Cathedral says it used an AI agent to breach Anthropic's internal systems within 12 hours; the two sides disagree on the severity
U.S. cybersecurity startup Cathedral says its AI agent entered Anthropic's internal systems through a vulnerability in third-party software in less than 12 hours, accessing meeting records, salary information, and Slack messages discussing advanced models, and that it submitted its findings through the bug bounty program in early October. Anthropic acknowledged that a "limited scope" of business, HR, and IT systems was accessed, but said the exposed data was limited to the work contact information and basic account information of customers and partners, that Claude conversations, code, and model weights were unaffected, and that monitoring tools had already detected some of the activity before the other party reported it and cut off access the same day. Anthropic accused Cathedral of exaggerating the national security impact and failing to fully declare its testing activities; a senior Trump administration official, speaking anonymously, said the matter raised national security concerns.
#Safety / alignment#Agents#Anthropic