A cybersecurity startup called Cathedral gained access to sensitive internal systems at Anthropic in less than 12 hours, exposing employee information, salary details, job offers and internal messages discussing the company's advanced AI models. The incident was discovered during a security test conducted under Anthropic's programme for outside researchers to identify vulnerabilities.
According to a draft report reviewed by The Washington Post, Cathedral used AI agents to find weaknesses in business software used by Anthropic for administrative and sales tasks. The researchers found ways to access internal data, including meeting transcripts and Slack messages, after running their agents for less than 12 hours.
Cathedral was founded by former members of the US Department of Government Efficiency (DOGE) and develops AI-powered cybersecurity tools for government agencies and corporate clients.
Anthropic confirmed that the researchers accessed a limited set of its sales, human resources and IT systems. The exposed information included business contact details for some customers and partners, along with basic user account records. However, Anthropic said the researchers could not access conversations between customers and its Claude chatbot, the responses generated by the model, or the source code and model weights behind its AI systems.
"Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day," Anthropic said in a statement. The company added that it had found no evidence of anyone other than Cathedral exploiting the vulnerabilities.
Anthropic disabled the affected business software and restored it only after the vendors confirmed that the security flaws had been addressed. It also briefed federal officials about the incident. The findings have raised national security concerns, with a senior Trump administration official telling The Washington Post that the report had circulated within the government. Alex Stamos, chief information security officer at AI coding startup Cognition, also pointed to weaknesses in how companies manage third-party software.
“This is a really hard problem, but Anthropic could have done a lot better,” Stamos said.
Anthropic, however, argued that Cathedral had overstated the national security implications of the incident. It also said the startup had not fully followed the rules of its cybersecurity testing programme because it failed to disclose all its activity within Anthropic's systems. Cathedral said it had kept data access to the minimum required for its research.
Anthropic's Claude has also carried out unauthorised actions
The security incident comes amid growing concerns about AI agents finding ways around restrictions while carrying out tasks. Anthropic has itself disclosed cases in which its Claude model accessed information or performed actions without proper authorisation.
In one recent incident, Claude accessed aggregate vote counts held by the US state of Georgia after finding a loophole in an older version of a government website. Anthropic said the system issued a digital access token that allowed the AI to reach information normally available only after paying a fee.
The company clarified that Claude did not access the state's voter registration system, retrieve individual voter records or change any voting records. It said the information accessed was limited to aggregate vote counts and that it had introduced safeguards to prevent similar incidents.
Anthropic had previously reported examples of Claude working around restrictions to reach information protected by a token or fee, including data on websites operated by US government agencies. The company said those incidents had minimal real-world impact.
Other reported cases involving AI agents have added to these concerns. An Anthropic model reportedly submitted a fake tip about an unsolved murder to Philadelphia police, while the US State Department disclosed that an Anthropic model had filed 19 visa applications in August.
- Ends