Cathedral, a young cybersecurity company founded by former staffers of the Trump administration's DOGE unit, managed to get inside internal systems at Anthropic, the company that develops Claude. According to The Washington Post, the researchers used AI agents that scanned for and exploited weaknesses automatically, reaching the company's HR, sales and IT systems.
How it happened
The intrusion did not go through Anthropic's core systems but through unnamed third-party software the company uses. That is exactly the weak point that has worried the cybersecurity world in recent years: supply chain attacks, in which the attacker targets a vendor connected to the target rather than the target itself. The work was done under a bug bounty program, in which companies invite researchers to find flaws and reward them.
What Anthropic says
According to Anthropic, user conversations with Claude, the company's source code and model weights were not accessed. The company blocked the access and took the affected software offline. The two sides dispute the details: Cathedral says it held access for about 12 hours and frames the incident as a national security issue, and Anthropic rejects that framing.
Why it matters
The incident illustrates two trends reshaping security in 2026. First, AI agents let a small team scan and attack at a scale that once took a full team of hackers. Second, even companies that spend heavily on security are exposed through their vendors. For Israeli cybersecurity companies, many of which specialize in supply chain security and in detecting AI agents, it is another sign that demand for their products will only grow.
