AI agents accessed Anthropic's salary records and Slack messages in under 12 hours, report claims
Cybersecurity startup Cathedral reportedly used AI agents that can work on their own to get into parts of Anthropic's internal business systems. These included employee records and Slack messages. The incident has raised new concerns about weaknesses in software made by outside companies that businesses use to do their work. However, Anthropic says the attackers did not access its main AI systems, customer conversations or model weights.
Anthropic, the company that makes Claude, reportedly found weaknesses in its internal business systems after a cybersecurity startup used AI agents to find ways into its administrative software in less than 12 hours. The incident shows that even companies building advanced AI models can have security problems in the everyday software they use to run their businesses.
According to a report published by The Washington Post on Monday, the researchers accessed a limited amount of information through outside companies' sales, human resources and IT software. They did not attack Claude itself. Other businesses reportedly use the same software, raising concerns that similar weaknesses could put other organisations at risk.
The findings came from a security-testing programme designed to help companies find and fix weaknesses before criminals can use them. However, Anthropic disagreed with parts of the researchers' actions and their description of what happened.
AI agents accessed internal business information
The testing was carried out by Cathedral, a cybersecurity startup founded by four former employees of the Department of Government Efficiency (DOGE). DOGE is a cost-cutting initiative linked to US President Donald Trump's administration. In July, Cathedral raised $160 million at a reported company value of $1.4 billion.
Cathedral took part in a programme similar to a bug bounty. In these programmes, security researchers look for possible weaknesses and tell the organisation responsible so they can be fixed. Cathedral's AI agents can carry out several actions in a row without needing a person to approve every step. The agents reportedly found ways to access internal meeting transcripts, salary details, job-offer information and Slack discussions about Anthropic's advanced AI models.
Anthropic said it had noticed some of Cathedral's activity before the startup reported its findings. “Our monitoring flagged some of Cathedral's activity before they reported it to us,” the company told The Washington Post. Anthropic added that it removed the startup's access on the same day.
The company said the affected systems held a limited amount of business information, including contact details and basic account records. It stressed that the incident did not involve customer conversations with Claude, source code or model weights. Model weights are numbers that help determine how a trained AI model works.
Anthropic also said it had found no evidence that anyone other than Cathedral had used the weaknesses to gain access. The affected software was turned off while the companies that supplied it worked to confirm that fixes were available. Anthropic has not publicly named those software providers in the information provided.
Anthropic and Cathedral disagree about how the testing was carried out. Anthropic accused Cathedral of making the national security risks sound greater than they were and of not reporting all its activities as the programme's rules required. In a draft report cited by the newspaper, Cathedral said it had limited its access to data as much as possible and followed common security research practices.
Anthropic incident raises wider AI security questions
The reported security breach has raised concerns beyond the technology industry. A senior official in the Trump administration, who spoke anonymously to The Washington Post, said the findings had been shared within the government and had raised national security concerns.
“If a bunch of kids who have just started a company can do this,” the official said, “then potentially, the Chinese aren't far behind.”
The concern is that AI systems that work on their own could help attackers find security weaknesses and move through connected software with little human help. Traditional security tools usually warn investigators about suspicious activity. AI agents may be able to carry out several steps of a task themselves, although their abilities and reliability can vary.
Anthropic has previously reported cases in which AI helped with cyberattacks. In November 2025, the company said hackers backed by the Chinese government had used Claude Code, its coding tool, in attacks against about 30 organisations. Anthropic estimated that AI carried out between 80 per cent and 90 per cent of the practical work in that campaign.
In July, the company also reported that its Claude models had hacked real organisations in three separate incidents during its own tests. These reports showed that AI can be used for both helpful and harmful purposes. Tools designed to help people write code and carry out security work can also be used to support attacks.
Anthropic says it has restricted access to the affected systems while fixes are being confirmed. However, it remains unclear how serious all the weaknesses were and whether the same problems could affect other organisations.