What happened. The test ran under Anthropic's program for outside security researchers, so this was authorized research, not a criminal intrusion. Cathedral says its agents reached meeting transcripts, salary and job-offer details, and internal Slack messages. Gizmodo reports Anthropic said the researchers had earlier spent several days failing to break its own software directly, which is why the third-party route matters.
Anthropic's side. Anthropic told the Post the exposed systems held business contact details for some customers and partners plus basic user account records. It says its monitoring flagged some of Cathedral's activity before Cathedral reported it, access was cut the same day, and the affected business apps stayed off until their vendors confirmed fixes. Anthropic says it found no sign anyone else used the holes, and it disputes how Cathedral ran and framed the test, saying Cathedral didn't disclose all of its activity and overstated the national security angle. The vendors and the specific flaws have not been named.
Why buyers should care. The model and the code were well defended; the HR, sales and IT apps wired into the company were not. That's the same pattern behind most SaaS breaches: the attacker goes after the tools connected to you, then rides their access. And AI agents make that hunt much faster, because they can probe, chain and retry without waiting on a human between steps.
What I'd do this week. List every SaaS app that holds HR, sales or chat data, and which other apps it's connected to. Review OAuth grants (the "allow this app to access your account" permissions) and cut any that are unused or too broad. Make sure your logs from those apps actually land in your SIEM so you'd see what Anthropic's team saw. And ask your top vendors when they last had an outside test that used AI agents.