Cathedral’s Test of Anthropic Went Through Third-Party Software. Here Is What That Means for Your SaaS Stack

A security start-up founded this year by former staff of the U.S. Department of Government Efficiency says its AI agents found their way into Anthropic’s internal business systems in under 12 hours. The start-up, Cathedral, did the work under Anthropic’s program for outside security researchers, and told the company what it found. The Washington Post first reported the episode on October 26, 2026, based on a draft of Cathedral’s findings.

The two companies tell different stories about what happened. Cathedral’s draft says the paths it found could reach meeting transcripts, pay and job offer details, and Slack discussions about advanced models. Anthropic says the researchers reached “a limited set” of sales, human resources and IT systems holding some customer and partner business contacts and basic account records, and never reached Claude conversations, model weights or source code. Anthropic also says Cathedral broke the program’s rules by not disclosing all of its activity, and overstated the national security implications. Public reporting does not establish whether the researchers actually viewed or copied the more sensitive categories their draft describes.

For privacy and security teams at other companies, the details of the dispute matter less than the route. Cathedral did not break Anthropic’s own software. It went through the business applications wired into it.

What is known so far

• The entry point was third-party software. Anthropic says Cathedral first spent several days trying to break its own systems and failed, then turned to vulnerabilities in outside administrative and sales applications. The vendors have not been named.
• Monitoring caught part of it. An Anthropic spokesperson said, “Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day.”
• The affected tools were switched off. Anthropic says it disabled the affected software until the vendors fixed the flaws and found no evidence that anyone outside Cathedral exploited them.
• Scope is disputed. Anthropic’s published responsible disclosure policy excludes systems owned or operated by third parties, even under Anthropic domains, and requires researchers to limit testing to the minimum needed. Cathedral’s draft says its researchers kept data access to a minimum. The specific terms of Cathedral’s engagement have not been made public.
• The 12-hour figure needs context. It appears to exclude the several days of failed direct attempts that came first.

Coverage from The Independent quoted security practitioners who described the problem as a basic hygiene failure in third-party software rather than a sophisticated AI attack. That is the useful lesson.

Why this is a vendor risk story

Every company runs on software it did not write: a CRM, an HR platform, an applicant tracking system, a support desk, a meeting recorder, a chat tool. Each one holds personal data, and each one connects to others through tokens and integrations. Security reviews tend to concentrate on the core product. Attackers, and now AI agents that can chain reconnaissance and testing with little delay, go where the defenses are thinner.

Look at the data categories in Cathedral’s draft: meeting transcripts, compensation, job offers and internal chat. Those are employee and candidate personal data, held in ordinary business tools. A breach of them can trigger notification duties under the GDPR and U.S. state laws, even if no customer data is touched. Our piece on why third-party risk programs fall short explains how questionnaires often miss exactly these integrations.

Six questions to ask about your own SaaS estate

1. Do we know every business application that holds personal data? Include tools bought by individual teams on a company card. A tool missing from your inventory will also be missing from your security reviews.
2. What can each integration reach? List the API tokens and connected apps for your chat, CRM and HR systems, and the permissions each one has. Old tokens with broad scopes are a common path in.
3. Do our vendors patch quickly, and how would we know? Ask for vulnerability management commitments in contracts and a named contact for security notices. Our guide to third-party risk assessments covers what to ask.
4. Would our monitoring catch unusual access through a vendor tool? Anthropic says its monitoring flagged part of the activity. Many companies do not collect logs from SaaS tools at all.
5. Can we switch a tool off fast? Anthropic disabled the affected software. Decide in advance who has authority to do that and what the business impact would be.
6. Are our bug bounty rules clear about third-party systems? If you run a disclosure program, state plainly whether vendor systems are in scope, how researchers must report activity, and what data they may access.

AI vendors deserve their own review, since they often connect to many internal systems at once. Our AI vendor due diligence checklist and our guide to GDPR compliance when using Claude Enterprise cover questions specific to AI tools.

Privacy obligations if a vendor tool is breached

When a researcher or attacker reaches personal data through a vendor’s flaw, the company that chose the vendor is usually still the controller. Under the GDPR, a personal data breach must be assessed and, unless it is unlikely to result in a risk to people, reported to the regulator within 72 hours of becoming aware of it. Authorized testing changes the facts but not the need to assess. If a tester exceeds the agreed scope and reaches personal data, the company should record the event, judge the risk, and decide on notification just as it would for any other unauthorized access.

Where Captain Compliance fits

Captain Compliance’s third-party risk and assessment tools help teams keep an inventory of vendors, the personal data each holds, and the review status of each one, and its data mapping shows how data moves between systems. An inventory and an assessment are evidence that you asked the right questions. They are not proof that a vendor’s software is secure. For a broader set of controls, see our guide on how to mitigate third-party risk.

Frequently asked questions

Was Anthropic hacked?

Researchers working under Anthropic’s outside testing program reached some internal business systems through flaws in third-party software. Anthropic says the testing went beyond the program’s scope and that no one else exploited the flaws. It was not a criminal attack, based on what has been reported.

Were Claude users’ conversations exposed?

Anthropic says no. It says Claude conversations, responses, source code and model weights were not reached.

Which vendors were involved?

They have not been named publicly.

Does authorized security testing count as a data breach?

It depends on what was accessed and whether the access stayed within what was authorized. If testing exceeds its agreed scope and reaches personal data, companies should assess it under their breach procedures.

What is the main takeaway for other companies?

Review the business applications around your core systems, the integrations between them and your ability to monitor and shut them off. That is where this test found its way in.

The weakest system is someone else’s

Anthropic’s core systems held up for days. The path in came through tools that every company buys and few companies examine closely. AI agents are making that kind of search faster and cheaper. Companies that cannot list their SaaS tools, the tokens connecting them and the personal data inside them are relying on no one looking. After this week, it is safe to assume someone will.