AI agents reached Anthropic's sales, HR and IT systems through third-party business software. The vendor tools are the soft spot

Attackers no longer need to beat your main platform. They go after the small tools plugged into it.

What happened

Cathedral, a security startup founded by former DOGE staffers, says its AI agents found ways into Anthropic's internal systems by exploiting vulnerabilities in third-party business software, as part of Anthropic's bug bounty program. The details come from a draft Cathedral report reviewed by The Washington Post.

Cathedral says its agents found paths to meeting transcripts, salary data, job offers and Slack messages in under 12 hours, through external admin and sales programs. Anthropic says the researchers first spent several days trying to breach its own software directly, then pivoted to the third-party tools.

Anthropic confirmed the researchers accessed a limited set of its sales, HR and IT systems, including business contact information for some customers and partners and basic user account data. It says Claude chats, source code and model weights were not exposed. It shut down the access points the same day, disabled the third-party programs and notified US federal authorities. Anthropic also says Cathedral found two vulnerabilities but reported only one, and accuses it of breaking the program's rules. Cathedral says it followed standard practice.

Anthropic red teamer Logan Graham said attackers already run AI agents around the clock against external dependencies, and that models half a generation to a full generation behind the frontier are capable enough. Alex Stamos of Cognition said integrated third-party apps are a major problem across the industry.

My take

The details are disputed, but the path is the lesson. The way in was not the core product. It was the sales and admin tools around it.

That is exactly the layer automation builders add to client businesses: CRM marketplace apps, form tools, schedulers, enrichment services, a webhook relay. Each one holds a token into the CRM.

What I now do on every client stack:

• Keep a list of every connected app, who installed it and which scopes it holds.
• Remove apps nobody has used in 90 days.
• Give each integration its own account or key, so one leak does not open everything.
• Turn on login and API alerts where the CRM supports them.

Cheap agents can probe all of this day and night. The inventory has to keep up.