The humans failed first. Cathedral’s researchers spent several days trying to break into Anthropic’s own software and got nowhere, according to Anthropic’s side of the story as Gizmodo reported it. Then they switched to AI agents, and the agents found a way in before the 12-hour mark. The way in wasn’t Claude or anything Anthropic built itself. It was a business tool Anthropic buys from another company.
The story broke on Monday, October 26, when the Washington Post wrote about a draft report from the startup. I’m working from TechRadar, Gizmodo and a few other write-ups of it, not from the Post piece, and I haven’t seen Cathedral’s report myself. Keep that in mind for everything below.
Who Cathedral is, and why the framing is backwards
The question I started with was how a company that promises to fix AI and cybersecurity problems ended up getting hacked. That has the roles flipped.
Cathedral is the cybersecurity company here. TechRadar describes it as an AI startup doing offensive and defensive cyber work for the US military and government, founded this year by former DOGE staff. It names four founders: Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. Anthropic makes AI models, and it was the one being tested. And it wasn’t a surprise test, because Anthropic runs a bug bounty program through HackerOne where outside researchers can report flaws for a reward. Cathedral sent its results through that program, so on paper it was allowed to try.
What they reached, and who says so
There are two versions, and they don’t match.
Cathedral’s draft report, as the Post described it, says its agents found routes to meeting transcripts, salary data, job offers and Slack messages about Anthropic’s advanced models. Read that carefully. “Found routes to” is not the same as “downloaded everything,” and Cathedral says its researchers kept their data access to a minimum.
Anthropic’s version is narrower. It confirmed that Cathedral got into a limited set of sales, HR and IT systems, and touched contact details and basic account records for some customers and partners. Claude conversations, source code and model weights were not accessed. Anthropic also says its monitoring caught some of the activity before Cathedral reported it, and that it cut off access the same day.
So where does the salary part land? The reports I read say “salary information” and “job offers” and never say whose, or how many people. A few headlines mention “employee details,” but the body text never gets more specific than that. Nobody has published a list of employee names that I could find. If you see a post claiming a big pile of names leaked, I’d wait for a source before believing it.
How it happened, as far as anyone knows
The short answer is third-party enterprise software. According to the Ukrainian outlet Mezha, the agents first found a vulnerability in a third-party business tool, and that opened the path to Slack messages, meeting transcripts, salary information and job offers. That’s the whole technical story in public right now. Which tool? Nobody has said. I checked six or seven write-ups looking for the vendor name and came up empty, which was annoying, because that’s the one fact that would make this article useful to anyone running the same software. So if you read somewhere that “they exploited such-and-such product’s bug,” that’s a guess. I’d skip it. What we can say is that the agents did the finding, and they did it fast, after humans had spent days failing on Anthropic’s direct front door. That contrast is what I keep coming back to. I’m oversimplifying a bit, though, since the 12 hours only counts the agent stage and not the days of human work before it, so the whole job wasn’t done in half a day.
Why the vendor and not Anthropic’s own systems? Jacob Krell, a senior director at Suzu Labs, told TechRadar that Cathedral got in the same way attackers get into everyone, “through the vendors.” His point was that your security can only be as good as the weakest company you plug into. That sounds obvious until you picture how many tools sit behind one HR department.
Putting the order together from the reports: a few days of human attempts failed, then agents found the vendor weakness in under 12 hours. Anthropic’s monitoring flagged some of the activity, Cathedral reported through the bounty, and Anthropic shut off access the same day. The Post story ran October 26. I don’t have exact timestamps for any step, and the articles don’t either, so the order is clear but the gaps between steps aren’t.
And here’s a detail that reads strangely now. A news roundup noted that an Anthropic employee, Jacob Coxon, publicly resigned last month, saying the company was being careless with dangerous AI, including by relying on ordinary business software. Whether that has anything to do with this breach, nobody has shown. I’m only mentioning it because the timing is odd.
Why the 12 hours bothers me more than the vendor
Vendor risk is old news. Every security person has been saying it for years, and plenty of breaches before this one started with a supplier. The speed is what’s new.
Think about what the days of human effort looked like. A team of trained researchers pushed on Anthropic’s own software, a company with a serious security budget and a monitoring setup that, by its own account, noticed Cathedral’s activity. They got nothing. Then they pointed agents at the whole mess of connected tools around the company, and the agents found a crack by the next morning, more or less. A person can only read so many settings pages, and an agent doesn’t get bored of them.
Gizmodo made a related point: for months the big AI-driven hacking stories have had Anthropic’s tools on the attacker’s side, helping someone break in somewhere else, and this time Anthropic was the target. TechRadar’s related links include a story about Claude breaking into three companies during tests, and another about Google’s Gemini doing something similar in a capture-the-flag exercise. I only read those headlines, so I won’t say more than that they exist.
Here’s what I think follows, and you can disagree. Defenders usually fix things on a schedule of weeks. An agent searching for a weak vendor integration works on a schedule of hours. Those two clocks don’t match, and no single company’s good intentions will fix that gap.
The fight over the rules
Right after the news, the two sides started arguing about the bounty itself.
Anthropic says Cathedral broke the program’s rules by not fully disclosing what it did inside the systems. Anthropic also thinks Cathedral exaggerated the national security side of this, and it has told federal officials about the incident. Cathedral’s own report calls it a wake-up call for every company in America, because ordinary business software can expose even the most advanced organizations. Whether the bounty gets paid, I don’t know. TechRadar says it sounds like it won’t, but that’s their read.
Politics got dragged in fast. A senior Trump administration official was reported as saying that if a group of people who just started a company can do this, the Chinese may not be far behind. One outlet also says the news landed on the same day Anthropic filed to go public. I can’t confirm the timing from what I’ve read, so treat it as reported, not proven.
Anthropic’s complaint about disclosure is fair, because bounty programs only work if researchers report everything they touched, and Cathedral’s own draft apparently doesn’t. But that complaint doesn’t change the main fact. A vendor’s software was the weak spot, and a small startup with agents found it in under a day. The national security talk feels bigger than what has been confirmed so far.
Side note, because it’s the same month and I find it odd. In the summer, white-hat hackers from Hacktron AI broke into OpenAI using Claude in under 72 hours, per TechRadar, and this month the FBI reportedly arrested an OpenAI employee for allegedly planting a recording device in an executive conference room. None of it is connected. October has just been a strange month for AI security.
What a small company can actually do with this
Forget Anthropic for a minute. Most of us don’t run a security team, we run Slack, a payroll tool, a CRM and a Google Workspace account, and each of them has connected apps nobody remembers approving.
Darin Fredde at Ridge Security made a point I liked: the real test after an incident isn’t that a patch went out, it’s that someone independent checks the attack paths are actually closed. Same idea works at small scale. Open your Slack admin page and look at the installed apps list. For each one, ask what it can read. Do the same in the Google Workspace admin console under the third-party app access settings. It will only take an hour, maybe less, and I’d bet at least one app on that list is something you stopped using a year ago.
Anthropic still hasn’t named the vendor. I’ll be watching for that, because until it does, every company using the same tool is guessing too.