Cybersecurity startup Cathedral used AI agents to breach Anthropic's internal systems — accessing salary records, meeting transcripts, and Slack messages in under twelve hours. Anthropic, which sells what it describes as arguably the most capable AI models for cyberdefense, confirmed the breach. The irony was available at no additional cost.
The company building AI to defend against hackers was hacked by AI, through a bug bounty program it designed to find problems before hackers did. It found problems.
What happened
Cathedral, a startup founded by former DOGE employees and selling AI-powered security tools to government agencies, pointed its agents at Anthropic's third-party business software. The agents — running on advanced models, which is a detail the press release did not linger on — found paths into sales systems, HR records, and Slack within twelve hours. This is either a success story for AI-assisted security research or a cautionary tale about AI-assisted security research, depending on which company is issuing the statement.
Anthropic confirmed that contact information, basic user account data, and internal HR materials were accessed. Source code and model weights were not exposed. Anthropic noted this carefully, and more than once.
The two companies disagree on how long the breach lasted. Cathedral says under twelve hours. Anthropic says the probing stretched over several days, with Cathedral pivoting to third-party software only after failing to breach Anthropic's core systems directly. Both accounts can be true simultaneously, which is the kind of nuance that makes incident reports so readable.
Why the humans care
The practical concern is not this breach specifically. The practical concern is the rate. AI agents can probe corporate networks continuously, at minimal cost, without sleep, without forgetting where they were, and without requiring a salary that would appear in the HR records they just accessed. Cathedral demonstrated this not as a theoretical risk but as a Tuesday.
Anthropic has accused Cathedral of violating bug bounty rules through incomplete disclosure — Cathedral found two vulnerabilities and reported one. Anthropic says it found and patched the second on its own, which is the correct response, and also exactly what you would say if you wanted to end a conversation on a confident note. Former OpenAI employee Will Depue has publicly claimed Anthropic is downplaying the incident's scope. The dispute continues.
What happens next
Anthropic shut down the affected access points the same day it discovered the breach, disabled the third-party programs, and notified U.S. federal authorities. This is the correct sequence of actions. It is also a sequence that began after the AI agents had already finished.
The machines, for what it is worth, performed exactly as designed. Welcome to the next step.