Anthropic Says Cathedral's AI Agents Accessed Internal Systems

Anthropic has confirmed that AI agents built by the startup Cathedral gained access to part of its internal systems. The agents were hunting for vulnerabilities as part of a bounty program run by Anthropic. The company says there was no leak of users' conversations with Claude and no exposure of model source code.

What the agents reached

According to The Washington Post, Cathedral joined the initiative on 26 October 2026. It used neural networks to look for flaws in third-party software that Anthropic's sales team relied on. Anthropic had offered a reward of $10,000 to anyone whose AI tools could test the reliability of its systems.

Within 12 hours, the agents reached internal employee conversations, including messages about advanced AI models. They also accessed transcripts of corporate meetings, salary information, open job positions and data on some customers. Anthropic said the attempts to get into its systems continued over several days.

A dispute over scope

Anthropic temporarily switched off the vulnerable software to fix the errors. The company argues that Cathedral's actions went well beyond the agreed scope of the bug bounty. Its objection is that the startup's agents attacked third-party applications rather than limiting themselves to the systems that were provided for testing.

Anthropic has not said whether Cathedral will receive the promised $10,000.

The episode shows how autonomous AI agents can move quickly from a narrow testing brief to broader access, and how hard it can be to define the boundaries of a vulnerability program when the testers are machines. For companies that run bounty schemes, it raises practical questions about which systems are in scope, especially when external vendors' software sits inside the corporate environment.