ai agents got into anthropic's sales, hr and it systems in under 12 hours
it was an authorized bug bounty test by a startup called cathedral, and it went in through third-party business software. anthropic says user chats, source code and model weights weren't touched, but slack messages, meeting transcripts and salary data were reachable
if the ai company can get hit through its vendors, so can everyone else
anthropic is massively underplaying the recent security breach. i'm hearing cathedral achieved full administrator access of the slack workspace (see every message, log in as arbitrary users) where literally every single research secret is contained
to those unfamiliar: Ant & OAI keep literally everything in Slack. it sounds exactly the same incident that happened to OpenAI in 2023, where OpenAI was hacked by a random guy who got access to an access token from an external app service
"we're critical to national security, we must beat China, and yes we keep all our crown jewels in Salesforce's Slack messenger. yes we have admin API tokens everywhere. why do you ask?"
Oct 28, 2026 · 8:39 AM UTC