IT Home On October 27, according to a report by the Washington Post on October 26 local time, cybersecurity startup Cathedral said that its researchers used an AI agent to find a way into Anthropic’s internal system within less than 12 hours through vulnerabilities in third-party commercial software.
Anthropic subsequently confirmed that some sales, human resources, and IT systems were accessed, but the customer’s conversations with Claude, model responses, source code, and model weights were not affected.
Cathedral was founded by a former member of the U.S. Department of Homeland Security (DOGE). According to a draft report from the company that has not yet been officially released, researchers conducted tests under the Anthropic’s external security research program, exploiting vulnerabilities in enterprise sales and administrative management software. They accessed internal information such as meeting minutes, employee salaries and hiring details, as well as Slack messages discussing advanced AI models.
Anthropic said that the researchers had access to a limited range of sales, human resources, and IT systems. The company stated that its monitoring system detected some related activities before the report was submitted to Cathedral, and it revoked the researchers' access rights on the same day.
Anthropic also stated that the company has stopped using the affected third-party software until the relevant suppliers confirm that the vulnerabilities have been fixed and notify the relevant federal government departments in the United States. The company said there is currently no evidence that anyone other than Cathedral has exploited these vulnerabilities (IT Home note: The names of the software suppliers and specific vulnerability details have not been made public).