Researchers say AI tools got into Anthropic's business systems

A security group called Cathedral says its AI agents found ways into Anthropic's business systems in under 12 hours. Anthropic, the company behind the Claude chatbot, confirms some limited access. It says the researchers did not reach Claude conversations, source code or model weights. The 12-hour timing is Cathedral's own claim and has not been independently measured.

What was reported

Cathedral used AI agents, which are programs that carry out tasks through connected tools, to probe outside software Anthropic used for administrative and sales work. It reportedly described routes to meeting transcripts, pay and hiring information, and Slack messages about advanced models. The work happened through Anthropic's external security-testing program, so the researchers should not automatically be called criminals.

What Anthropic says

Anthropic reportedly acknowledged access to parts of its sales, human resources and IT systems. It said the exposed information was mostly business contacts and basic account records. It said customer messages, model responses, source code and model weights were not accessed. Model weights are the numerical settings that make up an AI model.

The Washington Post's original investigation appeared October 26 and names the departing researcher as Jacob Coxon. That date is when the story was published, not when the access happened.

What is not known

• Whether data was only viewed, or also downloaded and kept. Those are different actions.
• Which outside apps were involved and how their software allowed the access.
• Whether Anthropic set up those connections correctly. Public reporting cannot answer that.
• Whether any enterprise customer's information crossed the reported boundary.

A reaction attributed to Hugging Face CEO Clément Delangue says the episode challenges confidence in AI built behind closed doors. His post could not be independently authenticated, so it is not treated here as his confirmed view.

What to do

The reported entry point was connected business software, not the AI model itself. That matters for any company that links outside apps to its workspace. A meeting tool may need some transcripts to work, but it may be able to reach far more. Review what each connected app can see, and remove access it does not need.