AI agents accessed Anthropic's salary records and Slack messages in under 12 hours, report claims

Anthropic, the company behind Claude, has reportedly discovered weaknesses in its internal business systems after a cybersecurity startup used autonomous AI agents to find ways into administrative software in less than 12 hours. The incident highlights how companies developing advanced AI models can remain vulnerable through the everyday tools they use to run their businesses.

According to a report by The Washington Post published on Monday, the researchers accessed a limited range of information through third-party sales, human resources and IT platforms rather than by attacking Claude itself. The software involved is reportedly used by other businesses as well, raising questions about whether similar weaknesses could affect organisations beyond Anthropic.

The findings emerged from a security-testing programme intended to help companies identify and fix vulnerabilities before malicious actors exploit them. However, Anthropic has disputed aspects of the researchers' conduct and their assessment of the incident.

AI agents accessed internal business information

The testing was conducted by Cathedral, a cybersecurity startup established by four former employees of the Department of Government Efficiency (DOGE), the cost-cutting initiative associated with US President Donald Trump's administration. The company raised $160 million at a reported valuation of $1.4 billion in July.

Cathedral participated in a bug bounty-style programme, under which security researchers investigate potential weaknesses and report their findings to the organisation concerned. Its AI agents, which can execute sequences of actions without requiring human approval at every stage, reportedly identified routes to internal meeting transcripts, salary and job-offer information, and Slack discussions concerning Anthropic's advanced models.

Anthropic said it had detected some of Cathedral's activity before receiving the researchers' report. “Our monitoring flagged some of Cathedral's activity before they reported it to us,” the company told The Washington Post, adding that it had withdrawn the startup's access on the same day.

The company said the exposed systems contained a limited amount of business information, including contact details and basic account records. It stressed that the incident did not extend to conversations between customers and Claude, source code or model weights — the numerical parameters that underpin a trained AI model.

Anthropic also said it had found no evidence that anyone other than Cathedral had exploited the vulnerabilities. The software affected was disabled while the relevant vendors worked to confirm that fixes were available. Anthropic has not publicly identified those vendors in the information provided.

The two sides differ over how the testing was conducted. Anthropic accused Cathedral of exaggerating the national security implications and failing to disclose all its activities in accordance with the programme's rules. Cathedral, in a draft report cited by the newspaper, maintained that it had restricted access to data as much as possible, following security research practices.

Anthropic incident raises wider AI security questions

The reported breach has drawn attention beyond the technology industry. A senior Trump administration official, speaking anonymously to The Washington Post, said the findings had circulated within government and prompted concerns about national security.

“If a bunch of kids who have just started a company can do this,” the official said, “then potentially, the Chinese aren't far behind.”

The concern reflects the possibility that autonomous AI systems could help attackers identify weaknesses and move through connected software with limited human intervention. Unlike conventional security tools that flag suspicious activity for investigators, AI agents can potentially carry out several stages of a task themselves, although their capabilities and reliability vary.

Anthropic has previously disclosed incidents involving AI-assisted cyber operations. In November 2025, the company said Chinese state-sponsored hackers had used Claude Code, its coding tool, in attacks targeting around 30 organisations. Anthropic estimated that AI handled between 80 per cent and 90 per cent of the tactical work in that campaign.

In July, the company also reported that Claude models had hacked real organisations in three separate incidents during its own testing. Those disclosures underscored the dual-use nature of AI. First, systems designed to assist with legitimate coding and second, security work can also be used to support harmful activity.

Although Anthropic says it has restricted access and addressed the affected systems while fixes are confirmed, the full extent of the vulnerabilities and their potential exposure elsewhere remains unclear.