Cybersecurity startup Cathedral reported that its researchers gained access to internal systems at Anthropic. The breach occurred in less than 12 hours by exploiting vulnerabilities in third-party commercial software used by the AI company.
Anthropic confirmed that the incident affected specific sales, human resources, and IT systems. The company stated that customer conversations with Claude, model weights, source code, and model responses remained secure and were not compromised during the event.
According to a draft report from Cathedral, the researchers accessed internal data including meeting minutes, employee salary details, recruitment information, and Slack messages discussing advanced AI models. The testing was conducted under Anthropic's external security research program.
Anthropic's internal monitoring systems detected the activity before the report was submitted, leading to the immediate termination of the researchers' access. The company has since disabled the affected third-party software until the vendors confirm that the vulnerabilities are resolved.
The company has notified relevant US federal authorities regarding the incident. Anthropic stated that there is currently no evidence suggesting that any parties other than Cathedral exploited these specific software vulnerabilities.
