Cybersecurity startup Cathedral said its AI agents found paths into Anthropic’s internal business systems in less than 12 hours through weaknesses in third-party administrative and sales software. Anthropic confirmed access to a limited set of sales, HR and IT systems, but said customer conversations, Claude responses, source code and model weights were not reached. It said it had no evidence that anyone other than Cathedral exploited the flaws.
Anthropic said its monitoring flagged some activity before Cathedral reported it and that it shut off access the same day. It also said Cathedral overstated the national security implications and failed to disclose all its testing; Cathedral said it kept data access to a minimum. Anthropic disabled the affected software until vendors confirmed fixes. The vendors were not named.
