AI Agents Got Into Anthropic Through Its SaaS Tools. Is Yours Next?

The route into Anthropic was not the model. Cathedral says its AI agents found paths into Anthropic's business systems in less than 12 hours through weaknesses in third party administrative and sales software, not through Claude (Decrypt). Many companies use the same software, so if you sell B2B SaaS, your product is part of someone else's attack surface.

TL;DR

• Cathedral says its agents reached Anthropic's systems in under 12 hours via third party admin and sales tools.
• A draft report describes routes to meeting transcripts, salary and job offer details and Slack messages.
• Anthropic confirmed limited access to sales, HR and IT systems, and says customer conversations, source code and model weights were not accessed.
• Anthropic disputes parts of the account, including the national security framing and how much activity was disclosed.
• For a small SaaS, the practical response is disclosure, least privilege, audit logs and fast vendor fixes.

Disclosure: ZeroRaised publishes this analysis and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 28 Oct 2026; ZeroRaised has no commercial relationship with the companies named.

An attack surface is the full set of entry points an attacker can try, including your app, the admin tools your team uses, the vendors behind them and the accounts that connect them. Least privilege is giving each person, service or agent only the access its job needs.

What did Cathedral actually get into?#

Cathedral was founded by four former DOGE staffers. It says its agents found paths into Anthropic's business systems in less than 12 hours, testing the work through a programme that works like a bug bounty (Decrypt).

Per a draft report, the routes reached meeting transcripts, salary and job offer details, and Slack messages (Decrypt).

Anthropic confirmed access to "a limited set" of sales, HR and IT systems. It said customer conversations, source code and model weights were not accessed (Decrypt).

The accounts differ in scope, which is normal early on. What matters for a vendor is the route: ordinary business software, not a frontier model.

Why is third party software the weak link?#

Administrative and sales software sits behind a company's login page but often connects to far more data than the buyer expects. A sales tool holds meeting transcripts. An HR tool holds offers and salaries. A chat tool holds everything people say while doing other work.

Many other companies use the same software (Decrypt), so a technique that works on one is worth trying on all of them.

This is an argument about defaults. If one admin account can read every customer record, if support staff share a login, if an integration token never expires, the weak point is your configuration rather than the vendor's code.

AI agents can change the economics of finding those weak points, because they make probing many paths cheaper. The same capability is available to defenders, but defenders have to know where to look.

What does Anthropic say?#

Anthropic's statement is specific. "Our monitoring flagged some of Cathedral's activity before they reported it to us," the company said, and "we shut off their access the same day" (Decrypt).

Anthropic also said Cathedral overstated the national security implications and did not disclose all of its activity (Decrypt). It disabled the affected software until vendors confirmed fixes, and did not name those vendors (Decrypt).

Both can be true. A researcher can find a real path and still tell a larger story. The useful reading is that detection and a same day shutdown mattered, and the disagreement is about the narrative, not whether access happened.

Cathedral raised $160M at a $1.4B valuation in July, which is worth remembering when you read either side. It has an incentive to describe the finding as significant (Decrypt).

What should a small SaaS do first?#

You do not need a security team to cover the basics.

1. Publish a security page. State what you collect, where it runs, who can access it and how you handle incidents.
2. Give researchers a route. Add a security.txt style contact, because a researcher who cannot report may publish instead.
3. Offer a bug bounty, or a clear safe harbour. A small programme with a response commitment signals that reports are welcome.
4. Apply least privilege to admin roles. Separate billing, support and deployment. Do not let one shared account do all three.
5. Log privileged actions. Who changed a setting, exported data or impersonated a user. Keep logs long enough to investigate.
6. Inventory your vendors. Know which tools can reach customer data, and who owns each relationship.
7. Fix vendor issues fast. When a supplier ships a patch, apply it the same week, not at the next rebuild.

The vibe coded app security checklist covers the code level version of this list, and the API key rotation guide covers the credential side.

Why does AI make this a sales problem?#

Because a buyer who has read a story about agents reaching a well known company through ordinary tools may ask the security question earlier, sometimes on the first call rather than after a verbal yes.

That is an opportunity for a small vendor with a clean answer. A one page security summary and a real disclosure email can close a gap that a bigger competitor answers with a PDF and a wait.

It is also a warning about feature scope. Every integration is another path into customer data, and every admin convenience is another privilege to review. The guide to building a defensible AI product calls process knowledge the moat; access control is the fence.

What this means for bootstrapped founders#

1. Write the security page this week. Describe your stack, data handling and incident contact.
2. Add a disclosure route and commit to a response time you can meet.
3. Remove shared admin accounts. Give each person and service its own identity.
4. Turn on audit logging for actions that touch customer data.
5. List your vendors and note which ones can read customer records.
6. Practise one patch. Time how long it takes to ship a dependency update.
7. Say what you do not do. If you do not hold payment data, say so, because the absence of data is a feature.

The trust argument also applies to the agents you build. If your product gives an AI agent access to a customer's systems, scope that access and make it revocable. The Hyphenate analysis shows how an audit trail can be a selling point rather than a cost.

Where ZeroRaised fits#

ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity. If your SaaS has a security page and a clear disclosure route, say so when you submit your product, because a cautious buyer will look for it. The newsletter carries new analysis like this, and the pricing page explains the listing options. We make no promise of traffic or results.

Sources#

• Decrypt: AI agents hack Anthropic business systems in 12 hours
• Washington Post: researchers say cybersecurity startup Cathedral got inside Anthropic