AI agents reached Anthropic’s business systems through third-party SaaS in under 12 hours

A security startup called Cathedral says its AI agents got into Anthropic’s internal business systems in less than 12 hours. The work ran through Anthropic’s program for outside security researchers, so it was an authorized test, not a criminal attack. According to public reporting from The Washington Post, Decrypt, and Gizmodo on October 26, 2026, the agents spent several days failing against Anthropic’s own software, then turned to the third-party tools Anthropic uses for sales, HR, and IT, and got in there.

The vendors have not been named, and Decrypt notes that many other companies use the same software. Anthropic says its monitoring flagged some of the activity before Cathedral reported it, and that it cut off the access the same day and kept the affected applications offline until the vendors confirmed fixes.

Anthropic’s own software held for days. The business software around it gave the agents a way in within hours, and that pattern could apply to nearly any organization. Every company runs a ring of SaaS applications for customers, payroll, hiring, IT tickets, and chat. They hold sensitive data, get patched on their vendors’ schedules, and are tied together by accounts and integrations that rarely get the scrutiny the core systems do.

AI agents make that weak point faster to find. An agent can try a path, fail, and move to the next without tiring, and Decrypt describes Cathedral’s agents carrying out multi-step tasks without a person approving each step. Attackers have the same tools: in November 2025, Anthropic reported that a Chinese state-sponsored group had used Claude Code against roughly 30 targets, with AI doing 80 to 90 percent of the work. Defenders should assume the search for the easiest way in now takes hours.

Anthropic says the researchers reached “a limited set” of systems holding business contact details for some customers and partners and basic user account records. Cathedral’s draft report, as described by The Washington Post, claims routes to meeting transcripts, salary and job-offer details, and internal Slack messages. Anthropic also says Cathedral did not disclose all of its activity.

In a real data breach, the attacker discloses nothing, and the organization has to answer alone: which records did this access actually touch? A tester’s report, an attacker’s claim, or an application’s summary of itself can start that investigation, but none of them proves scope. The proof has to come from systems the organization controls, recorded where the data is read and kept where an intruder cannot edit it. That is what breach notification rules, customers, and regulators will ask for.

Data inside a SaaS vendor’s service depends on that vendor’s controls and on the identity and SaaS security tools around it. RackTop BrickStor SP does not run inside another company’s SaaS application and would not have seen these paths. But much of the same kind of data also lands on file storage an organization runs itself: payroll and HR exports, offer letters, meeting recordings and transcripts, and the files integrations copy out of SaaS tools every night.

For that data, Cyberstorage puts data storage security in the system that serves the files, across SMB, NFS, S3, and Web Drive. In BrickStor SP, attribute-based access control (ABAC) decides per file and per operation what an account may touch, so one stolen credential cannot reach every share. User Behavior Auditing records every read, write, rename, and delete by user, session, and client in an immutable audit trail, so “what was reached?” has a documented answer. Active Defense terminates a session that starts reading or changing files in bulk in under a second, fast enough to matter against an AI agent. Immutable snapshots and Intelligent Bulk Remediation (IBR) restore only the files that session changed.

List the business applications that hold HR, finance, customer, and meeting data, and every integration and service account that connects them. Remove file-share access those accounts do not need. Ask each SaaS vendor how fast it reports vulnerabilities and what access logs it can hand over during an incident. Then test whether your team could say, from its own records and within a day, which files a suspicious account read last week.

If that test is hard to pass, RackTop’s free Cyber Recovery Readiness Assessment scores your readiness for ransomware, data theft, insider threats, and infrastructure compromise in 32 questions. Or request a demo to watch Active Defense stop a live attack on BrickStor SP and see the audit record it leaves.