Cathedral, a startup founded by former DOGE employees that sells AI-powered security tools, reported in a draft report reviewed by The Washington Post that its agents found meeting transcripts, salary data, job postings and Slack messages in under twelve hours. The researchers got in through external admin and sales programs, after first probing Anthropic's own systems, according to Anthropic red teamer Logan Graham.
The two sides disagree on how long the activity lasted and how far it reached. Cathedral says it took less than twelve hours, while Anthropic says the attempts stretched over several days. Anthropic says it shut the affected access points the same day, disabled the third-party programs, and notified U.S. federal authorities. It also accuses Cathedral of incomplete disclosure and of going beyond the program's safe harbor provisions, which Cathedral disputes.
Will Depue, a former OpenAI employee, has claimed that Cathedral gained full admin access to Anthropic's Slack workspace, a claim Graham rejects. Graham says Anthropic found and patched a second vulnerability that Cathedral did not report, and warns that attackers already run AI agents around the clock against external dependencies.
Why it matters if you build agents
Agents with network access can probe third-party integrations continuously and at low cost, so those integrations are part of your attack surface. Developers should review which tools and apps their agents can reach, especially chat and workspace platforms that hold sensitive data, and limit admin-level tokens.
Get stories like this every weekday
One short email with the day's agent tooling news.