On October 26, 2026, a security test disclosed by The Washington Post put Anthropic in an awkward position: AI agents sent in to test the company reached part of its sales, human resources and IT systems in under 12 hours. Anthropic then confirmed that scope, saying it had shut off the access paths and briefed federal officials. One distinction matters first: this was not an outside hacking attack, but an authorized test that Anthropic itself had invited outside researchers to run — and precisely because it was authorized, what it exposed deserves to be taken seriously.
How the agents got in
According to a draft Cathedral report seen by The Washington Post, the researchers exploited vulnerabilities in the business software Anthropic uses for day-to-day administrative and sales work, rather than breaking directly into a frontier model. The report says the agents followed the permission chains in that software and found paths to meeting transcripts, salary and job-offer details, and internal messages discussing advanced models. Those details come from the draft report so far; what Anthropic has publicly confirmed is only the scope — "a limited set" of its sales, human resources and IT systems. The two should be kept apart: the first is the tester's account, the second is the tested company's confirmation.
Authorized test versus intrusion
Cathedral is not an ordinary outside firm. It is a months-old cybersecurity startup founded by former members of the U.S. DOGE Service, selling AI-powered security tools to government and corporate clients, and valued by investors at $1.4 billion. It carried out this work under Anthropic's program inviting outside researchers to test its systems, and it disclosed the findings to Anthropic earlier in October. In other words, Anthropic did not learn after the fact that someone had entered its systems; it asked people to look for flaws, they found them, and it closed them. Calling this "Anthropic got hacked" would mislead readers: the real news is not that someone broke through the defenses, but that the defenses lasted less than half a day against a test Anthropic itself had commissioned.
What companies should actually worry about
The shock here is not any single vulnerability, but speed and generality. An agent does not need to stay up all night writing exploit code; it can tirelessly try permissions, chain systems together and read documents, compressing days of manual testing into a few hours. The reporting notes that the business software exploited is not unique to Anthropic — many companies use similar tools for administrative and sales work. That means similar permission chains may exist inside other firms too: an account that seems to handle only expenses or scheduling could, through integrations and shared permissions, lead on to far more sensitive data.
For companies already using AI agents, the lesson is concrete: give agents accounts with the least privilege they need, keep test accounts hard-separated from production data, and require human review and complete logging for consequential actions, rather than judging only the final result an agent hands back. More importantly, security testing cannot stop at whether a model says the wrong thing; it must also measure how far an agent can travel inside real business systems. Anthropic's sequence — invite the test, find the problem, close it and report it — is not itself at fault. The mistake is assuming that putting guardrails around an agent is enough, without counting how fast it can run inside them.
