AI Agents Penetrate Anthropic Systems in Under 12 Hours

How AI Agents Found a Path into Anthropic

Imagine placing high-tech security locks on your front door, only to leave a side office window unlocked. That scenario effectively describes what happened to Anthropic, one of the leading artificial intelligence research firms.

According to a report published by The Washington Post, cybersecurity researchers managed to find entry routes into Anthropic's internal business systems in less than 12 hours. Rather than relying on human hackers working manually, the researchers deployed autonomous AI agents to execute the tasks.

These AI agents carry out multi-step instructions independently without requiring a human to approve every single move. Here is a breakdown of how the test occurred, what data was exposed, and why the findings are drawing attention from cybersecurity experts and government officials alike.

Third-Party Tools Provided the Entry Route

When news breaks about an AI company experiencing a security event, people often assume the core AI model itself was breached. However, Anthropic's flagship AI assistant, Claude, was not the point of vulnerability.

Instead, the AI agents targeted third-party administrative, human resources, and sales management software. Organizations widely use these external tools to record customer communications, manage employee databases, and track operational workflows.

Because many enterprises rely on identical third-party vendors, a security flaw in one software product can potentially affect multiple organizations that rely on the same platform.

Who Built the AI Agents?

The entity responsible for discovering the security gaps is Cathedral, a cybersecurity startup founded just months ago. Despite its recent launch, Cathedral secured $160 million in funding at a $1.4 billion valuation.

Cathedral was established by four former staff members of the Department of Government Efficiency, the cost-cutting initiative commonly referred to as DOGEDOGE-0.14% under the Donald Trump administration.

The testing was conducted under a bug bounty program. In these setups, companies invite external security professionals to identify system weaknesses so they can be fixed before malicious actors exploit them.

What Systems Were Exposed vs. What Stayed Safe

During the 12-hour evaluation, Cathedral's AI agents accessed specific internal administrative directories. According to a draft of Cathedral's report, the agents reached:

• Internal meeting transcripts
• Salary structure details and formal job-offer records
• Internal Slack messages containing discussions about advanced AI models
• Basic user account details and sales contact databases

Anthropic clarified that core proprietary assets remained completely uncompromised throughout the assessment. The following key items were not accessed:

• Customer conversations with Claude
• Generated Claude responses
• Proprietary source code
• Model weights (the core parameters that define how the trained AI functions)

Anthropic stated that there is no evidence indicating any unauthorized external parties exploited these vulnerabilities outside of Cathedral's controlled test.

Disagreements Over Testing Rules and Scope

Although both organizations agree that access occurred, they hold differing views on how the testing was reported and interpreted.

Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day.

Anthropic asserted that Cathedral overstated the national security risks of the findings. The company also stated Cathedral did not follow bug bounty protocol fully because it failed to disclose all testing activities in real time.

Cathedral maintained that its team strictly followed standard ethical research practices. In its draft report, the startup stated that data accesses were kept to the absolute minimum required to prove system vulnerabilities.

Broader Industry Concerns and Past Incidents

The rapid speed at which AI agents executed the penetration test has caught the attention of federal officials. A senior official from the Trump administration, speaking anonymously, stated that the report has circulated within government channels.

The official noted that if a newly established private firm can breach corporate environments this quickly using AI tools, state-sponsored foreign adversaries could potentially utilize similar capabilities.

This event adds to an ongoing conversation regarding AI safety and security:

• In November 2025, Anthropic reported that Chinese state-sponsored hackers used its Claude Code tool to target approximately 30 organizations, with AI carrying out 80% to 90% of the initial tactical labor.
• In July, Anthropic revealed that its Claude models successfully compromised target organizations during internal security testing.

Vendor Responses and Security Mitigations

Following the discovery, Anthropic temporarily disabled the affected third-party programs. The systems remained offline until the third-party software providers deployed verified security patches. The specific names of the software vendors involved have not been disclosed.

The incident serves as a key reminder for technology companies and digital asset infrastructure providers alike: enterprise security relies on every connected system, including external administrative tools.