When you set up corporate login for a new administrative, sales, or HR tool, or click to grant it access to Slack and GitHub, it is easy to treat it as a peripheral office utility. Even if those edge tools have issues, they seem isolated from production servers, core repositories, and model weights. That default assumption is common in everyday engineering work. Recently, however, Anthropic and OpenAI, two of the highest-spending AI companies on security in the world, both stumbled on peripheral software that nobody usually watches. Cybersecurity is an interconnected whole. Once companies weld steel plates across the front doors of their core data centers, attacks naturally flow like water around the frontal defenses and enter the internal network through lightly guarded HR tools, public forums, and legacy authorizations.
In late October, an investigative report by The Washington Post brought an external security test against Anthropic into public view. Cathedral, a cybersecurity startup founded just a few months ago, used AI agents to probe Anthropic’s security defenses. Anthropic’s red-team lead disclosed in a public statement that the agents initially tried to storm the front gate like other attackers, spending several days directly targeting Anthropic’s proprietary core software, and failed every time. Top AI labs clearly maintain tight frontal defenses around their core systems, making direct front-door breakthroughs difficult for external attackers.
Blocked at the front gate, the attack immediately flowed like water toward the thinnest part of the perimeter. The agents pivoted to test third-party commercial software that Anthropic used for daily administrative, sales, and human resources management, and quickly found two security vulnerabilities. To sync routine business data, these office applications already held integration permissions connected to internal company systems. Following those existing cross-system channels, the agents accessed partial meeting audio transcripts, employee salary and offer letter details, basic business contact information for customers and partners, and a subset of internal Slack messages in under 12 hours. After reviewing a draft of the report, Alex Stamos, chief information security officer at the security firm Cognition, pointed out directly that the core issue came down to connecting third-party applications to internal company systems.
Over a longer timeframe, Anthropic was not the first victim. In another incident disclosed a month earlier, OpenAI also suffered from edge systems and authorization workflows. When a peripheral website or HR tool falls, how does it connect all the way to core assets?
Look back at the
postmortem on how three legacy authorizations reached OpenAI’s internal
repository. In late July, three researchers from Hacktron testing
OpenAI bypassed the layered defenses around the training clusters and
aimed directly at the image upload endpoint on the public developer
forum community.openai.com. When processing images, the
forum relied on the underlying open-source image library
libheif. The researchers manually located a years-old
memory flaw in that library, then used Claude Opus 5 to help write the
exploit code, gaining remote code execution on the forum server along
with backend administrative privileges.
Although the forum backend seemed far removed from the core research
environment, the researchers next found two internal channels running in
daily operations. The first hop was single sign-on, the unified login
mechanism that lets employees sign in once with their main corporate
account and open various internal tools directly. The public forum did
not maintain a separate account table; it hung directly off the
company-wide unified login system. Using synchronized login sessions,
the testers took over an internal engineer’s ChatGPT and coding
assistant Codex accounts without any interaction from the target
employee. The second hop was tool connectors, the authorization channels
that allow one application to read and write data in another. Following
routine development habits, that engineer had bound personal GitHub
write permissions to Codex. The researchers used that connection to
create a branch and submit a pull request directly in the core code
repository openai/openai.
Similar vulnerabilities are pervasive in office environments. In late July, the security organization Zenity also disclosed the AgentForger vulnerability in ChatGPT workspaces. By luring a user into clicking a malicious link, an attacker could quietly create a controlled agent inside the workspace that inherited the permissions of all office tools connected to that account. Large companies put the strongest locks on core data centers, model weights, and production databases, yet for daily convenience they use unified login and tool connectors to link HR software, sales spreadsheets, public forums, Slack, and code repositories into a set of interconnected vessels joined at the bottom. The true security waterline of the entire internal network ultimately depends on its weakest peripheral software.
At this point, a natural question arises: if the entry points were third-party software vulnerabilities and the pathways were existing legacy authorizations, how is this any different from traditional penetration testing? What did AI actually change?
First, AI has undeniably grown stronger at cracking individual vulnerabilities on the front lines. In late October, for instance, the PHP Foundation patched two critical 9.2-score kernel remote code execution vulnerabilities in an official security advisory. The underlying memory cleanup flaw had been reported as early as 2020 and raised again in subsequent audits, but it sat unfixed for years because it appeared too difficult to exploit. In late July of this year, the security firm Calif was invited to conduct an audit and used AI to write an unauthenticated remote code execution proof of concept in just two weeks. That shows AI is genuinely advancing in single-point frontal breakthroughs.
