Anthropic Targeted Through Third-Party Apps, Controversial Reach

Cathedral claims to have accessed internal content such as Slack messages in less than twelve hours using AI agents. Anthropic confirms limited access to sales, HR, and IT systems but denies any exposure of code or model weights, describing the incident as a multi-day attack. Both parties are also disputing compliance with disclosure rules.

Scope of Access and Timeline: Two Irreconcilable Versions

Cathedral asserts that the incident lasted less than twelve hours, while Anthropic mentions several days. The actual amount of accessible data remains debated. Anthropic states that the access was limited to a restricted scope, including sales, human resources, and IT systems, with contact information and basic user account data, and clarifies that neither discussions with Claude, nor the source code, nor model weights were exposed. In contrast, Will Depue, a former OpenAI employee, claims, based on sources he considers reliable, that complete admin access to Slack would have allowed reading all messages and logging into any user account. Logan Graham from Anthropic's red team disputes these claims and, while citing the sensitivity of the issue to avoid providing details, believes the industry must now rethink its security annually.

Intrusion Vector: Third-Party Services and Contested Reporting

Cathedral researchers report having accessed external administrative and sales programs. According to Logan Graham, this pivot to third-party software occurred after several days of initial exploration. Anthropic claims that two vulnerabilities were discovered in this environment, but only one was reported by Cathedral; the second was identified and fixed internally. The company also accuses Cathedral of incomplete disclosure, contrary to the rules of its bug bounty program. Logan Graham considers that targeting third-party vendors and extracting data exceeded the intended protections, while acknowledging the value of the discoveries. Cathedral, on its part, asserts that it adhered to standard practices in security research. Anthropic states it closed the affected access points on the day of discovery, disabled third-party integrations until the issue was resolved, and informed U.S. federal authorities.

AI Agents: Mining Speed and Sufficient Capabilities

Cathedral reports having used AI agents as part of Anthropic's bug bounty program, which allegedly found paths to internal documents in less than twelve hours. Logan Graham warns that attackers are already running AI agents continuously to target external dependencies. He believes that models half a generation or one generation behind the state of the art are sufficient for this type of attack and predicts that adversaries will have more powerful systems in the future. His response involves conducting continuous internal penetration tests and rebuilding software with formal verification, which he now considers economically viable thanks to AI, and he recommends constantly testing against "very creative" models. The manner in which Cathedral achieved such a level of access despite Anthropic's measures is not detailed.

An Exposed Ecosystem via SaaS Integrations

Alex Stamos, head of security at Cognition, considers the findings significant. He emphasizes that integrated third-party applications represent a major problem in the industry and believes that Anthropic could have better secured its external services.

Cathedral Profile and Declarative Elements

Cathedral indicates it has formalized its findings in a preliminary report. The company, founded by former employees of the U.S. agency DOGE, markets AI-assisted security tools for public and private clients. It claims that its agents quickly located internal elements such as Slack messages and payroll data. Will Depue further asserts that research secrets and administrative API keys would be stored in a dispersed manner in Slack within labs like Anthropic and OpenAI. Jacob Coxon, who left Anthropic in September 2026, had previously criticized the use of desktop tools like Slack for research deemed risky.