AI startup Cathedral breached Anthropic's internal systems within 12 hours

AI security startup Cathedral entered Anthropic's sales, human resources, and IT systems in under 12 hours, obtaining employee information, salary details, offer letters, and internal messages discussing the company's advanced models. Anthropic said the access occurred under its external researcher vulnerability identification program, that the researchers were unable to access Claude's conversations with customers, model outputs, source code, or model weights, and that the company had already detected some of the activity through monitoring before Cathedral reported it and shut down its access that same day. Anthropic also said Cathedral did not fully comply with the testing program's rules and did not disclose all of its activity within the systems, while Cathedral said it had limited data access to the minimum necessary for its research.