The security story everybody was arguing about this week: a startup called Cathedral says its AI agents found paths into Anthropic's internal business systems in under 12 hours. The Washington Post broke it on Monday. I'm not interested in the drama. I'm interested in how they got in, because the answer applies to almost every company I talk to.
What's Actually Known
Sticking to what's been reported publicly (Decrypt and Cybersecurity News, both citing the Post):
- The testing happened under a bug-bounty-style program, not as a criminal intrusion.
- The way in was third-party sales and administrative software Anthropic uses. Not Claude, not Anthropic's own code.
- Cathedral's draft report says the agents reached meeting transcripts, salary and job-offer details, and Slack messages.
- Anthropic says the researchers reached "a limited set" of sales, HR, and IT systems, and that customer conversations with Claude, source code, and model weights were not touched. It says its monitoring flagged some of the activity before Cathedral reported it, and that it "shut off their access the same day."
- The two sides disagree on how serious it is and on whether Cathedral fully followed the program's disclosure rules. I'm not going to referee that. The vendors whose software was involved haven't been named.
Credit Where It's Due
Anthropic ran a program that invites this kind of testing, its monitoring caught activity on its own, and it pulled the affected integrations until the vendors confirmed fixes. Plenty of companies would have found out from the newspaper. Every organization, mine included, has third-party software it doesn't fully control.
The Real Lesson: Your SaaS Sprawl Is the Perimeter Now
Forget whose name is in the headline. Here's the pattern:
- The crown jewels were well defended. The sales and HR tools weren't as hardened. Attackers don't go through your strongest wall. They go through the CRM integration somebody set up three years ago.
- SaaS connections inherit trust. A tool connected to Slack, your HR system, and your calendar is a bridge between all three. Compromise the bridge and you get everything it can read.
- AI agents compress the timeline. Mapping hundreds of SaaS apps, tokens, and integrations used to take a skilled team weeks. Now it's hours. Whatever the exact facts here turn out to be, that part isn't in dispute, and defenders need to plan for it.
What I'd Do This Week
- Inventory your SaaS-to-SaaS connections. Every OAuth grant, API token, and integration. Who owns it, what it can read, when it was last used. Kill the ones nobody claims.
- Shrink scopes. A sales tool doesn't need to read every Slack channel. Least privilege applies to apps, not just people.
- Put access behind identity, not network location. Admin consoles for business apps should require strong, phishing-resistant authentication and device posture, and shouldn't be reachable just because someone found the URL.
- Watch data flows, not just logins. Bulk reads of HR records or Slack exports by an integration should page someone.
- Have your own red team (human or AI) try the side doors. If an outside team can map your SaaS estate in 12 hours, you should know what they'll find before they do.
Bottom Line
The scariest part of this story isn't that AI agents got in. It's where they got in: through the boring, everyday business software every company runs and almost nobody audits. AI makes the side doors faster to find. Close them first.
Sources: Decrypt and Cybersecurity News, both summarizing The Washington Post's October 26 report