Cathedral says its AI agents reached Anthropic business systems in under 12 hours; Anthropic disputes it

Two lists that do not match, in a dispute where neither side's document is public

Cathedral, a security startup founded by former DOGE staffers, says in a draft report reviewed by the Washington Post that its AI agents found paths into Anthropic's internal systems in under 12 hours, with routes to meeting transcripts, salary and job offer details, and Slack discussions about advanced models (Gizmodo, Decrypt). Anthropic's own list, as quoted in the same coverage, is different: a "limited set" of sales, human resources and IT systems, holding business contact details for customers and partners and some basic user account records. Count the overlap in the wording as printed and it is zero (derived). One list names kinds of content, the other names systems and record types. So the two accounts are not shown to conflict, and they are not shown to agree.

What that does not establish is most of what matters. It does not establish that the 12 hours is the right figure, that any data left Anthropic's systems, which third party software was involved, whether any customer data beyond contact details was touched, or what the bug bounty rules actually say. Anthropic says Cathedral broke them by not disclosing all of its activity. Cathedral says it kept data access to the absolute minimum. Neither party has published a document that settles any of this.

This briefing is therefore an attribution map, not a finding. It was built from 15:36 GMT on Friday 30 October 2026. The lead is SecurityWeek's roundup of 30 October, which cites the Washington Post report of 26 October. That article is paywalled. One request for it timed out and nothing was done to get past the paywall, so it was not read. Cathedral's draft report is not public. No Anthropic statement page was read by this build. Every claim below reaches this site through an outlet, and the table says which. Some outlets also relay public posts on X by an Anthropic red team lead and by a former OpenAI employee. Those posts were not opened. They are used only as The Decoder relays them, and said so each time.

Who says what, and where it was read

Fourteen claims carry the story. None was read in a document its author published (derived from the table: 14 of 14 reach this site through an outlet). Gizmodo, Decrypt and The Independent quote Anthropic on the record as relayed from the Post. The Decoder adds the posts on X and a named expert's view. TechTimes and explainx repeat the core and add detail that no other outlet read carries, so those details are marked as single source below.

Claims in this dispute, who is reported as making each, and the outlets read that carry it (all read 30 October 2026; no primary document from either party was available)

Claim	Attributed to	Read in
Agents found paths in under 12 hours, through weaknesses in third party administrative and sales software	Cathedral's draft report, reviewed by the Post	Gizmodo, Decrypt, The Decoder, SecurityWeek
Routes to meeting transcripts, salary and job offer details, Slack messages about advanced models	Cathedral's draft report	Gizmodo, Decrypt, SecurityWeek
Data accesses kept to the absolute minimum under security research best practice	Cathedral's draft report, quoted	Decrypt
A limited set of sales, HR and IT systems: customer and partner business contacts, some basic user account records	Anthropic, to the Post	Gizmodo, Decrypt, The Decoder
No Claude conversations, source code or model weights reached	Anthropic	Gizmodo, Decrypt, The Decoder
Monitoring flagged some activity before Cathedral reported it; access shut off the same day	An Anthropic spokesperson, to the Post	Decrypt, Futurism
No evidence anyone other than Cathedral exploited the flaws	An Anthropic spokesperson	Decrypt, Futurism
The work involved attempts over several days; Cathedral first tried Anthropic's own software without success	An Anthropic spokesperson, to The Independent; Anthropic, to the Post	The Independent (via Yahoo), Gizmodo, Futurism
Two flaws found in the third party software, one reported; Anthropic found and fixed the second itself	An Anthropic red team lead, on X, as relayed	The Decoder only
Cathedral did not disclose all of its activity and broke the program's rules; it went substantially beyond the program by targeting third party applications	Anthropic and its spokesperson	Gizmodo, Decrypt, The Independent, SecurityWeek
Cathedral overstated the national security implications	Anthropic	Decrypt
The report circulated in government and raised national security concerns	A senior administration official, anonymous, to the Post	Decrypt, Futurism, Gizmodo
Cathedral had full administrator access to Slack and could read every message (unverified); Anthropic's red team lead says those sources were wrong	A former OpenAI employee, on X, as relayed; the red team lead's reply, as relayed	The Decoder only
The findings are significant and Anthropic could have secured its external services better	The chief security officer of an AI coding startup that uses Anthropic's models, to the Post	The Decoder

Zoom

The dates, and the dates nobody prints

Dated events in the coverage read, and what each date does and does not show

Date	Event, as reported	What it does not show
26 October 2026	The Washington Post publishes the report (Gizmodo timestamps it 11:00 ET; Decrypt says published Monday). The Independent says Anthropic filed IPO papers the same day.	When the testing happened.
27 October 2026	TechTimes and Mezha carry summaries. TechTimes says Anthropic had filed no legal complaint as of its report.	Anything after that date.
28 October 2026	The Decoder relays posts on X from an Anthropic red team lead and a former OpenAI employee. The Independent's version is syndicated.	That either post was opened or checked by this site.
30 October 2026	SecurityWeek's roundup, 10:41 ET, summarises the Post report.	Any new statement by either party.

From the Post's report to this build is 4 days (derived). In those four days the record read has not gained a document from either party. No source read prints a date for the testing itself, a bounty window, a report date to Anthropic or the date access was cut. The phrase "the same day" in Anthropic's statement is not tied in the coverage to a calendar day, or to whether the day is the one of detection or of Cathedral's report. A reader should treat every time claim in this dispute as unanchored.

