An Anthropic security test has raised questions about how third-party business software can provide routes into sensitive corporate systems. Cathedral, a cybersecurity start-up founded by former United States Department of Government Efficiency staff, claims its researchers found such routes within roughly 12 hours.
The activity was reportedly an authorised security assessment, not a malicious attack. Anthropic also disputes the breadth of Cathedral’s account, saying access was limited and did not expose customer prompts, Claude outputs, model code or model weights.
What happened during the Anthropic security test?
The claim became public on 26 October 2026, when The Washington Post reported that Cathedral had examined software connected to Anthropic’s business environment. The newspaper reviewed a draft Cathedral report, but that document and its supporting technical evidence have not been released publicly.
According to the account, Cathedral used AI-driven techniques to identify and chain weaknesses in third-party administrative or business software used by Anthropic. Within roughly 12 hours, its researchers reportedly identified routes into internal systems.
Cathedral described potential access to information including meeting transcripts, salary and job offer information, and Slack discussions concerning advanced AI models. However, Anthropic gave press outlets a narrower characterisation of the Anthropic security test, saying the reachable information was confined to a limited set of sales, human resources and IT systems.
This distinction is important. There is no public evidence that Cathedral compromised Anthropic’s core AI infrastructure, stole model intellectual property or reached customer conversations. The dispute concerns how broadly the researchers could move through business systems and how sensitive the accessible information was.
An authorised assessment, not a criminal intrusion
Although some headlines describe Cathedral as having hacked Anthropic, the reported activity took place through an Anthropic programme that invited external security researchers to look for weaknesses. There is no indication that a criminal group exploited the same routes or that Cathedral acted outside the authorised testing process.
No malicious exploitation has been reported as of 26 October 2026. Cathedral’s researchers are the only identified actors, and no separate threat group has been linked to the weaknesses.
How Cathedral reportedly reached Anthropic systems
The reported path did not begin with Claude’s underlying models. Instead, Cathedral examined third-party administrative software and integrations connected to Anthropic’s internal business environment.
The researchers reportedly combined multiple weaknesses rather than relying on one publicly identified vulnerability. This kind of attack chain can involve excessive permissions, weak trust relationships, configuration problems or inadequate separation between connected services. However, none of those possible causes has been confirmed for this Anthropic security test.
The exact technical steps remain undisclosed. Cathedral has not published exploit code, a proof of concept or a detailed report explaining the flaws, authentication methods or privilege boundaries involved.
Public reporting also does not name the third-party vendors, products or affected versions. It is therefore not currently possible for other organisations to determine whether they use the same software or configurations based on product names alone.
What is known about the reported route can be summarised as follows:
- Cathedral examined third-party business or administrative software connected to Anthropic.
- Its researchers reportedly chained weaknesses across those services.
- The resulting routes led towards internal sales, HR and IT environments.
- Cathedral claimed access to several categories of internal corporate information.
- Anthropic disputed the breadth of that access and excluded its core model assets and customer content.
No indicators of compromise have been published. There are no disclosed IP addresses, domains, file hashes, user agents, account names or system paths that security teams can use to search for comparable activity.
Anthropic’s response and the disputed scope
Anthropic reportedly closed the exposed pathways after Cathedral disclosed its findings. The company also disabled affected software integrations while waiting for the relevant third-party vendors to provide fixes.
Its response suggests that the reported routes were considered significant enough to require immediate containment, even though Anthropic rejects the broadest interpretation of Cathedral’s claims. Disabling integrations can prevent further access while preserving time for investigation and remediation.
Anthropic said the following assets were not accessible during the Anthropic security test:
- Customer prompts submitted to Claude.
- Outputs generated by Claude.
- Anthropic’s model source code.
- The model weights that define how its AI systems operate.
Anthropic instead characterised the exposure as limited to some sales, human resources and IT data. Those systems can still contain commercially or personally sensitive records, but they are distinct from customer AI interactions and the technology used to build and operate Claude.
As of 26 October 2026, Anthropic has not published a stand-alone technical blog about the Cathedral assessment. Cathedral has likewise not released its draft report, leaving important questions about the affected integrations, permissions and remediation unanswered.
Anthropic security test timeline and verification
The first identifiable public account appeared on 26 October 2026. The Washington Post published Cathedral’s claims alongside Anthropic’s narrower explanation, and other outlets repeated the report on the same day.
Those later reports do not provide independent technical confirmation. They rely substantially on the original account, the draft report reviewed by the newspaper and comments attributed to an Anthropic spokesperson.
The available timeline is therefore limited:
- Cathedral conducted an authorised assessment through Anthropic’s external researcher programme.
- Researchers reportedly identified routes into business systems within roughly 12 hours.
- Cathedral informed Anthropic of its findings.
- Anthropic closed pathways and disabled affected integrations pending vendor fixes.
- The claims and Anthropic’s response became public on 26 October 2026.
The dates on which testing began, disclosure occurred and containment was completed have not been made public. Any claim about those milestones would currently go beyond the available evidence.
Why the Anthropic security test matters
The event highlights a distinction that can be lost when an AI company is involved. The reported weaknesses concerned ordinary business applications and their connections, not a direct compromise of an AI model.
For UK organisations, the relevant risk is that trusted SaaS integrations can create indirect routes between sales, HR, IT and AI-related environments. A compromise of one connected service may expose data elsewhere if permissions are broad or trust relationships are poorly segmented.
What organisations should do now
There is no named product to patch and no published indicator to block. Organisations should avoid assuming that they are affected solely because they use Anthropic or Claude.
Teams using Anthropic services should instead review the specific integrations surrounding their AI deployments:
- Inventory connections between AI services and HR, sales, messaging or IT platforms.
- Check whether integration accounts can read more data than their operational purpose requires.
- Rotate API keys or credentials if logs show unexplained access, unusual token use or unexpected configuration changes.
- Confirm that customer prompts and sensitive internal data are not retained unnecessarily in connected systems.
- Monitor Anthropic, Cathedral and relevant software vendors for named products, versions or formal remediation guidance.
Until technical evidence is released, the Cathedral claim should be treated as credible reporting about an authorised test, but not as proof of a broad Anthropic compromise. The confirmed lesson is narrower: third-party integrations reportedly created pathways into internal business systems, and Anthropic disabled those pathways after notification.
Originally reported by Gizmodo.
