Calm down. · Both

Calm down: the 12-hour Anthropic "breach" came in through third-party vendor apps

By alkizz · Oct 26, 2026

At 9:30 AM ET today, Polymarket posted that an "AI cybersecurity startup founded by ex-DOGE staffers breaches Anthropic's internal systems in under 12 hours using AI agents, accessing sensitive employee data & Slack messages." No link, no company name, no context. Just the scariest verbs available. Calm down.

The source is a Washington Post exclusive published at 1:00 AM ET, about eight and a half hours earlier. The startup is Cathedral, which WaPo says was founded by former U.S. DOGE Service staffers. WaPo's story rests on a draft Cathedral report the paper reviewed. Cathedral hasn't published anything yet, and its spokeswoman declined to comment.

Here's what that report says, per WaPo: after running AI agents for less than 12 hours, the researchers "found paths to access" Anthropic data. The way in wasn't Claude, and it wasn't Anthropic's own code. It was flaws in unnamed third-party business software that Anthropic uses for admin and sales work. Cathedral says it was testing under Anthropic's bug bounty program, the one that invites outside security researchers to try the doors, and Anthropic's own statement talks about that program's rules. If that holds, this isn't a criminal gang kicking the door in. It's a researcher in a program that invites people to try the doors. Whether every door they tried was in scope is a separate fight, and it's coming up.

Now Anthropic's side, from its statement to WaPo. It confirms access to "a limited set" of sales, HR and IT systems. Those held business contact details for some customers and partners, plus basic user account records. Anthropic says customer prompts, Claude responses, code and model weights were not accessed. It says its monitoring flagged some of Cathedral's activity before Cathedral reported it, and it shut off the access the same day. The vendor software stayed disabled until the vendors confirmed fixes. And: "We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral."

Anthropic isn't a pure fan of the tester, either. It says Cathedral didn't fully follow the bug bounty rules because it didn't disclose all of its activity, and that Cathedral overstated the "implied national security implications." Anthropic hasn't put out a blog post or an X post about any of this. As of noon ET today, all anyone has is a statement to the press.

Claimed vs. confirmed

So what did Polymarket do? It took the strongest version of Cathedral's own claims and posted it as fact. "Found paths to access" became "accessing." "A limited set of sales, HR and IT systems" became "internal systems." And the parts that make it boring got left out: the bug bounty context, the third-party software, the same-day shut-off, and the vendor fixes.

To be fair, it's not only Polymarket. WaPo's Gerrit De Vynck wrote on X that "They saw internal chats, meeting transcripts and employee salaries," and added that "Model weights and customer prompts were not compromised in this breach." Whether Cathedral actually viewed or copied that data, or only showed it could, isn't public. Anthropic's statement doesn't say. The "12 hours" is softer than it sounds, too: by Cathedral's own account, it's how long the agents ran before the researchers found the paths, not how long it took to get the data.

None of that means nothing happened. Something did. Alex Stamos, CISO at Cognition, reviewed the findings for WaPo and said, "They found something big here." He called the third-party app risk "a humongous problem for everybody," and added, "This is a really hard problem, but Anthropic could have done a lot better." Fair. A frontier AI lab had its HR and sales tools reachable through somebody else's software. That's worth a headline. It's just not the headline Polymarket wrote.

My take: this is a vendor-risk story wearing an AI-agent costume. The scary part isn't that agents found the paths. It's that the paths were there: ordinary business apps wired into HR, sales and chat, with flaws in software Anthropic doesn't control. Every company with a SaaS bill has that problem. The part I'd copy is the boring part: monitoring flagged some of the activity, access got cut the same day, and the vendor software stayed off until the vendors confirmed fixes, according to Anthropic. That's what a decent day in incident response looks like.

What to do:

• Inventory your SaaS integrations and OAuth grants. Why: no vendors are named here, so you can't check for "the" bad app. You can check what's connected to your identity, chat and HR data. How:
  • Businesses and CISOs: list every third-party app with access to identity, chat, HR and sales data, what scopes it holds, and who approved it. In Microsoft Entra, check each app under Enterprise apps > Permissions (Microsoft's guide). In Google Workspace, go to Security > Access and data control > API controls > Manage App Access to see configured and accessed apps and their scopes, and download the list as a CSV (Google's guide).
  • Builders and home labs: do the same for the GitHub, Google, Slack and other accounts you've connected to agents and tools. Remove grants you don't use, and give the ones you keep the smallest scope that works.
• Disable a risky integration until the vendor fixes it. Why: Anthropic says that's how it contained this. It cut access the same day and kept the vendor software off until the vendors confirmed fixes. How: disable instead of delete, so you can turn it back on later. In Microsoft Entra, set "Enabled for users to sign-in?" to No in the app's Properties, which stops new tokens being issued for it (Microsoft's guide). In Google Workspace, set the app's access to Blocked in Manage App Access. Turn it back on only after the vendor confirms a fix. Microsoft also notes that revoking permissions doesn't stop users from consenting again, so block re-consent if the app will keep asking.
• Keep and export your audit logs before you revoke tokens. Why: Anthropic says Cathedral didn't disclose all of its activity. Your own logs, not the tester's report, tell you what happened. How:
  • Export SaaS audit logs, chat audit and access logs, OAuth grant history and identity provider sign-in logs to storage you control.
  • Check your retention settings first. Some plans keep logs for a short time.
  • Then revoke tokens, rotate credentials and disable the app.
• Check whether you'd have caught it. Why: Anthropic says its monitoring flagged some of Cathedral's activity before the report came in. How: alert on unusual integration or service-account behavior, bulk reads, and third-party apps touching chat or HR data.
• If you run a bug bounty, check its scope covers third-party SaaS. Why: Anthropic's public scope covers confidential data exposed through SaaS it uses, but says that isn't permission to test the SaaS vendors' own infrastructure. How: say what's in and out, require full activity disclosure, and decide ahead of time how you'll handle a researcher who reaches employee data.

Sources

• The Washington Post: How an AI start-up founded by ex-DOGE staffers broke into Anthropic (Oct 26, 2026)
• Polymarket on X (Oct 26, 2026)
• Gerrit De Vynck on X (Oct 26, 2026), follow-up
• Anthropic HackerOne policy scopes (updated Jul 15, 2026)
• Microsoft Learn: Review permissions granted to enterprise applications
• Microsoft Learn: Disable user sign-in for application
• Google Workspace Admin Help: Control which apps access Google Workspace data

← All briefs