Cathedral, a young security company, used AI agents to get into Anthropic's internal systems through Anthropic's own bug bounty program, which invites outsiders to hunt for flaws. The agents did not attack Claude. They found weaknesses in business software that Anthropic buys from other companies, and through it reached meeting transcripts, salary data and Slack messages. Anthropic confirms access to a limited set of sales, HR and IT systems and holds that customer chats, source code and model weights were never exposed. How far Cathedral really got is disputed.
A vendor's tool holds a key to your data
When you connect an app to your email, your customer list or your shared drive, you hand it a key. The app now holds that key all day, and it is only as safe as the company that built it.
In August 2025, attackers stole the keys held by Drift, an AI chat tool that companies put on their websites. They used those keys to read customer records stored in Salesforce, and possibly more than 700 organizations were affected. None of those organizations was broken into one by one. One vendor was, and it held a key to all of them.
Target, Drift and Anthropic are three versions of the same story. Nobody attacked the strongest part of the company. They went to the tool next to it that held a key.
AI removes the reason small firms were safe
Testing a vendor's tool takes patience. Someone has to read how its login works, try its sign-up and reset pages, and see what a stolen or guessed key would open. That is skilled, slow work, and it is why attackers spent it only on rich targets.
An agent does the same reading and trying without being paid by the hour. Anthropic red teamer Logan Graham made the point after the breach: attackers already run agents around the clock against outside dependencies, and models a generation behind the best ones are good enough. My estimate is that a tool which cost a skilled person a couple of days to test now costs an agent a few hours of cheap computing. A company with fifteen connected tools used to be a month of someone's work. Now it is one night.
So being too small to bother with stops protecting you. The attacker no longer chooses between you and a bigger prize, because both can be tried.
An hour with your own list
Picture a 60-person distributor. Over the years it has connected payroll, an e-signature service, a customer database, a shipping-label tool, a chat widget on its website and an HR portal. Each one can reach something: staff salaries, customer addresses, signed contracts. Nobody has ever written the list down.
Writing it down is the first hour, and it is worth more than any new product. For each tool, note what it can reach and who has admin rights. Delete the ones nobody uses, because an app that is forgotten still holds its key. Make every admin account ask for a second step when it signs in. Cut each tool's permissions to what it actually needs. Then ask the vendor how it tests its own security, and treat a vague answer as an answer.
The same agents work for defenders, which is what Graham's advice to red team yourself all the time comes down to. A small firm cannot run that, but it can paste its tool list into an AI assistant and ask, for each one, what is the worst thing an attacker could reach through it. Anthropic is probably as well equipped to defend itself against AI as any company, and it was still reached through vendor software, so a small business should assume its own vendors have the same kind of door.