AI Agents Access Sensitive Anthropic Systems in Security Test

AI-powered cybersecurity agents used by Cathedral, a security startup, accessed sensitive internal systems at Anthropic, the company behind Claude, during security testing that exposed weaknesses in third-party business software.

The incident, reported on October 26, 2026, involved access to internal business information, including meeting transcripts, salary and job-offer details, Slack discussions about advanced AI models, and limited customer and employee records, according to reporting by The Washington Post.

The activity took place as part of Anthropic's cybersecurity testing program, but the company said Cathedral did not fully comply with its disclosure rules.

Anthropic disabled the affected software, notified federal officials and said it had found no evidence that other parties had exploited the same weaknesses.

Anthropic also drew a distinction between the business information that was accessed and its most sensitive AI assets.

According to the reporting, the researchers did not access customer conversations with Claude, the company's model code or its model weights.

The incident raises questions about how businesses secure the software they use every day, how much access external security researchers should receive, and whether increasingly capable AI agents can discover and exploit weaknesses faster than organizations can contain them.

What the Researchers Accessed

The reported exposure involved internal business systems rather than a confirmed compromise of Anthropic's underlying AI models.

Information reportedly reached during the testing included:

• Internal meeting transcripts.

• Employee salary information and job-offer details.

• Slack discussions concerning advanced AI models.

• Limited customer and employee records.

The distinction matters because corporate systems often contain sensitive information even when they are not part of a company's core technology infrastructure.

Collaboration platforms, human resources applications, meeting tools and other business services can collectively reveal organizational plans, employee information and internal operations.

The available reporting does not establish that every accessible record was downloaded, retained or subsequently misused.

Access to a system and confirmed large-scale data theft are different outcomes, and the incident should not be described as proof that all Anthropic customer data was compromised.

How AI Agents Reached the Systems

The researchers reportedly used AI agents for less than 12 hours to exploit weaknesses in third-party business software and gain access to internal information.

AI agents differ from conventional chatbots because they can perform sequences of actions toward a goal.

Depending on their tools and permissions, they can inspect systems, investigate possible weaknesses, interact with applications and continue through multiple steps without requiring a person to direct every individual action.

That ability can be useful in authorized penetration testing, where security professionals examine systems for weaknesses before criminals discover them.

It can also increase risk when an agent has broad access, unclear boundaries or tools that allow it to act on real systems.

In this case, the reported access was associated with weaknesses in third-party business software.

The available information does not establish that Anthropic's Claude models themselves were responsible for the activity.

The AI agents used by Cathedral should not be conflated with Anthropic's own models or with the separate incidents involving Claude during cybersecurity evaluations.

The distinction is important: an AI system used to test a company's defenses is not necessarily the same system as the AI model whose developer is being tested.

Why the Incident Matters Beyond Anthropic

The reported incident illustrates a security problem that extends across the technology industry: companies can protect their own applications while remaining exposed through the external software they depend on.

Third-party applications often connect to internal communication platforms, employee databases, customer relationship management systems and cloud services.

Depending on their permissions and configuration, a weakness in one application can create a path toward information held elsewhere.

This is particularly important for companies developing advanced AI systems.

Internal discussions, employee information, business relationships and technical plans can all be sensitive, even if the underlying model infrastructure remains secure.

The incident does not establish that Anthropic's AI models were compromised.

Instead, it highlights the risks associated with the broader corporate environment surrounding an AI developer.

The speed reported by Cathedral is also significant, although it requires careful interpretation.

Finding a route to sensitive information in less than 12 hours demonstrates the potential efficiency of AI-assisted security testing.

It does not, by itself, establish that every organization faces the same exposure or that an equivalent attack would succeed against other companies.

Anthropic and Cathedral Disagree About the Scope

The two organizations have presented different accounts of the incident's significance.

Cathedral's draft report, reviewed by The Washington Post, described access to meeting transcripts, employee compensation and job-offer details, and internal Slack discussions about advanced AI models.

