A folkfox special report.
Anthropic security breach:
what did Cathedral reach?
A security test found a way into Anthropic through third-party software. A wider allegation about Slack followed. Here is what the evidence can, and cannot, tell us.
By the folkfox newsroom. The article can be read without using its controls.
The door in the office
The Washington Post reported on 26 October that Cathedral, a cybersecurity start-up founded by former staff of the US DOGE Service, had found ways into Anthropic's internal systems through third-party business software. The paper reviewed a draft of Cathedral's report. The Decoder summarises its reporting. This article has not independently examined the draft or the underlying access logs.
The story is unsettling because of the route. An AI laboratory can put its most sensitive systems behind strong walls and still depend on ordinary applications connected to the rest of the business. How far a person can travel from one of those applications depends on permissions and other controls. The specific permissions in this incident remain undisclosed.
What Cathedral says it found
According to the Post's account of the draft, Cathedral's AI agents ran for less than 12 hours and found paths to internal data, including meeting transcripts, salary and job-offer details, and Slack messages discussing Anthropic's advanced models. The reported finding is a route to information. The public account does not tell us which individual messages the researchers read, copied or retained.
The distinction matters. A door demonstrated to be open is a security finding even if its visitor stops at the threshold. It does not tell us what is in every room.
Anthropic's account
Anthropic told the Post that Cathedral reached a limited set of sales, human resources and IT systems, containing some business contact details and basic account records. It said customer conversations with Claude, model responses, source code and model weights were not accessed. It also said monitoring flagged some activity before Cathedral reported it, access was cut off the same day, and affected software was disabled until its vendors confirmed fixes.
The company said it had no evidence that anyone else exploited the vulnerabilities. That is an account of the evidence available to Anthropic, not proof that no other attempt ever occurred.
The Anthropic Slack allegation
Former OpenAI employee Will Depue wrote that he had heard Cathedral gained full administrator access to Anthropic's Slack workspace, could read every message and could log in as arbitrary users. He also claimed the labs keep all their research secrets in Slack.
Those are serious allegations. They are not independently established by the evidence available for this report. Anthropic's frontier red-team lead Logan Graham replied that Depue's facts were wrong, but did not identify the specific claims he disputed, citing sensitivity. The denial deserves the same prominence as the allegation. Neither supplies the missing permissions, logs or message inventory.
Depue's experience at OpenAI gives his warning context, but his post describes what he is hearing from sources. It does not provide the evidence those sources have seen. Graham's position carries direct relevance as a member of Anthropic's security team, yet his reply leaves readers unable to tell which particular detail he rejects. The two positions should not be flattened into a single, confident version of events.
Full Slack administration
Depue says sources told him Cathedral could read every message and log in as users. This is an unverified allegation.
The facts are wrong
Anthropic’s red-team lead disputes the account, without identifying each disputed detail. The access scope remains unresolved.
What does an administrator see?
Slack's own export guide distinguishes public-channel exports available to workspace administrators from broader exports of private channels and direct messages, which depend on plan, owner permissions and approval. A label such as administrator cannot establish by itself that every conversation was readable, or that users could be impersonated. A token or integration could carry different permissions again. The exact route and privileges here have not been published.
That does not make research conversations unimportant. It means the evidence needed to assess them is specific: the integration, its scopes, the channels reachable, and the activity observed.
Twelve hours or several days?
The Post described less than 12 hours of agent runtime in Cathedral's draft. Graham wrote that Anthropic saw several days of attempts before two third-party vulnerabilities were exploited. He said Cathedral reported one and Anthropic independently found and cut off the other.
Those clocks may measure different parts of the exercise. Without the complete chronology, neither a 12-hour total intrusion nor a contradiction between the two figures is established.
The rules of the test
Anthropic told the Post that Cathedral did not disclose all its activity and had not fully followed the testing programme's rules. Cathedral's draft said data access was kept to the minimum, according to the same report. Graham characterised the third-party activity as outside safe harbour.
Anthropic's public responsible disclosure policy excludes third-party systems and places limits on accessing data. That public document alone does not establish the terms of this particular engagement or resolve the dispute. The conditions agreed for the test, and the activity actually performed, would matter.
A path or permission could make information accessible.
A person or system viewed or otherwise touched information.
Information was exported, retained or transmitted.
Information was later applied or shared.
The 2023 OpenAI comparison
The resemblance is worth following carefully. In 2023 an intruder accessed an OpenAI employee forum containing discussion of AI technology, according to New York Times reporting summarised by SecurityWeek. The account says the attacker did not get into the systems where the company housed and built its AI.
