Overview
- Cathedral, an AI‑driven cybersecurity startup, says its autonomous agents exploited vulnerabilities in third‑party business software to gain access to Anthropic’s systems in under 12 hours.
- Anthropic confirmed a limited exposure of sales, human resources and IT systems, said it shut off Cathedral’s access the same day, and stated that source code and model weights were not accessed.
- Cathedral reported that the agents viewed meeting transcripts, salary and job‑offer details, and Slack messages about Anthropic’s models, while Anthropic has accused Cathedral of not fully disclosing its activity under the invite‑only bug‑bounty program.
- Security experts praised Anthropic’s detection and containment but warned that true remediation requires independent verification and stressed that vendor software remains a common weak point in corporate defenses.
- The episode raises commercial and political risks for both companies because Cathedral has high‑profile investors and government ties and Anthropic is preparing an IPO, which could draw closer regulatory and national‑security review.