{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Cathedral researchers get into Anthropic's sales, HR and IT systems through third-party software · updates",
  "home_page_url": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026",
  "feed_url": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026/feed.json",
  "description": "Researchers at Cathedral, a months-old security start-up, got into a limited set of Anthropic's sales, HR and IT systems while testing under Anthropic's external security (bug bounty) program, The Washington Post reported on Oct 26 2026. Cathedral's draft report says its AI agents found paths in through flaws in third-party admin and sales software in under 12 hours, reaching meeting transcripts, salary and job-offer details and Slack messages. Anthropic confirmed access to systems holding business contact details for some customers and partners and basic user account records, but says Claude conversations, source code and model weights were not reached. It says its monitoring flagged the activity, it cut off access the same day, disabled the affected third-party apps until their vendors fixed the flaws, and found no evidence anyone else exploited them. Anthropic also says Cathedral did not disclose all of its testing as the program rules require and overstated the national-security implications.",
  "language": "en",
  "_pwn": {
    "slug": "anthropic-cathedral-business-systems-access-oct-2026",
    "severity": "medium",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026#2026-10-26-547b5330",
      "url": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026#2026-10-26-547b5330",
      "title": "Cathedral researchers get into Anthropic's sales, HR and IT systems through third-party software: The Washington Post reports that researchers at the security start-up Cathedral got inside Anthropic's internal business systems during testing under Anthropic's external security program, citing a draft Cathedral report that says AI agents found the way in through third-party admin and sales software in under 12 hours.",
      "content_text": "Cathedral researchers get into Anthropic's sales, HR and IT systems through third-party software: The Washington Post reports that researchers at the security start-up Cathedral got inside Anthropic's internal business systems during testing under Anthropic's external security program, citing a draft Cathedral report that says AI agents found the way in through third-party admin and sales software in under 12 hours.\n\nSource: https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026#2026-10-26-53c5ed52",
      "url": "https://pwn.watch/i/anthropic-cathedral-business-systems-access-oct-2026#2026-10-26-53c5ed52",
      "title": "Cathedral researchers get into Anthropic's sales, HR and IT systems through third-party software: Anthropic confirms Cathedral reached a limited set of sales, HR and IT systems holding business contact details for some customers and partners and basic user account records; it says Claude conversations, source code and model weights were not accessed, that its monitoring flagged the activity and it cut off access the same day, and that it found no evidence anyone other than Cathedral exploited the flaws.",
      "content_text": "Cathedral researchers get into Anthropic's sales, HR and IT systems through third-party software: Anthropic confirms Cathedral reached a limited set of sales, HR and IT systems holding business contact details for some customers and partners and basic user account records; it says Claude conversations, source code and model weights were not accessed, that its monitoring flagged the activity and it cut off access the same day, and that it found no evidence anyone other than Cathedral exploited the flaws.\n\nSource: https://decrypt.co/381860/ai-agents-hack-anthropic-business-systems-12-hours",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://decrypt.co/381860/ai-agents-hack-anthropic-business-systems-12-hours",
      "tags": [
        "medium"
      ]
    }
  ]
}