The reporting examined for this report does not establish that the 2023 forum was Slack or that an external application's access token supplied the route. It is a comparison about sensitive workplace discussion and security boundaries, not evidence that both incidents used the same mechanism.
A different OpenAI test, in 2026
Hacktron's technical account describes a separate July 2026 assessment. Its researchers say they chained a flaw in forum software with an OpenAI sign-in issue, accessed employee ChatGPT and Codex accounts, and opened a proof-of-access pull request in an internal repository. They identified Slack and email as possible connected reach.
OpenAI told SecurityWeek that Hacktron had not verified access to employee Slack messages, and described limited reads of repository metadata and commits. Potential access and demonstrated access must stay separate in both stories.
| Incident | Published account | What remains unproved |
|---|---|---|
| 2023 | Employee forum discussions were accessed. | Slack and an external-app token as the route. |
| 2026 | Hacktron demonstrated access through a forum and sign-in chain. | That employee Slack messages were read. |
- 2023Employee forum discussions were accessed.Slack and an external-app token as the route.
- 2026Hacktron demonstrated access through a forum and sign-in chain.That employee Slack messages were read.
The strongest case for Anthropic
On its account, detection worked before the researchers' report, access was cut off and vendors repaired the affected software. Its statement also identifies important categories it says remained out of reach. Those are meaningful claims and should not be erased simply because the broader question is uncomfortable.
The company's position has a limit. Saying model weights and customer conversations were not reached does not by itself answer whether internal research discussions were accessible, how broad that access was, or what the researchers actually saw. Graham's rejection of Depue's account makes the allegation disputed; it does not supply a public technical inventory.
There is room for an organisation to contain an incident promptly and still leave legitimate questions unanswered in public. There is also room for a researcher to demonstrate a serious weakness without proving the most expansive account circulating afterwards. Both possibilities belong in the same report, because the available evidence does not force a choice between them.
Anthropic security breach: the case for scrutiny
The AI security question is larger than any single file. Research discussion can contain plans, methods and context even when the weights themselves remain protected. That is a general risk, not a finding that Cathedral obtained those things. Alex Stamos, who reviewed Cathedral's findings for the Post, described third-party connections as a broad industry problem and said Anthropic could have done better.
The national-security implications are contested. Cathedral's draft framed its findings as a warning; Anthropic said the implications were overstated. A reported weakness does not establish that a foreign government used it, or that an adversary obtained research secrets.
The practical lesson for any organisation using connected software is to know what each integration can reach. An access review can ask who owns an application, what its permissions allow, whether those permissions are still needed and how its activity is monitored. Those are sensible questions prompted by the incident, not a claim that the public record identifies Anthropic's configuration.
An inventory is only the beginning. It needs an owner who can remove unused access, a way to detect unexpected use and a plan for what happens when a supplier reports a flaw.
What would settle it?
A useful disclosure would identify the affected classes of integration, the permissions held, the categories of data demonstrably accessible, what was actually accessed, when the access existed, and how the fixes were verified. Some details may need to remain private while vendors and affected parties are protected. A clear description of the evidence boundaries can still help readers judge the scale of the event.
For now the fox can follow the trail only as far as the record goes: a real access problem, a sharp disagreement over its reach, and an unanswered question about the research conversations inside the workplace tools.
Explore related work on cybersecurity communications, AI consultancy, and how to communicate an unconfirmed AI story.
Quick answers
Did Cathedral access Anthropic systems?
Anthropic acknowledged that researchers reached a limited set of business systems through third-party vulnerabilities. The full scope is disputed.
Did Cathedral gain full Slack administrator access?
Will Depue alleged that it did. Anthropic red-team lead Logan Graham said his facts were wrong without identifying the specific claims. The allegation remains unverified.
Were Claude conversations or model weights accessed?
Anthropic says customer conversations, model responses, source code and model weights were not accessed.
Does a Slack administrator automatically see every message?
Slack documents different export permissions by role, plan and approval. The label alone does not establish access to every private message.
Was this the same incident as the 2023 OpenAI breach?
No. The 2023 event involved an OpenAI employee forum. The public reporting examined here does not establish the same access mechanism.
Sources
- The Decoder, Cathedral and Anthropic accounts
- MadRobot, reporting on the Post and the company statements
- Will Depue, claim about Slack
- Logan Graham, reply
- Logan Graham, initial statement
- Slack, workspace export options
- Anthropic, responsible disclosure policy
- Hacktron, Hacking OpenAI
- SecurityWeek, OpenAI response to Hacktron
- SecurityWeek, OpenAI 2023 incident