Article · AI translation
Thanks to IT Home reader 咩咩洋 for the tip!
IT Home reported on October 27 that, according to an October 26 local-time report by The Washington Post, cybersecurity startup Cathedral said its researchers used AI agents to find a path into Anthropic’s internal systems through vulnerabilities in third-party commercial software in less than 12 hours.
Anthropic subsequently confirmed that some sales, human resources and IT systems had been accessed, but customers’ conversations with Claude, model responses, source code and model weights were not affected.
Cathedral was founded by former members of the U.S. Department of Government Efficiency (DOGE). According to a draft of a report by the company that has not yet been formally released, researchers conducted the testing under Anthropic’s external security research program. By exploiting vulnerabilities in business sales and administrative software, they gained access to internal information including meeting notes, employee salary and hiring information, and Slack messages discussing advanced AI models.
Anthropic said the researchers accessed a limited set of sales, human resources and IT systems. The company said its monitoring systems had detected some of the related activity before Cathedral submitted its report, and that it cut off the researchers’ access that same day.
Anthropic also said it had disabled the affected third-party software until the relevant vendors confirmed that the vulnerabilities had been fixed, and had notified relevant U.S. federal government agencies. The company said there is currently no evidence that anyone outside Cathedral exploited these vulnerabilities (IT Home note: The names of the software vendors and details of the specific vulnerabilities have not yet been made public).