AI Agents Breached Anthropic in 12 Hours via Third-Party Tools

How autonomous agents breached Anthropic in under 12 hours

Human security researchers spent days attempting to break into Anthropic's systems without success. The breakthrough came when defense-focused startup Cathedral deployed autonomous AI agents. Within 12 hours, the automated tools pinpointed an unpatched flaw in commercial enterprise software integrated into Anthropic's corporate environment.

Once past the perimeter, the agents moved through internal systems. They pulled internal Slack messages, meeting transcripts, and sensitive human resources records covering employee compensation and job offers. Cathedral subsequently reported the findings via Anthropic's public HackerOne bug bounty program, presenting the raid as an ethical demonstration of agentic vulnerability testing.

The incident reflects growing concern across the industry over machine-speed intrusions, echoing scenarios where a rogue AI agent recruits vulnerable systems into botnets. Cathedral operates as an offensive and defensive security venture founded by former Pentagon and SpaceX specialists, arguing that if autonomous tools can dismantle an AI leader's perimeter in half a day, enterprise supply chains are dangerously exposed.

What data leaked and Anthropic's bug bounty pushback

Anthropic confirmed the breach occurred but pushed back against the startup's conduct. According to the company, the intrusion was restricted to a limited set of sales, human resources, and IT tools. Core assets remained untouched: source code and model weights were never accessed, nor were direct user conversations with Claude.

Anthropic stated that internal security telemetry flagged Cathedral's suspicious behavior before the researchers filed their HackerOne report, allowing engineers to sever access within hours. However, Anthropic has accused Cathedral of violating standard bug bounty terms by failing to disclose the full scope of their data harvesting immediately.

The friction leaves Cathedral's bounty payout in doubt. More critically, the intrusion arrives at an awkward moment for Anthropic as it preps for an upcoming public listing, reminding investors that even the best AI security teams remain vulnerable to standard corporate supply-chain blunders.

What it means for enterprise users

For organizations using Claude via Anthropic's API or enterprise tier, Anthropic confirmed that customer prompt histories, fine-tuning data, and foundational model weights were not exposed. The compromised records were confined to basic account metadata and contact information within sales and partner portals.

Organizations operating across the US, UK, and Europe do not need to rotate API keys or reconfigure deployments. However, security administrators should treat the incident as a reminder to audit third-party SaaS integrations, which frequently grant broad corporate access regardless of an organization's core defensive posture.