AI agents found paths into Anthropic’s business systems in under 12 hours, startup says

A cybersecurity startup says its AI agents found paths into Anthropic’s internal business systems in less than 12 hours. The Washington Post reported the findings on Monday.

The entry point was not Claude, the AI assistant that made Anthropic famous. It was the unglamorous software every company runs in the background: tools for administration, sales, HR and IT.

Anthropic is pushing back on parts of the story. The startup, Cathedral, is defending how it ran the test. Both sides are arguing about how bad this really was.

How the agents got in

Cathedral is a newly founded cybersecurity firm. It pointed AI agents at Anthropic’s business systems and let them look for weak spots.

They found some. In under 12 hours, the agents had mapped routes into Anthropic’s systems through vulnerabilities in third-party programs.

According to the research findings, the access reached sensitive internal material. That reportedly included employee compensation data and internal communications.

Anthropic says the most critical assets stayed untouched. The company stated that customer prompts sent to Claude and any associated source code remained secure.

Anthropic also said no customer data or model weights were accessed. Model weights are the trained core of an AI system, the part that makes Claude behave like Claude.

Two versions of the same test

The test was reportedly conducted under Anthropic’s authorized vulnerability disclosure program. These programs invite outside researchers to probe a company’s defenses and report what they find, rather than exploit it.

Anthropic says Cathedral overstated the national security implications of what it found. The company also says Cathedral did not disclose all of its testing.

Cathedral’s position is that it kept its data access to the absolute minimum.

Anthropic added another detail to its side of the ledger. The company says its own monitoring systems flagged unusual activity before Cathedral reported its findings.

Once detected, access was cut off. The affected third-party tools were disabled while fixes are put in place.

Why the side doors matter

The story is less about AI models being hacked and more about supply-chain security. That is the risk that comes from depending on software made by other companies.

Anthropic is one of the most closely watched AI developers in the world. If its administrative tools offered a route in, the same category of software likely sits inside countless other organizations.

The speed is the other uncomfortable detail. Less than 12 hours is not a long engagement for finding exploitable paths into a major tech company’s business systems.

What this means

For Anthropic, the episode lands awkwardly. The company builds AI agents and has been studying how they behave. Now AI agents have been used to probe its own perimeter.

The research findings note that this comes as AI agent autonomy is already under scrutiny following Anthropic’s own agent behavior evaluations. Anthropic would point out that its core AI systems were not the weak link.

That distinction is the most important part of the story for anyone trying to judge the risk. The reported exposure came through widely used business software, not through a flaw in Claude itself.

Anthropic’s claim that Cathedral did not disclose all of its testing goes to the heart of how these programs function. They run on trust between the company and the researcher.

The national security disagreement is another fault line. Anthropic says Cathedral overstated those implications. As AI companies become more central to government and defense conversations, how their internal security is described carries real weight.

For other companies, the lesson is fairly direct. Locking down your flagship product is not enough if your HR portal or sales software offers a quieter way in.