The report
On October 26, Cathedral described an AI-assisted security investigation that it says reached information in third-party business software used by Anthropic. Anthropic confirmed limited exposure of business contact and account data but disputed the scope of the researchers' claims. Nothing in the public reporting establishes that Claude users' conversations, Anthropic source code or model weights were accessed.
Two accounts of one event
Cathedral told the Washington Post that its team combined AI agents with security research and reached areas of sales, human resources and other corporate software in less than 12 hours. Its account includes claims concerning meetings, compensation and Slack material. Those descriptions are researcher claims, not an independently published inventory of recovered records. The Washington Post account records that Anthropic accepted a narrower description and denied access to systems supporting Claude or the sensitive model assets named above.
Anthropic also said its monitors identified some activity, relevant access was closed on the same day, and affected business-tool paths had been patched. A short offensive timeline should not be mistaken for a full account of preceding testing: Anthropic says the researchers had been probing for several days. The companies also dispute aspects of authorization and conduct. There are no publicly verified vendor-by-vendor exploit chains or reliable exposed-record counts in this evidence.
What the AI component changes
The interesting security boundary is not a model jailbreak. It is the translation of a security researcher's chosen targets into agent-driven reconnaissance and repeated testing against ordinary third-party SaaS accounts. Even if each vulnerable service is conventional software, automated discovery can compress the time between finding one access path and checking the next. That interpretation does not prove that an AI system independently selected its goals, bypassed a unique Anthropic model defense or caused the entire reported data exposure.
The underlying investigation dossier separates the reported offensive reach from the response the company confirms. A complete reconstruction would require the affected vendor identities, the exact authentication and authorization failures, the approved test scope, and an independently reconciled list of accessed records.
Bottom line: limited business-system access is acknowledged; the wider access description remains disputed. Readers should not convert either the claimed testing speed or the headline into a confirmed compromise of Claude's model infrastructure.