Cathedral AI agents breached Anthropic systems via third-party software, exploiting bug bounty program

Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the lab's own bug bounty program. Researchers accessed meeting transcripts, salary data, job postings, and Slack messages within twelve hours. Anthropic confirmed limited access to sales, HR, and IT systems, including customer contact information, but said chats, source code, and model weights were never exposed. The incident highlights growing industry concerns about AI security and the risks of relying on third-party software.