Startup Blog for First Time Entrepreneurs who Bootstrap

Cathedral Anthropic: The Bug Bounty Rules Dispute, and How a Small Startup Lets Security Researchers Test Safely

TL;DR: What is the Cathedral Anthropic rules dispute?

Cathedral tested Anthropic through its paid researcher programme and says its AI agents found paths in within 12 hours via third-party sales and admin software. Anthropic says Cathedral did not disclose all of its activity; Cathedral says it kept data access to the minimum. The startup lesson: write your testing rules down first, publish a vulnerability disclosure policy and a security.txt file, and check every report against your logs.
Developing story. Last updated 27 Oct 2026, 07:35 CET. We'll update this article as Anthropic, Cathedral and the software vendors publish more.
The Cathedral Anthropic security test made headlines on 26 October 2026, when The Washington Post reported that a young AI security startup had reached part of Anthropic's internal business systems. The hub has the full story; this article covers the rules fight underneath it, and how a small startup can invite hackers in safely.

What we know so far

  • Earlier in October 2026: Cathedral reports its findings through Anthropic's paid researcher programme, which works like a bug bounty; the exact date isn't public.
  • The test: after days of failed attempts on Anthropic's own software, Cathedral's AI agents found paths in within 12 hours through unnamed third-party admin and sales software.
  • Anthropic's account: access reached a "limited set" of sales, HR and IT systems. Claude conversations, source code and model weights were not accessed, and access was cut the same day.
  • 26 Oct 2026: The Washington Post publishes the story from a draft Cathedral report; Decrypt and others follow.

What we don't know yet

  • Which vendors and flaws were involved, and whether all their customers are patched.
  • What the programme rules asked Cathedral to report, and which activity went unreported.
  • Whether any data left Anthropic's systems.
  • Whether Cathedral's final report will match the draft.

Why are Anthropic and Cathedral arguing about the bug bounty rules?

Both sides agree Cathedral was invited to test, found a way in and reported it. The split is about conduct. Anthropic told the Post that Cathedral did not fully follow the programme's rules because it did not disclose all of its activity, and that it overstated the national-security angle. Cathedral's draft says "data accesses were kept to the absolute minimum".
Here is why that matters to you. A bug bounty is a written deal with strangers: you treat good-faith testing as research, they stay inside agreed lines and report everything. When the lines are vague, an honest test becomes a public he-said-she-said. Anthropic had one advantage: "Our monitoring flagged some of Cathedral's activity before they reported it to us." And when the weak spot sits at a supplier, as in the October 2026 Vanden Broele hack, follow our 72-hour plan for a supplier data breach.

What is the difference between a vulnerability disclosure policy and a bug bounty?

A vulnerability disclosure policy (VDP) is a public page that tells outsiders how to report a security flaw, what they may test and what you promise in return. A bug bounty adds money for valid findings, which brings more testers and more reports. The EU's Cyber Resilience Act names bug bounty programmes as one way to reward people who report flaws.
Start with a VDP and add money later, through your own page or a platform such as Intigriti, YesWeHack or HackerOne. Cathedral's case shows a bounty also attracts well-funded teams whose AI agents work fast, so your rules have to hold up at machine speed.

What belongs in scope, and what must stay out?

Scope is the list of systems a researcher may test, and you can only authorise what you own or control. Your CRM, HR, payroll and invoicing tools belong to their vendors, the same kind of software Cathedral used to get in.
  • In scope: your domains, web and mobile app, API, and a test environment you set up.
  • Out of scope: third-party SaaS (point to each vendor's security page), your staff (no phishing or calls), denial-of-service tests, and other customers' accounts.
Add one line most policies forget: if you find a way into a vendor's system, stop and tell us. To see which apps hold your salaries and client data, use the 60-minute check in our guide to the small business apps behind the Cathedral Anthropic hack.

Which rules of engagement keep a security test from turning into a dispute?

  1. Disclose all activity. Every report includes a log of systems, accounts, timestamps and IP addresses.
  2. Stop at the first proof. No moving sideways.
  3. Set data limits. View the least real data that proves the flaw, such as one record, and keep nothing.
  4. Keep staff data off limits: salaries, HR files and internal chats.
  5. Use test accounts with a marked email address, so tester traffic stands out in your logs.
  6. Put AI agents under the same rules, logged and under your rate limit.

