Cybersecurity startup Cathedral discovered routes into Anthropic's internal systems by exploiting vulnerabilities in third-party software, revealing weaknesses outside the core AI infrastructure used for Claude. Cathedral's report outlined potential access to meeting transcripts, salary and job-offer information, and Slack discussions about advanced AI models. Anthropic acknowledged a narrower scope involving sales, human resources, and IT systems, while rejecting suggestions that its underlying models or customer conversations were compromised.
In contrast, Anthropic reported that researchers had been trying to breach its software for several days without success, calling the timing claim dubious. Founded by former Department of Government Efficiency staffers, Cathedral develops AI-powered cybersecurity tools for government and corporate customers. The startup's findings have highlighted the exposure of ordinary enterprise software, but the unpublished draft and undisclosed application names leave important technical questions unresolved for independent security teams worldwide.
Although the work occurred under Anthropic's bug bounty program, the company accused Cathedral of failing to disclose the full extent of its activity and therefore violating program rules. The public record delineates three distinct issues: demonstrated access to business systems, Cathedral's broader description of accessible information, and Anthropic's assertion that critical AI assets remained safeguarded. Explore the platform for your team.
