A researcher programme test at Anthropic has turned into a public argument about what the testers did and what they told the company. For anyone running a bug bounty in the UK, the dispute is a useful stress test of scope wording, activity logging and safe harbour.
What happened
On 26 October 2026 the Washington Post reported that Cathedral, a security start-up only a few months old, had told Anthropic its researchers had reached sensitive internal systems at the AI company. Cathedral was founded by four former staff of the US Department of Government Efficiency (DOGE): Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. According to earlier Reuters reporting, it raised $160m in July at a $1.4bn valuation, with Andreessen Horowitz and Sequoia Capital backing the round.
According to the Washington Post, which reviewed a draft of Cathedral’s findings, the testing ran under Anthropic’s outside-researcher programme, which works much like a bug bounty. Cathedral’s draft says its AI agents needed under 12 hours to find ways in. The draft claims those paths exposed internal Slack threads on frontier models, meeting transcripts, and pay and offer data.
Anthropic tells the story differently. It told the Post that its monitoring “flagged some of Cathedral’s activity before they reported it”. It cut the access within the day and describes a “limited set” of HR, IT and sales systems containing partner and customer contact details plus basic account records. It says Claude chats, model weights and source code were never reached, and it has seen no sign of anyone else using the flaws.
The disagreement is now in the open. According to the Post, Anthropic accuses Cathedral of breaching programme rules by leaving some of its activity unreported, and of exaggerating the national security angle. Cathedral’s draft insists its researchers held data access as low as possible, in keeping with accepted research practice. An unnamed senior Trump administration official told the Post the report has been passed around government and raised national security concerns.
The technical picture
Cathedral did not get in through Claude or through Anthropic’s own code. Anthropic says the testers first spent several days trying to break its software directly and failed. They then turned to weaknesses in third-party administrative and sales applications, the kind of SaaS tools almost every organisation uses to manage customers and staff. The vendors have not been named. Anthropic says it disabled the affected products until the suppliers confirmed fixes.
Viewed as an attack path, this is a familiar story told faster. The core platform held up, so the attackers used the business systems wired into it: HR, CRM, identity and collaboration tools, each with its own integrations, tokens and permissions. AI agents can chain reconnaissance, testing and pivoting with far less human delay between steps. The 12-hour figure needs care, though, because it excludes the failed direct attempts that came first. Alex Stamos, who reviewed the findings for the Post, reportedly saw them as evidence of gaps in Anthropic’s handling of supplier integrations.
Why it matters for UK organisations
Strip out the AI and the politics and this is a scoping dispute of a familiar kind. Two questions decide it. Were the third-party platforms in scope? Did the researchers tell the programme owner everything they did, as they did it? UK programme owners should ask both of their own policies.
The legal stakes are higher in the UK. Section 1 of the Computer Misuse Act 1990 makes unauthorised access an offence regardless of motive, and the Act still has no defence for good-faith research. A bounty policy works as a grant of authorisation from the programme owner. That grant only covers systems the owner is entitled to authorise. When a researcher pivots from your estate into a SaaS supplier’s platform, your safe harbour may not reach that far, because you cannot authorise access to someone else’s computer. The researcher is then exposed, and you inherit a disclosure problem with a vendor who never agreed to testing.
The government’s stated plan, which a government minister restated in the House of Lords on 26 October, is a section 1 defence limited to accredited researchers, to be delivered through the national security-focused Bill promised in May’s King’s Speech. No date has been set. Until that arrives, the programme’s own wording is what protects researchers and organisations alike.
Expert view
In my experience, the most bitter disputes in coordinated disclosure are rarely about the vulnerability itself. They are about what happened after the first foothold. Programme rules usually ask testers to stop at proof of access, avoid reading personal data and report promptly. Each of those becomes harder to judge when an autonomous agent is doing the exploring and can touch hundreds of records in the time a human tester would open one.
When we scope a penetration test, the rules of engagement say exactly which third-party services can be touched, with written permission from those providers where it is needed. Bounty programmes are often looser. Many simply exclude third-party services and leave the researcher to guess where the line falls once an integration leads somewhere unexpected. That ambiguity gets much more expensive when testers bring agents that move fast and log patchily.
Both sides in this case can be partly right. A tester can keep data access minimal and still fail to report every step in real time. A defender can detect activity early and still have left a supplier path open. I would not draw conclusions about either party from a draft report and one company’s statement, and neither should UK boards.
What to do now
- Rewrite scope for SaaS. List the third-party platforms that hold your data and say explicitly whether testers may touch them, stop at the boundary or must report and halt. Remember that you can only authorise access to systems you control.
- Require activity disclosure. Ask researchers to keep a timestamped log of actions, accounts used and data viewed, and to submit it with the report. Say so in the policy, including for AI-agent-driven testing.
- Set data-handling limits. Define a stop condition, such as the first sight of personal data or credentials, along with how evidence is to be redacted and when it must be deleted.
- Strengthen your safe harbour text. Commit not to pursue legal action under the Computer Misuse Act for good-faith work within scope. The NCSC’s vulnerability disclosure guidance is a sensible baseline.
- Audit integrations. Review OAuth grants, API tokens and service accounts linking SaaS tools to core systems, and remove anything stale. This maps to the Cyber Essentials access control and secure configuration controls.
- Test your detection. Check whether your monitoring would flag unusual access through a supplier integration on the same day, as Anthropic says its own did.
Bottom line
The Cathedral episode is less about how quickly AI agents can find a way in than about whether bounty rules can keep up with them. Supplier platforms are the soft edge of most estates, and UK law gives researchers little protection once they cross into them. Programme owners who define that boundary clearly, and require a full account of what testers did there, will avoid most of the dispute now playing out in public.
Sources
- Gizmodo: Former DOGE Staffers’ New Startup Claims It Hacked Anthropic
- Decrypt: AI Agents Found a Way Into Anthropic’s Business Systems in Under 12 Hours
- Cyber Security News: Researchers Use AI Agents to Breach Anthropic’s Internal Systems in Just 12 Hours
- Tech Startups: Ex-DOGE AI cybersecurity startup Cathedral breaches Anthropic’s internal systems in under 12 hours
- Hansard: Cyber Security and Resilience (Network and Information Systems) Bill, House of Lords, 26 October 2026