What "under 12 hours" can and cannot measure

The figure is Cathedral's, from its own draft. Decrypt and others state it as the startup's claim, and explainx notes that nobody has measured it from outside. Anthropic says the work "involved attempts over several days" (The Independent via Yahoo), and Gizmodo and Futurism report Anthropic saying the researchers first spent days failing to break into its own software, then turned to business software it used.

These two statements can both be true. If the 12 hours began when the agents were pointed at the third party software, the days of earlier attempts are outside it. TechTimes reads the draft that way. That is one outlet's reading of a document it did not publish, and this site treats it as an inference at best. If the clock instead covers the whole effort, the figures conflict. No source read says which.

Three more things the number leaves open. The reports say AI agents did the work; how many human steps there were is not stated. "Found paths to" is the wording used for the transcripts, salaries and Slack channels, which is a statement about reachability, and whether content was read or copied is not stated by either side. And the Anthropic red team lead's account, as relayed by The Decoder, is that Cathedral found two flaws and reported one. If true, that is the core of the conduct complaint. It rests on one relayed post, and Cathedral's reply to it was not found.

What the figure does support is narrow and does not depend on the dispute: AI agents are credibly used to probe a company's business software at machine speed, and the weak point named by every account is the software around the model, not the model. That is the same pattern this site covered in a medical device maker whose data left through third party hosted business applications.

The bounty rules: every comforting label here is unaudited

The friendly name in this story is not one word but a set. "Bug bounty" implies a defined scope. "Authorised" implies the activity was permitted. "Safe harbour" implies protection for the tester. "Best practice" implies a limit on what was touched. "Limited set" implies a boundary on what was reached. None of these is a control until the text behind it is published, and for none of them is it.

What the coverage prints about the rules is thin. Anthropic says Cathedral did not follow all of them because it did not disclose all of its activity (Gizmodo, Decrypt, SecurityWeek). An Anthropic spokesperson told The Independent the work went "substantially beyond" the program by targeting third party applications (via Yahoo). The Decoder relays the red team lead as saying that targeting third party providers and pulling data went beyond the program's safe harbour, while welcoming the discovery of the flaws. Cathedral's stated position is the best practice line. That is a description of its own conduct, not a rule it cites. TechTimes says a Cathedral spokeswoman declined to comment on the dispute and that Cathedral sent its findings to the affected vendors as well. Both are single source.

The programme's rules text was not available in anything read, so which clause is alleged to be broken is not known. A general point, labelled as inference: a programme usually has authority only over assets its owner controls. A third party's software is another company's system, and a bounty from the customer does not by itself authorise testing against it. Whether that matters here depends on terms nobody has shown.

The reported path, and the boundary Anthropic says held

The sequence below is assembled from the accounts above, in the order the outlets give it. It is a reading of reports, not of logs. Cathedral's draft and Anthropic's statements agree on the broad shape: a test under the bounty program, business software as the way in, some sales, HR and IT systems reached. They differ on how long it took, what was in reach, and whether the conduct was permitted.

Zoom

Stated, not stated

What the coverage states and what it leaves out, by question (read 30 October 2026)

Question	Stated	Not stated
How fast	Cathedral: under 12 hours. Anthropic: attempts over several days.	When the clock started, human steps, any log.
What was reached	Anthropic: a limited set of sales, HR and IT systems, contact details, basic account records. Cathedral: paths to transcripts, salary data, Slack.	Which records, how many, whether read or copied.
Did data leave Anthropic	Neither side addresses it in the coverage read.	Any exfiltration, retention or deletion by Cathedral.
Customer data	Anthropic: business contact details of customers and partners were reached; no Claude conversations.	Whether any other customer data was touched.
Which software	Third party administrative and sales software, by description.	Vendor names, the flaws, whether fixed. Anthropic disabled the software until vendors confirmed fixes.
The rules	Anthropic: not all activity disclosed; third party targeting beyond the program. Cathedral: best practice followed.	The rules text, the clause, the bounty window, any payout.
Others exploiting it	Anthropic: no evidence of anyone else.	Anything from the vendors.
Legal or government action	TechTimes: no legal complaint filed as of its report. An anonymous official: concerns in government.	Any later action, or which agencies.

Technical details

Neither party has published a technical artifact. No CVE, vendor name, product, version, configuration, request, log line, payload, hash, domain or address appears in any source read, and Cathedral's draft is not public. No code block is printed here because none exists to copy, and inventing one would be fabrication. The vendors are unnamed, and The Decoder, Decrypt and TechTimes all say so.

What a defender can hunt, as this site's inference from the reported shape and not from any artifact: administrator accounts, API tokens and OAuth grants on the business software that holds HR, sales, meeting and chat data; which of those grants can read every channel, every record or every transcript; sign in and API activity from a tester or an unfamiliar automated client against those tools; and bursts of enumeration (many object listings, permission probes) that look like machine speed. These are places to look. They are not indicators from this incident.

What to do on the strength of it, in order

The question the dispute exposes

If an outside party's AI agent reached your sales, HR and IT systems through a vendor's admin tool tomorrow, which document would settle what it touched: your rules text, your logs, or their draft report? And could you publish it?

This page was last checked against its main sources at 15:46 GMT on 30 October 2026. Anything that could be overtaken, a Cathedral statement, an Anthropic post, a vendor name, a legal step, should be read as of then.

Key facts