The Anthropic security breach exposed salaries, internal messages and business information through outside software used by the AI developer—not through access to its model weights, according to the company. Researchers from Cathedral reached parts of Anthropic’s commercial, human resources and IT systems, setting off a dispute over the testing and its national security implications.
Key takeaways
Cathedral accessed internal business systems through third-party applications.
Anthropic says customer prompts and model components were not accessed.
Affected applications stayed disabled until vendors confirmed fixes.
The companies disagree over reporting and the incident’s significance.
What the Anthropic security breach exposed
The accessed systems contained personnel records and internal communications, along with commercial information. Cathedral said AI agents used during its research found routes to meeting transcripts, salary information, job offers and Slack messages.
The affected systems also held commercial contacts for some customers and partners, as well as basic account information. Anthropic said the researchers did not reach customer prompts, model responses, source code or AI model weights.
The route ran through vulnerabilities in external administrative and business applications used by Anthropic. The vendors involved were not named. The access therefore concerned software supporting the business, rather than the model components that Anthropic said remained outside the researchers’ reach.
Cathedral carried out the testing under Anthropic’s External Researchers Program, which provides a channel for reporting vulnerabilities. Founded by former DOGE members, the startup develops AI cybersecurity tools for government and enterprise customers.
How Anthropic detected and contained the access
Anthropic said its monitoring identified some activity before Cathedral notified it, and access was cut off that same day. The response to the Anthropic security breach also included disabling the affected applications.
Those applications were restored only after their vendors confirmed that they had patched the vulnerabilities. Cutting off the researchers’ access and fixing the software were separate parts of the response.
Anthropic said it had no evidence of exploitation by anyone other than Cathedral.
Reporting dispute extends beyond the exposed data
Anthropic and Cathedral differ over the completeness of the research reporting and the incident’s national security significance. Anthropic accused Cathedral of failing to report all the activity it conducted on the company’s systems.
The Anthropic security breach illustrates a distinction between protecting AI models and securing the infrastructure around them: personnel documents, meeting records and internal messages remained exposed even though Anthropic said model components were not accessed.
Anthropic’s head of red teaming also advocated continuous security testing and redesigning software systems to reduce their exposure.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.