour, reason shown
Stage of use
in testing
D inferred by us from the described behaviour, reason shown
Whose system
company that built the AI
D inferred by us from the described behaviour, reason shown
How it was connected
agent with tools
D inferred by us from the described behaviour, reason shown
What it was for
Security research and penetration testing of Anthropic's systems under its bug bounty program.
D inferred by us from the described behaviour, reason shown
What happened
Earliest source we hold
2026-10-28
A the date the source itself carries
Cause
a permission, scope or wiring error
D inferred by us from the described behaviour, reason shown
Cause in detail
Access was obtained through external admin and sales programs and integrated third-party apps, which Stamos said Anthropic could have secured better.
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
D inferred by us from the described behaviour, reason shown
What was stopped
Third-party programs were disabled until the issue was resolved.
D inferred by us from the described behaviour, reason shown
What was done
Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities.
D inferred by us from the described behaviour, reason shown
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
What it did
The agents were used by an outside startup to break into Anthropic's internal systems through third-party business software.
D inferred by us from the described behaviour, reason shown
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
A limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data; meeting transcripts, salary data, job postings and Slack messages were reportedly reached.
C one secondary source states it
Kinds of data exposed
personal information, credentials
D inferred by us from the described behaviour, reason shown
Why this severity
Customer and partner contact data and internal HR/IT systems were accessed, a bounded scope stated by Anthropic.
D inferred by us from the described behaviour, reason shown
Context
Industry
Information
D inferred by us from the described behaviour, reason shown
Country
United States
D inferred by us from the described behaviour, reason shown
LR-2026-0257 · version 2 · published 2026-10-28 after automatic checks; not yet checked field by field by a person · changes to this case · JSON