Anthropic has confirmed that cybersecurity researchers gained unauthorized access to sensitive internal information after exploiting vulnerabilities in third-party business software connected to the AI company’s systems.
Cathedral, a cybersecurity startup founded by former U.S. DOGE Service employees, reportedly completed the intrusion in less than 12 hours while conducting research under Anthropic’s vulnerability-disclosure program.
The accessed information reportedly included internal meeting transcripts, employee compensation and job-offer records, Slack discussions about advanced AI models, and limited customer and employee data.
Anthropic said the researchers did not obtain Claude customer conversations, AI-generated responses, source code or model weights.
THIRD-PARTY INTEGRATIONS CREATED THE ATTACK PATH
The researchers reportedly entered Anthropic’s environment by finding security weaknesses in external business applications integrated with the company’s systems.
The complete technical attack chain and the names of the affected software vendors have not been publicly disclosed. Publishing those details before all affected organizations are protected could create additional exploitation risks.
Third-party applications routinely connect to corporate identity providers, document platforms, messaging services and human-resources systems. These integrations may receive broad permissions or reusable authentication tokens that allow a compromised application to access data beyond its primary function.
The incident demonstrates that an organization’s security can depend on every connected vendor—not only the systems it develops and operates directly.
INTERNAL AI DISCUSSIONS AND EMPLOYEE INFORMATION WERE ACCESSED
According to a Cathedral report reviewed by The Washington Post, the researchers accessed internal meeting transcripts and Slack conversations concerning advanced Anthropic models.
The accessed employee information reportedly included salary details and job-offer data. Limited customer and employee records were also exposed, although the number of affected individuals and the exact data fields have not been published.
Anthropic disputed some of Cathedral’s characterization of the incident and accused the researchers of overstating its national-security implications and violating parts of the company’s testing rules.
The disagreement does not change Anthropic’s confirmation that researchers entered sensitive systems and accessed internal information. However, Cathedral’s broader claims should be treated as allegations unless supported by additional evidence.
CLAUDE CONVERSATIONS AND MODEL WEIGHTS WERE NOT REACHED
Anthropic said the researchers could not access conversations between customers and Claude or the responses generated by the AI assistant.
The company also said its source code and model weights were not exposed.
Model weights are among an AI laboratory’s most sensitive assets because they contain the parameters that define a trained model’s behavior. Theft could create risks involving intellectual property, unauthorized model replication and the removal of safety controls.
There is currently no evidence that Cathedral obtained those assets or entered Anthropic’s core model infrastructure.