Anthropic’s Claude and other AI agents are some of the most carefully-protected pieces of software in the world. A new cybersecurity startup composed of ex-DOGE members has come worryingly close, however, demonstrating that nothing is any stronger than the weakest link in its vendor chains.
The startup, Cathedral, claims to have not only accessed private internal Anthropic data and messages but to have found openings in under 12 hours of beginning to probe vendors for vulnerabilities. Anthropic has confirmed the breach but says that Cathedral did not reach any critically sensitive items like customer conversations, model weights or source code.
Anthropic Says Hackers Did Not Breach AI Agents; Hackers Say They Held Back Intentionally
Though the involved parties agree that the breach took place, they differ somewhat on details of severity and seriousness.
Cathedral says that it was pursuing vulnerabilities in connection with Anthropic’s public security bug bounty program, which offers rewards for discovering issues that range in amounts from $100 to $550,000 depending on the severity of the flaw. The researchers did not attack Claude directly, however, but instead targeted assorted third-party administrative and sales software provided by vendors.
Anthropic’s story is essentially that the Cathedral researchers did not get much farther than these initial vendor entry points, and that the outfit overstated the national security implications of the breach. The developer says that the researchers definitely did not access its AI agents, such as stored conversations with users or the source code and model weights that make them tick, and that it also detected some of their activity prior to their public disclosure and cut off their access. Cathedral has since responded by saying that they intentionally did not go as far as they could have. Anthropic is also refusing to pay any bug bounty to Cathedral, claiming that the researchers did not disclose all of their activity and failed to strictly follow program rules.
Cathedral was founded several months ago by four former members of the Department of Government Efficiency (DOGE), and in July was valued at $1.4 billion as it raised $160 million in initial funding. The outfit itself has a focus on using AI agents for penetration testing of targets, and is seeking federal contracts for the AI systems it has developed. The group has reported accessing internal meeting notes and discussions about job offers and salary for Anthropic prospects and staff.
While Anthropic does not seem to believe that the incident rose to the level of a national security concern, at least some of the Trump administration seems to disagree. A senior official, speaking to the media anonymously, said that if a “bunch of kids” were able to penetrate this far then advanced espionage-focused hackers from China could not be far behind.
John Strand, Owner of Black Hills Information Security, is additionally of the belief that Cathedral was primarily interested in using this as a marketing opportunity rather than a serious attempt to assist Anthropic, or even to collect on legitimate bug bounties: “It’s a very interesting story, and I’m disappointed in how some of this was released and communicated. But there are important lessons here. One is about what happens when bug bounty programs are poorly run or the relationship between researchers and vendors breaks down. The other is about the enormous amount of risk organizations inherit from SaaS applications and the vendors they trust with access to critical parts of their infrastructure.”
Researchers spent days trying Claude “head on” before targeting vendors with AI agents
While headlines indicate the AI agents breached Anthropic in less than 12 hours, the actual story is a bit more complicated. It seems the Cathedral researchers first spent several days attempting to breach Claude itself, apparently to no avail. Failing that approach, they then turned their attention to vendors where they found success in under half a day. While that speaks positively to the resilience of Claude when probed maliciously by fellow AI agents, an attacker that was less interested in bug bounty rewards and more interested in theft likely would have skipped straight to probing the vendors for weaknesses.
Their report, as well as media follow-up reports, have yet to name any of these vendors. However, the researchers have implied that they are broadly and commonly used by businesses. This story may thus not yet be over, as follow-on attackers may follow the breadcrumbs with their own AI agents to test Anthropic’s known vendors. Anthropic’s confirmation indicates, at minimum, the vulnerabilities exposed business contact details and “basic” user account records.
Vendor exploitation is a long-running problem, standing as a recurring cybersecurity issue from long before AI agents were even a factor. The most recent Verizon DBIR report found 48% of data breaches involved a third party services provider, a jump of 60% from the prior year. One of the biggest factors in this surge is an increase in use of stolen vendor credentials, a task that AI agents are particularly well-suited for as they can rapidly comb exposed GitHub accounts and similar sources. The Kroll Data Breach Outlook 2026 additionally found that 69% of its recorded incidents involved a vendor, and Black Kite’s 2026 Third-Party Breach Report finds that the average vendor data breach can now be expected to yield over five downstream victims.
Jacob Krell, Sr. Dir: Secure AI Solutions & Cybersecurity at Suzu Labs, notes that vendor integration points will almost certainly be one of the weaknesses that AI agents continue to target: “Cathedral’s agents got into Anthropic the same way attackers get into everyone else, through the vendors. By Anthropic’s account, days of direct attacks on its own software failed. The breach came when the agents pivoted to the commercial software-as-a-service (SaaS) tools running Anthropic’s sales, human resources, and IT operations, and Cathedral says its agents found exploitable weaknesses there in under 12 hours.”
“Anthropic is about as well-defended as a company gets, and its crown jewels never moved, no model weights, no source code, no customer conversations with Claude,” Krell adds. “What got hit was the layer it bought instead of built, third-party software that tracks customers and manages staff, the kind of layer wired together with integration permissions nobody re-reviews. Security maturity is capped by the weakest vendor you integrate with, and no amount of in-house engineering changes that.”
