Anthropic: AI agents reach sales, HR and IT systems via unnamed third-party software (no CVE)

Severity: medium · Patch status: partial · Since 2026-10-26

Cathedral, an AI-security startup founded by former DOGE staffers, says its autonomous agents reached Anthropic's internal business systems in under 12 hours, after Anthropic says several days of its own direct attempts had failed. The entry point was weaknesses in unnamed third-party business administration and sales software, per the Washington Post's report on a Cathedral draft; no vendor, product, version or CVE has been published, and the Post withheld the vendor names. Anthropic's account, given to journalists rather than in a published Anthropic post, is that access was limited to a set of sales, HR and IT systems holding contact details for some customers and partners and basic user account records, and that Claude conversations, source code and model weights were not reached. Cathedral's draft describes meeting transcripts, salary and job-offer details and Slack discussions about advanced models; sources disagree on whether Anthropic confirmed those specific items, and the 12-hour timing is Cathedral's own figure. The work ran under Anthropic's bug bounty program. Anthropic says it spotted some of the activity, cut access the same day, disabled the affected software pending vendor fixes, found no evidence that anyone else exploited the flaws, and says Cathedral did not disclose all of its activity as program rules require and overstated the national-security implications. Cathedral says it kept data access to the minimum needed.

What to do

Inventory third-party business applications (CRM, HR, sales, IT tooling) and their access to sensitive systems; disable or restrict the affected vendor software pending fixes
Verify third-party software contents and components rather than relying on questionnaires and certifications
Monitor for anomalous access to internal business systems and review permissions of integrated SaaS applications
Assume AI-assisted attackers can find third-party software weaknesses quickly; shorten patch and vendor-remediation SLAs

Sources

Researchers Break Into Anthropic’s Systems in Just 12 Hours—Through Third-Party Software (reversinglabs.com)

All live incidents on Threat Watch

Threat Watch– active

All incidents

More on Threat Watch

More Anthropic incidents

Claude Code extension (Cursor marketplace): tampered 2.1.312/2.1.313 plants SSH backdoor (no CVE) High · Supply chain
Aur0ra ransomware: AI coding agents (Cursor, Claude) used to reach domain admin (no CVE) High · Breach
Jenkins core: 15 vulnerabilities fixed in 2.588 / LTS 2.580.2. Low-privilege users can get RCE on the controller; an unauthenticated race in the setup wizard can create an admin (CVE-2026-117612–117626) High · Patch now
Command Code: distillation-linked incident forces revocation of all API keys Medium · Breach
Codex, Claude Code: planted AGENTS.md in Downloads makes agents install malicious npm package function-color High · Supply chain
PyPI: typosquatted packages 1h1 and aanthropic download and execute malware during install (no CVE) Critical · Supply chain

Browse

Helix Cyber

Is your stack exposed? Get it tested.

The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.

Get a pentest How it works

Agent Virtualization

Enterprise Coding Agents

Private AI Platform

Digital Sovereignty

Follow the Sun

The Speed Advantage

Financial Services

GPU Cloud & Neoclouds

Public Sector & Defence

More on Threat Watch

More Anthropic incidents

Browse

Is your stack exposed? Get it tested.