Because threats on the main battlefield are so visible, enterprises naturally invest heavy resources to harden core systems and patch vulnerabilities in trunk services. Yet cybersecurity is a systems-level contest where both human hackers and AI agents instinctively seek the easiest path with the weakest defenses. In the past, peripheral software escaped unscathed mainly because top security researchers’ time was too expensive. Human red teams focused their energy on core business systems; almost nobody spent weeks turning over dozens of procured administrative tools, contractor-maintained microsites, and legacy authorization chains one by one.
The arrival of AI changed the economics of perimeter reconnaissance. In mid-October, the security organization NorForge published a report, alongside coverage from Reuters, detailing a wave of mass intrusions launched with the open-source multi-agent collaboration platform Cairn. Researchers found more than 20 attacker-operated Cairn control panels exposed on the public internet. In one of the most active clusters, the operator gave the agents targets and tactics in under 100 words, and the agents automatically gathered intelligence, located peripheral admin panels, recorded leads on a shared blackboard, and iterated through trial and error. Those agents attempted to breach more than 1,200 sites and compromised over 100 companies, including agricultural machinery giant John Deere, home appliance maker SharkNinja, and engine manufacturer Cummins. Each successful breach took roughly one day of probing on average, with the entire campaign costing about $5,000 in total, or roughly $50 in compute per compromised company, mostly hitting standalone product support sites or peripheral websites run by third-party vendors.
Looking back at Hacktron and Cathedral, the pattern is identical. Hacktron used models to compress a memory-layout tuning task that would take a senior engineer several days into a few hours, with an API bill under $3,000; Cathedral’s agents hit a wall in front of Anthropic’s core systems for days, then pivoted to sweep the peripheral software in less than half a day. As Anthropic’s red-team lead noted, models that trail the frontier by half a generation to a full generation can now scan an enterprise’s external software dependencies around the clock and chain together attack paths. Once the front iron gates are bolted shut, AI agents flow like water across every peripheral interface, and if even one window is left ajar, water pours into the internal network.
When attacks seep in like water through the softest perimeter, defenders cannot just weld more steel plates onto the front gate. No team can eliminate every vulnerability across dozens of external software vendors, but teams can install three floodgates at the pipe junctions of those interconnected vessels so a small leak at the edge does not flood the entire internal network.
Install the first floodgate on unified login by segmenting trust domains by security tier. For convenience, many companies use a single undifferentiated login session across public community forums, external marketing pages, edge administrative tools, and core code repositories. OpenAI remediated its breach in roughly a dozen hours, and its central move was tightening the credential scope of the community forum, revoking affected user credentials and sessions in bulk, and severing the link that allowed a direct jump from an edge forum into the internal R&D environment. Low-security edge applications can still use unified accounts, but they should never share the same session pass as the core internal network.
Install the second floodgate on tool connectors by assigning least privilege under the assumption that the vendor will be breached tomorrow. When employees connect third-party applications to Slack, Feishu, GitHub, or internal agents, they often check full read-write access for convenience and issue long-lived authorization tokens. Before approving or configuring each connector, teams should ask a simple question: if this third-party HR or sales tool is compromised tomorrow, what can an attacker take or modify inside our network through this pipe? Cutting unnecessary write permissions down to read-only and narrowing company-wide wildcard authorizations to individual projects keeps the water contained in a local compartment when the perimeter fails.
Install the third floodgate at the internal data access checkpoints by monitoring abnormal pull behavior. Since an enterprise cannot guarantee zero vulnerabilities across dozens of external vendors, it must enforce rate limits and independent alerts at the checkpoints where those vendors pull data from internal systems. Although Anthropic could not prevent the third-party office software from having vulnerabilities of its own, the testers reported only one of the two vulnerabilities they exploited; Anthropic’s internal monitoring independently caught the anomalous activity on the second channel and shut it down proactively. Acknowledging that peripheral software will develop cracks, and building watertight bulkheads at the entrances to internal core assets, is the most practical defense against automated perimeter intrusion.
