AI startup breaches Anthropic in 12 hours during security testing, obtaining employee information and internal messages

In Anthropic's security testing for external researchers, the security startup Cathedral used an AI agent to find weaknesses in its business software in under 12 hours, reaching employee information, salaries, offer letters and internal messages discussing advanced AI models. Anthropic confirmed that the other party accessed some sales, human resources and IT systems, including some customers' and partners' business contact details and basic account records, but could not access Claude conversations, model responses, source code or model weights. Anthropic said monitoring had flagged some of the other party's activity before it was reported and cut off access the same day, found no evidence that anyone else exploited these vulnerabilities, and accused Cathedral of exaggerating the national security impact and failing to disclose all of its testing activity; Cathedral said data access was kept to the minimum necessary. A senior Trump administration official told The Washington Post that a related draft report was circulating within the government.