The draft characterized the findings as evidence of a serious gap between emerging offensive capabilities and existing defenses.

Anthropic described the access more narrowly.

The company said the researchers reached a limited set of sales, human resources and IT systems containing business contact information for some customers and partners, along with basic user account records.

Anthropic also said its monitoring detected some of Cathedral's activity before the researchers reported it and that the company shut off their access on the same day.

The affected software was disabled pending fixes from the vendors.

The company said it had no evidence that anyone else had exploited the vulnerabilities.

It also criticized Cathedral for not fully disclosing its activity under the security testing program's rules.

These distinctions matter because the public account relies substantially on Cathedral's draft report and Anthropic's response.

The full technical evidence has not been publicly established in the reporting available at publication time.

There is also no confirmed evidence in the available reporting that the information was subsequently used for fraud, espionage or another malicious purpose.

What This Reveals About AI Cybersecurity Testing

Authorized security testing allows companies to discover weaknesses before malicious actors exploit them.

AI agents can make this process faster by automating parts of reconnaissance, investigation and vulnerability discovery.

However, automation does not remove the need for clear authorization and strict boundaries.

An agent may be able to perform a sequence of actions much faster than a human reviewer can evaluate every step.

If the permitted scope is unclear, or if connected systems expose more information than intended, the consequences can extend beyond the original test target.

Three controls are particularly important.

First, organizations need to limit access. Security researchers and automated agents should receive only the permissions necessary for the approved assessment.

Access to employee records, customer information and internal communications should not be assumed to be necessary merely because those systems are connected.

Second, companies need to monitor activity across connected systems. Security teams should be able to identify unusual access patterns, detect unexpected data retrieval and revoke permissions quickly.

Monitoring is most useful when it covers third-party applications and the systems those applications can reach.

Third, testing programs need explicit rules. Organizations should define which systems may be tested, what information may be accessed, whether data can be downloaded, and how researchers must report discoveries.

These boundaries become especially important when AI agents can carry out many actions in rapid succession.

The incident also reinforces the need to review software vendors as part of enterprise security.

A company can have strong internal security policies and still inherit risks from an application with excessive permissions or inadequate controls.

What Businesses Should Do Now

Organizations do not need to wait for a similar incident before reviewing their exposure.

Security teams should begin by inventorying third-party applications that can access internal communications, HR records, customer information and cloud infrastructure.

The goal is to understand which applications have access to sensitive information and whether those permissions are necessary.

They should then review application permissions, authentication arrangements, service accounts and access tokens.

Unnecessary privileges should be removed, and sensitive systems should be separated so that access to one application does not automatically provide a route to unrelated information.

Companies using AI agents for security testing should also establish explicit limits on the systems agents may access.

Where possible, tests should use isolated environments and synthetic data rather than live employee or customer records.

If production access is necessary, organizations should define strict scope, logging, data-handling and emergency shutdown procedures before testing begins.

Finally, businesses should confirm that their incident-response procedures cover activity originating from authorized testing.

Security teams need to distinguish legitimate research from activity that exceeds the approved scope, while retaining the ability to stop access immediately if necessary.

These measures do not eliminate every vulnerability, but they can reduce the likelihood that a weakness in one business application becomes a wider corporate exposure.

What Happens Next?

The immediate response described in the reporting includes Anthropic disabling the affected software, notifying federal officials and addressing the vulnerabilities with the relevant vendors.

Important details remain unresolved in the publicly available account.

These include the complete technical path used by the researchers, the precise scope of accessible information, whether sensitive records were copied or retained, and the full extent of the disagreement over the security program's disclosure rules.

Further technical disclosures from Anthropic, Cathedral or the software vendors could help establish those details.

For now, the incident is best understood as a reported security-testing case involving access to internal business systems, not as a confirmed compromise of Claude's model weights or customer conversations.

Its broader lesson is that the security of an AI company depends on more than the safeguards built into its models.

The applications, accounts, permissions and operational systems surrounding those models can also create significant exposure.