What does safe-harbour wording look like?

Safe harbour is your promise to treat rule-following researchers as authorised, with no lawsuits or police reports. The Cyber Resilience Act itself notes that researchers in some EU countries face criminal and civil liability. Sample wording to adapt:
If you make a good-faith effort to follow this policy, we will consider your research authorised and take no legal action against you. This covers only the systems in scope and only activity you report to us in full.
The last clause ties safe harbour to full disclosure, the point Anthropic says Cathedral missed. Ask a lawyer in your country to read it once.

How do you publish a security.txt file?

security.txt is a plain text file defined in RFC 9116 (IETF, April 2022) that tells researchers where to send reports. Put it at /.well-known/security.txt, serve it over HTTPS, and include the two required fields, Contact and Expires. The RFC recommends an Expires date less than a year ahead.
Contact: mailto:security@example.com
Expires: 2027-10-26T23:00:00Z
Policy: https://example.com/security-policy
Preferred-Languages: en, nl
If your website builder blocks that folder, list a security@ address in your footer.

What should you do when a researcher reports a flaw?

  1. Reply within 3 working days (our suggested target).
  2. Check the report against your logs. Gaps between the two are where disputes start.
  3. Contain first: revoke a token, disable a connector or reset an admin password.
  4. Tell the vendor if the flaw sits in a tool you use. The Ogi Networks breach showed the customer still carries the blame.
  5. Check GDPR. Article 33 sets 72 hours to notify your data protection authority of a personal data breach, unless it is unlikely to put people at risk. See our GDPR guide for startups.
  6. Fix, retest and credit the researcher, and agree a publication date together.

Does the EU Cyber Resilience Act require a vulnerability disclosure policy?

Yes, for makers of products with digital elements, from 11 December 2027. The Cyber Resilience Act (Regulation (EU) 2024/2847) entered into force on 10 December 2024, and Annex I obliges makers to "put in place and enforce a policy on coordinated vulnerability disclosure".
Reporting already applies. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents to their national CSIRT and ENISA: an early warning within 24 hours and a notification within 72 hours, according to the Commission's CRA summary. Micro and small enterprises can't be fined for missing the 24-hour deadline.
Web-only SaaS sits outside the CRA: the regulation excludes cloud services designed outside a product maker's responsibility and points to the NIS2 Directive for SaaS security rules. A mobile app, desktop software or connected device with its cloud backend is in scope.

What this means for you: steps that are safe to take now

  1. List what you own for your scope, and every SaaS tool you use for the out-of-scope list.
  2. Publish a one-page VDP and security.txt with scope, rules, safe harbour and response times. Our cybersecurity guide for non-technical entrepreneurs helps if you start from zero.
  3. Turn on logging for admin logins and API use.
  4. Review AI agent access to email, CRM and payroll. Read our GDPR questions to ask before an AI agent reads your customer email.
  5. Patch your own site with our no-developer PHP vulnerability plan.
  6. Write scope and data limits into the contract when you hire a penetration tester.
Building your first startup on a budget?

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder and a community of founders.

👉 Start the game

More on this story

FAQ: Cathedral Anthropic and bug bounty rules

What happened between Cathedral and Anthropic?

Cathedral says its AI agents found paths into Anthropic's sales, HR and IT systems within 12 hours via third-party software, during Anthropic's paid researcher programme.

Did Cathedral break Anthropic's bug bounty rules?

Anthropic says Cathedral didn't disclose all of its activity, so it didn't fully follow the rules. Cathedral says it kept data access to the minimum. Neither has published the rules.

Does a small startup need a paid bug bounty?

Start with a vulnerability disclosure policy and security.txt. Add a paid bounty once someone can answer every report within days.

Should third-party SaaS be in my bug bounty scope?

No. You can only authorise testing of systems you own or control, so point researchers to each vendor's security page.

Does the EU Cyber Resilience Act apply to SaaS startups?

Web-only SaaS is outside it. Apps, desktop software and connected devices are in: reporting since 11 September 2026, a disclosure policy from 11 December 2027.
2026-10-27 07:31 Startup News and Trends