AI Agents Expose Third-Party Security Gaps at Anthropic in Under 12 Hours

Cathedral, a startup founded by former DOGE staffers, revealed that its AI agents successfully identified access paths into Anthropic's sales, HR, and IT systems in less than 12 hours. The agents achieved this by exploiting vulnerabilities in third-party software integrated with Anthropic's infrastructure, highlighting the growing risks of supply chain attacks. This development underscores a critical challenge for AI companies: even advanced security measures can be undermined by less secure external vendors. The findings are particularly significant as Anthropic, a leading AI safety-focused company, faces scrutiny over its own security practices. Cathedral's disclosure suggests that AI-driven offensive security tools are becoming faster and more effective, potentially reshaping how organizations assess and manage third-party risk. As AI systems become more capable, the race between attackers and defenders intensifies, making proactive security testing essential. The incident serves as a wake-up call for the tech industry to prioritize comprehensive security audits that include all connected software ecosystems.