The security start-up Cathedral has, according to its own report draft, used AI agents to break into internal systems of Claude developer Anthropic via third-party business software as part of Anthropic's bug bounty program. The Washington Post was able to review the report. According to it, Cathedral gained access to internal data and messaging systems.
What Anthropic confirms
Anthropic confirms access to a limited selection of sales, HR and IT systems, including contact details of individual customers and partners and basic user account data. According to the company, chats with Claude, source code and model weights remained inaccessible to the researchers. Anthropic says it closed the affected access on the day of discovery, disabled the third-party programs until repaired, and informed US federal authorities.
Conflicting accounts
The accounts diverge on duration and scope. According to the report, Cathedral says it needed under twelve hours to find access routes to meeting transcripts, salary data, job offers and Slack messages. Anthropic red-teamer Logan Graham counters that the attackers first spent several days testing Anthropic's own systems before switching to the third-party software. There, two vulnerabilities were exploited, but only one was reported. Anthropic says it discovered and closed the second one itself. Graham accuses the start-up of exceeding the program's safe harbor commitment through incomplete disclosure, the exploitation of third parties and data retrieval. Cathedral says it adhered to usual security research standards.
Regarding the scope of data viewed, there is an additional unconfirmed claim: former OpenAI employee Will Depue asserts that Cathedral obtained full administrator access to the Slack workspace and could log into arbitrary accounts. Graham disputes this, pointing to the sensitivity of the matter, without giving details.
Assessment
Alex Stamos, chief security officer at AI start-up Cognition, which itself uses Anthropic models, told the Washington Post that the findings are significant: embedded third-party apps are a major problem, and Anthropic could have better secured its external services. For companies connecting AI providers through third-party software, the case could mean scrutinizing supply chains and external dependencies more strictly. Which data was actually affected has not yet been independently verified.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
