Anthropic Restored Apps After Cathedral Agents Found Paths to Staff Records

Cathedral, a cybersecurity research group, reached some of Anthropic’s business, personnel and IT environment through flaws in outside apps, and said its agents identified paths to internal records.

Anthropic’s systems also contained employee records and internal messages, along with customer and partner contact information and basic account details. Cathedral described its agents finding routes to meeting transcripts, salary data, job offers and Slack conversations. The affected systems included parts of Anthropic’s commercial, human resources and IT functions.

Company alerts surfaced some of the activity before Cathedral filed its notification, Anthropic said. Anthropic ended the researchers’ access that day and took the affected applications offline. Vendors later verified that fixes were in place, after which Anthropic returned the applications to service. Anthropic said it had not identified signs that a separate party used the flaws.

The test took place through Anthropic’s program for external security researchers, which gives participants a way to report software weaknesses. Anthropic alleged Cathedral did not disclose every action its researchers took in Anthropic’s systems. The companies also disagree over whether the test had national security implications.

Anthropic maintained the exercise did not touch prompts sent by its customers, the model’s replies, proprietary code or the weights underlying its AI models.