The cybersecurity start-up Cathedral says it identified, in less than 12 hours, vulnerabilities in third‑party software used by Anthropic, the publisher of the Claude model. The company confirms limited access to certain internal systems, but asserts that user conversations and its model components were not accessed.
AI agents, that is, programs capable of chaining multiple tasks in an automated manner, can accelerate both vulnerability research and attack capabilities. According to a preliminary report by Cathedral, a young cybersecurity firm, its researchers found pathways into several internal Anthropic systems in less than 12 hours. Consulted by the Washington Post, the document mentions potentially accessible information, including meeting minutes, salary data, and Slack exchanges related to the company’s advanced AI models.
Anthropic notes that the researchers had spent several days trying, without success, to penetrate its software directly. They then turned to vulnerable third‑party professional applications. The “less than 12 hours” therefore refers only to the successful research phase, not to the total attempts. According to the published information, access was not gained by attacking Claude or its training infrastructure directly, but by exploiting software used for commercial and administrative activities. The vendors of those software have not been publicly identified.
A disclosure program at the heart of the case
Cathedral was founded by former members of the Department of Government Efficiency (DOGE), the Trump administration agency tasked with cutting public spending. The company develops AI‑based cybersecurity capabilities, notably for government use. It says it conducted its research under Anthropic’s vulnerability disclosure program, which permits external researchers to test certain protections and report discovered flaws, and states it communicated its findings to the publisher and the affected vendors.
A contested scope
Anthropic acknowledges that the researchers reached a limited perimeter of its commercial, human‑resources and IT systems. Professional contact details of clients and partners, as well as basic information on certain user accounts, were accessible. However, the company asserts that user conversations with Claude, model responses, source code and trained parameters were not accessed. It notes that its monitoring mechanisms had detected part of Cathedral’s activity before the researchers’ disclosure, that it cut the accesses the same day and disabled the affected software pending fixes by their vendors. It finally states it has no evidence that other actors exploited the same vulnerabilities.
The two companies differ on the interpretation of the incident. Cathedral frames its findings as a warning about emerging offensive AI capabilities. Anthropic, on the contrary, believes the start‑up overstated the implications of its discoveries for national security, and accuses it of failing to report all of its activities in accordance with the research program’s rules. The published information does not, at this stage, allow a conclusion that Anthropic’s models were compromised. It does, however, establish that limited access to professional applications can expose sensitive information.
