AI Agents Breach Anthropic Internal Systems in Under 12 Hours
Security firm Cathedral used AI agents to breach Anthropic's internal systems via third-party software vulnerabilities in under 12 hours. While Anthropic clarified that core model weights and customer conversations remained secure, the incident highlights the growing threat and efficiency of autonomous agents in automated cyberattacks.
Full Report
Contents3 sections
According to a draft report from Cathedral reviewed by The Washington Post, researchers using AI agents found a path into Anthropic's internal systems in less than 12 hours. Anthropic subsequently confirmed that Cathedral researchers accessed some data within the company's sales, human resources, and IT systems. The company stated that customer conversations with Claude, model responses, source code, and model weights were not accessed.
Researchers Breached Anthropic Systems via Commercial Software Vulnerabilities in Under 12 Hours
Per the draft report reviewed by The Washington Post, Cathedral recently notified Anthropic, the developer of the Claude chatbot, that its researchers had discovered a pathway into the AI company's internal data and messaging systems.
Cathedral was founded by former members of the U.S. Department of Government Efficiency (DOGE) and provides AI-driven cybersecurity tools to government and enterprise clients. The report states that the researchers exploited vulnerabilities in commercial software used by Anthropic and many other companies for administrative and sales operations.
After running AI agents for less than 12 hours, the researchers identified a path to access Anthropic's internal data. According to Cathedral's report, this data included meeting notes, compensation and job offer details, and Slack messages discussing Anthropic's advanced AI models. Cathedral conducted these tests through one of Anthropic's security testing programs, which allows external cybersecurity experts to test the company's systems.
In a statement, Anthropic confirmed that Cathedral researchers accessed "limited data" within the company's sales, HR, and IT systems. The company said the content accessed included some business contact information for customers and partners, as well as basic user account records.
Anthropic also stated that the researchers could not access messages sent by customers to the AI models, the responses returned by the models, or the code behind the company's AI systems, including the "model weights." Consequently, the meeting notes, compensation information, and Slack messages mentioned in Cathedral's report do not fully align with Anthropic's description of the actual scope of access.
Anthropic noted that its monitoring systems detected some of the activity before Cathedral reported it, and the company revoked the relevant access permissions on the same day. The company also stated there is no evidence that anyone outside of Cathedral exploited these vulnerabilities.
Vulnerabilities Originated in Third-Party Software; Disputes Over Disclosure Process
Cathedral disclosed the findings through Anthropic's cybersecurity testing program, which rewards security researchers who report vulnerabilities. The draft report states that Cathedral also notified the relevant commercial software vendors but did not publicly identify these companies due to security concerns.
Anthropic said it disabled the affected commercial software until the vendors confirmed the vulnerabilities had been patched, at which point it re-enabled the software. Cathedral's report claimed that the researchers "minimized data access to the absolute minimum necessary, in accordance with best practices for security research."
The two parties also disagree on whether the testing process adhered to the program's rules. Anthropic argued that Cathedral exaggerated the "national security implications" suggested by these findings and claimed the startup did not fully disclose all its activities within Anthropic's systems, thereby failing to fully comply with the bug bounty program's rules.
A Cathedral spokesperson declined to comment. Sources close to the company said the researchers attempted to access Anthropic's systems to highlight the security challenges facing leading U.S. AI developers. Due to the sensitive nature of the findings, the sources requested anonymity.
Alex Stamos, Chief Information Security Officer at AI coding startup Cognition, reviewed Cathedral's findings at the request of The Washington Post. He stated, "They found a very serious problem." Stamos previously served as director of the Stanford Internet Observatory under the Stanford Center for Cyber Policy.
Stamos believes the risks associated with connecting third-party applications to corporate systems are a "massive problem for everyone." He said Cathedral's findings exposed "gaps" in how Anthropic manages the use of external software vendors, noting, "This is a very difficult problem to solve, but Anthropic could have done much better." Cognition uses models from Anthropic and other AI companies.
Incident Raises Concerns About AI Company Security Defenses
Cathedral's findings have renewed attention on the security risks posed by AI companies' reliance on third-party enterprise software. Vulnerabilities in standard commercial software can serve as entry points for attackers into the internal systems of major tech companies. In its draft report, Cathedral stated that this incident "reveals a critical gap: emerging attack capabilities are advancing faster than defensive measures."
The report further wrote: "The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of the most advanced organizations should be a wake-up call for every company."
Earlier this month, the FBI arrested an employee of OpenAI, the developer of ChatGPT, suspected of placing recording devices in an executive conference room. Last month, hackers who had used Anthropic's Claude chatbot to breach OpenAI's systems warned that the AI industry is not yet prepared to handle the security risks posed by its own technology.
Founded by former DOGE members, Cathedral is seeking government contracts and private sector opportunities. Investors value the company at $1.4 billion. Cathedral co-founder Gavin Kliger served as the Pentagon's Chief Data Officer after his tenure at DOGE.
According to data firm PitchBook, Cathedral has raised $160 million from investors. Prominent investors Marc Andreessen and Shaun Maguire both sit on the company's board.
Anthropic employee Jacob Coxon publicly resigned last month. He expressed concern that Anthropic was not being sufficiently responsible in handling dangerous AI technologies, including its reliance on traditional commercial software. Posting on X, he stated that the company had made "an arrogant bet, and it shouldn't have started from a private company's Slack." Slack is a commercial messaging tool used by Anthropic and many other tech companies.
Source: