Key Notes
- Cathedral says AI agents helped its researchers reach Anthropic’s internal correspondence, meeting records and employee compensation information in less than 12 hours.
- Anthropic acknowledged limited internal-data access but said Claude conversations, source code and model weights were unaffected.
- The work took place through a bug-bounty program, although Anthropic disputed the researchers’ compliance and the national-security implications of their findings.
Cathedral, a cybersecurity startup founded by former members of the U.S. Department of Government Efficiency, says AI agents helped its researchers gain access to internal Anthropic systems in less than 12 hours. The reported findings put a concrete question behind the debate over AI-powered hacking: how well can an AI developer protect the sensitive business information surrounding its research?
The testing took place through Anthropic’s bug-bounty program, according to the Washington Post, which reported the incident on October 26. Anthropic acknowledged limited access to internal data while saying its source code, model weights and users’ conversations with Claude were unaffected.
What Cathedral Says Its Researchers Accessed
The researchers reportedly reached internal correspondence, meeting records, employee compensation information and discussions involving advanced AI models. Those are sensitive categories even when the underlying models remain protected: workplace conversations and personnel records can contain information that employees and a company reasonably expect to stay private.
The under-12-hour figure describes Cathedral’s account of work involving AI agents. It should not be read as evidence that an unattended chatbot independently selected Anthropic, broke into it and stole its models. Researchers were directing a security investigation, and the reported access occurred in that setting.
Anthropic also told the Post that Cathedral failed to disclose all its activity and overstated the findings’ national-security implications. That disagreement matters when describing the exercise as authorized research: participation in a bounty program does not settle whether every action complied with its rules.
A Bug Bounty Comes With Boundaries
Anthropic’s published disclosure policy encourages good-faith researchers to report technical vulnerabilities. Its guidelines ask researchers to limit exploitation to what is needed to demonstrate a problem, avoid accessing communications and other data, and report inadvertent access. They also prohibit retaining collected data and call for coordinated public disclosure.
The public policy distinguishes systems Anthropic controls from those operated by third parties, including contractors and service providers. It is useful background for understanding the limits of permission, but it does not establish the specific terms governing Cathedral’s testing. Without that agreement and a complete account of the research, readers cannot independently resolve the compliance dispute.
There is a practical reason for those restrictions. A researcher can demonstrate a weakness without needing to explore every accessible record. The challenge becomes sharper when agents can perform many investigative steps quickly: researchers still need to decide where the test ends and unnecessary access begins.
Why the Findings Reached Washington
The report also describes concern inside the White House. An administration official questioned what a foreign adversary might accomplish if a newly formed startup could obtain this kind of access so quickly. That is a warning about potential exposure, rather than evidence that a foreign government carried out this incident.
Protecting an AI laboratory requires more than safeguarding the files that define a model. Internal discussions, staff information and research planning can have value in their own right. At the same time, distinguishing those records from model weights and customer conversations is essential to describing the scale of a security incident accurately.
Anthropic’s transparency disclosures describe separate reporting routes for security vulnerabilities, model-safety problems and other concerns, including HackerOne bounty programs. Those channels give outsiders a way to surface weaknesses, but their existence alone cannot demonstrate that the surrounding systems are secure.
Another Test of AI Security Claims
The incident adds a different dimension to our coverage of Anthropic’s independent evaluators and its OSS Scanner. Assessing how a model behaves, using AI to find software flaws and securing the company operating those tools are related responsibilities, each requiring its own evidence.
For now, the central finding is serious but bounded: researchers say AI agents helped them reach sensitive internal information unusually quickly, while Anthropic says the systems behind Claude and its users’ conversations remained protected. The speed deserves scrutiny, alongside a clear account of exactly what was accessed and what stayed out of reach.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
