AI Agents Breach Anthropic's Business Systems Within Hours

AI Exploits Vulnerabilities in Anthropic's Systems

A cybersecurity startup, Cathedral, has reported that its AI agents successfully infiltrated Anthropic's internal business systems in under 12 hours by leveraging weaknesses in third-party administrative and sales software. This software is commonly used by various companies for customer tracking and staff management.

Anthropic has acknowledged that the breach affected a limited range of their sales, HR, and IT systems, but assured that critical components such as customer conversations, Claude's AI responses, source code, and model weights were not compromised. The company stated, "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day."

Cathedral, established by four former members of the Trump administration's Department of Government Efficiency, had raised $160 million at a valuation of $1.4 billion earlier this year. Their testing methodology resembled a bug bounty program, where external experts are rewarded for identifying flaws rather than exploiting them. Their AI agents uncovered access to sensitive information including meeting transcripts, salary details, and internal communications about Anthropic's AI models.

Despite the breach, Anthropic criticized Cathedral for exaggerating the national security implications of the incident and claimed that the startup did not adhere to all guidelines of their testing program. Cathedral countered that they maintained a strict limit on data access in accordance with security best practices.

Concerns regarding national security have been raised, with an anonymous senior Trump administration official commenting on the ease of the breach, suggesting that if Cathedral could achieve this, similar threats could come from state-sponsored actors. This follows previous incidents where Anthropic's technology was reportedly exploited by Chinese hackers in attacks on multiple organizations.

In response, Anthropic has temporarily disabled the affected software until the vendors implement necessary fixes, though those vendors have not been publicly identified.