AI startup breaches Anthropic in 12 hours via third-party software flaw

AI startup Cathedral breached Anthropic's systems in under 12 hours using autonomous AI agents, accessing employee details and internal messages through third-party software flaws. Anthropic confirmed the intrusion but accused Cathedral of violating its bug bounty rules. The agents exploited weaknesses in third-party business software to reach HR, sales, and IT systems, exposing limited customer and partner contact information and basic account records. Anthropic's monitoring flagged the activity, and it shut off access the same day, with source code and AI model weights remaining untouched. Cathedral, founded by former DOGE members, reported the findings through Anthropic's HackerOne program. The incident highlights vendor-related security risks, with experts noting that even advanced organizations remain vulnerable to AI-powered attacks, though Anthropic's response drew some praise.