Researchers Reached Anthropic Through Third-Party Software
External security research accessed business systems via connected SaaS — a reminder that AI security includes every linked application, not just the model.
Short answer
Attackers can enter through weaker connected business software rather than the core AI platform — recruitment, CRM, and messaging tools may hold transcripts, payroll, and account data with powerful cross-service access. Map supplier connections, enforce least privilege, monitor unusual data access, and contract for breach notification and investigation records.
Most businesses protect their most important systems carefully. The problem is that attackers do not have to begin with the strongest door. They can look for a connected service with weaker security and work their way inward.
On 26 October 2026, The Washington Post reported that researchers from cybersecurity start-up Cathedral used AI agents to identify routes into business systems used by Anthropic. The researchers reportedly worked for fewer than 12 hours and reached information in connected software used for business activities. Anthropic confirmed limited access to systems containing business contact records, account information, meeting transcripts, pay and job-offer details, and internal discussions.
Anthropic said the researchers did not obtain customer conversations with Claude, source code, or the underlying AI models. It also said it blocked access, detected some activity, and found no evidence that others exploited the weaknesses. The testing took place under an external security research program, but Anthropic and Cathedral disagreed about compliance with disclosure rules. This is not the same as a confirmed attack by an unidentified criminal group.
What to do
The story matters because ordinary business software can provide routes to highly sensitive information. Recruitment systems, customer relationship tools, internal messaging services, and help desks may all hold confidential material or have powerful connections to other services.
Organisations should map those connections and ask what each outside provider can actually see or change. Remove connections that are no longer required and ensure accounts are limited to the minimum access needed. Avoid using one administrator account for several services. Require extra verification for important changes and make sure access can be revoked quickly if a supplier suffers an incident.
Look beyond failed login alerts. Unusual downloads, a support application viewing payroll files, or a recruitment account querying unrelated customer data may be more revealing than a conventional password attack. Supplier contracts should also state when incidents must be reported and which records the customer can obtain for investigation.
Sources
- The Washington Post, 26 October 2026 — Cathedral researchers and Anthropic systems.
- ISO/IEC 42001 explained — International Organization for Standardization.
We assess suppliers and data flows around your AI stack, not just the model — through gap assessment and supplier governance under ISO/IEC 42001.