Weeks after a departing Anthropic researcher warned against making high-stakes AI decisions through a private company's Slack, former DOGE staffers used AI agents to breach parts of the Claude maker's internal business systems.
In less than 12 hours of AI-assisted testing, researchers reportedly found ways to access sensitive Slack discussions, employee salary details and meeting transcripts.
The findings, revealed by The Washington Post on Monday, 26 October 2026, exposed weaknesses in third-party software used by Anthropic. However, the company disputed the extent of the reported exposure and said its core AI technology remained protected.
Anthropic Researcher Warned About Slack Weeks Before Breach
On 9 September 2026, Anthropic researcher Jacob Coxon publicly resigned, raising concerns about the direction of artificial intelligence development.
Coxon, who spent three years conducting AI research at Anthropic and OpenAI, accused both companies of pursuing increasingly powerful systems without adequately addressing their risks.
In a post on X, he described the race towards advanced AI as 'a hubristic gamble that should not be launched from a private company's Slack'.
His warning concerned corporate decision-making and AI safety, not a specific vulnerability in Slack.
Coxon argued that developing potentially dangerous AI systems required greater scrutiny than decisions made within private technology companies.
Nearly seven weeks later, cybersecurity start-up Cathedral reported finding ways to access Anthropic's internal Slack discussions, including messages concerning its most advanced AI models.
There is no evidence that Coxon knew about the vulnerabilities or predicted the security investigation. Nevertheless, the findings have raised questions about how securely AI companies protect their internal communications.
How Ex-DOGE Researchers Breached Anthropic's Systems
Cathedral was founded by four former employees of the Trump administration's Department of Government Efficiency (DOGE).
The cybersecurity start-up investigated Anthropic through a programme that allows outside researchers to identify and report security vulnerabilities.
According to a draft Cathedral report reviewed by The Washington Post, its AI agents discovered routes into Anthropic's business systems after running for less than 12 hours.
Rather than penetrating Claude directly, the researchers exploited vulnerabilities in third-party administrative and sales software connected to Anthropic's operations.
Cathedral reported finding potential access to internal meeting transcripts, employee salaries, job-offer details and Slack discussions about advanced AI systems.
However, it remains unclear how much of that sensitive information the researchers actually viewed or retrieved.
Anthropic also challenged the impression that the entire investigation lasted less than 12 hours.
According to the company, Cathedral had previously spent several days unsuccessfully attempting to penetrate its software directly before targeting third-party applications.
The reported weaknesses affected business software integrations, not Anthropic's underlying AI models.
Similar software is widely used by other organisations. The affected vendors have not been publicly identified.
Anthropic Confirms Limited Access but Disputes Wider Claims
Anthropic acknowledged that Cathedral researchers accessed a limited number of systems used by its sales, human resources and IT departments.
According to the company, those systems contained business contact details for some customers and partners, alongside basic user account records.
However, Anthropic said the researchers could not access customer conversations with Claude, AI-generated responses, proprietary source code or model weights.
Model weights are the numerical parameters that help trained AI systems generate responses.
Anthropic also said its monitoring tools detected some of Cathedral's activity before the researchers submitted their findings.
The company said it blocked their access on the day its monitoring flagged the activity. It also disabled the affected business software until the vendors confirmed that the vulnerabilities had been addressed.
Federal officials were briefed about the incident.
Despite acknowledging the security weaknesses, Anthropic challenged Cathedral's conduct during the investigation.
It accused the start-up of failing to disclose all its testing activities and overstating the findings' national security implications.
Cathedral's draft report maintained that researchers minimised access to sensitive information in accordance with responsible security research practices.
Anthropic said it had found no evidence that anyone outside Cathedral had exploited the vulnerabilities.
Why the Anthropic Breach Matters Beyond Claude
The findings illustrate how AI agents can help cybersecurity researchers identify weaknesses across interconnected business systems.
Alex Stamos, chief information security officer at AI coding company Cognition and a former Facebook security executive, reviewed Cathedral's findings for The Washington Post.
He described the risks associated with third-party software integrations as a widespread problem. Although he acknowledged the difficulty of managing those risks, Stamos said Anthropic could have handled them better.
The investigation also attracted attention in Washington. A senior Trump administration official expressed concern that foreign adversaries could exploit similar weaknesses.
Cathedral has substantial financial backing. The start-up raised $160 million (approximately £120 million) in a funding round announced in July, valuing the company at $1.4 billion, according to Reuters.
For Anthropic, the incident illustrates a security challenge extending beyond its AI models.
The company says its core technology remained protected. Nevertheless, researchers gained limited access to internal business systems through software supplied by outside vendors.
Nearly seven weeks after Coxon questioned the wisdom of making consequential AI decisions through a private company's Slack, Cathedral's findings have renewed scrutiny of how sensitive corporate discussions are protected.
