A cybersecurity firm gets into internal Anthropic systems in under 12 hours, The Washington Post reports
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
The start-up Cathedral, set up by former DOGE staff, claims it took under 12 hours to slip into internal systems at Anthropic by turning AI agents on outside vendor software. According to a draft seen by The Washington Post, it reached payroll, transcribed meetings and Slack chats. Anthropic admits a limited intrusion, denies that Claude, its code or the model weights were reached and accuses Cathedral of exaggerating.
Cathedral, a cybersecurity start-up just a few months old founded by former members of DOGE (the US government's cost-cutting office), says it managed to get into internal systems at Anthropic, the company behind the Claude model, in under 12 hours, as The Washington Post reported on Monday, October 26.
The newspaper relies on a draft report by Cathedral itself, which the start-up recently shared with Anthropic. Its researchers turned AI agents on software from outside vendors that Anthropic uses for sales and to manage its staff, exploited flaws in that software and worked their way inside from there. That is how they got to salaries, job offers, meeting transcripts and Slack conversations (its internal chat) about the company's most advanced models. According to Infobae, these are tools that thousands of companies with nothing to do with artificial intelligence also use.
Anthropic acknowledges that there was access to "a limited set" of its sales, human resources and IT systems. According to the company, no one got to its customers' conversations with Claude, the code or the model weights (the numerical values that make it work); it shut the door that same day and alerted federal officials. It adds that its internal monitoring spotted part of the activity before it received the report and that it has no sign that anyone else has exploited those flaws.
The two sides tell different stories. Anthropic maintains that Cathedral overstated what this means for national security and did not tell it about all of its activity, something its bug bounty program requires. Cathedral replies that it kept its access to a minimum. The start-up sells AI-based cybersecurity to the US government and to companies, has raised $160 million and is valued at $1.4 billion, according to Infobae.
Alex Stamos, head of security at Cognition and formerly director of the Stanford Internet Observatory, reviewed the findings at the newspaper's request. He told The Washington Post, as reported by Infobae, that they had found something big, that linking third-party software is a huge problem for any company and that Anthropic could have done much better.
This is not the first case of its kind. In July, according to Infobae, three researchers from Hacktron AI got into OpenAI in under 72 hours: they started on its public developer forum and ended up in its internal code repository.
Why it matters · analysis and opinion
The case shifts attention to where an AI company needs to protect itself. The labs guard their models very carefully, but the access came through the sales, staff and messaging applications they share with any other company, which turns the problem into something that concerns everyone. The two sides' accounts do not match and each has its own interests, so it is wise to wait for the final report before judging how serious it is. What can be done now is to review which outside vendors have access to sensitive data, with what permissions and whether anyone monitors those connections. AI agents finding these gaps so quickly also makes attacks cheaper and calls for those connections to be checked more often.
Source: Infobae · Written with the help of AI: how we make the news
What does it mean for your business? · analysis and opinion
This case matters to any small business or freelancer in Spain and Latin America that relies on other companies' cloud software to sell, manage staff or chat internally, which today means almost all of them. You do not need to build AI to be exposed: according to the reports, the way in was through outside sales and human resources vendors, not the model. Those who barely connect services to one another face less risk, although not zero.
Our advice is to start with a simple list of the apps linked to company accounts and to remove permissions from the ones no longer in use. It is worth turning on two-step verification for the internal chat, email and the payroll tool, and checking who can see salaries and meeting recordings or transcripts. It is also prudent not to leave passwords or employee personal data in the chat, and to ask each vendor how and when it will notify you if it suffers an incident.
These measures cost mainly time, not money. The risk of skipping them is growing: if a few AI agents were enough to find flaws in under 12 hours, we think it is reasonable to assume that similar tools are within reach of anyone with bad intentions. And a leak of payroll or job offers involves staff personal data, with the loss of trust and the legal obligations that come with it.
