Startup says it broke into Anthropic's systems; Anthropic disputes timing

A young AI startup called Cathedral says it broke into Anthropic's internal network in less than 12 hours. Anthropic, the company behind the Claude chatbot, confirms a break-in happened but disputes the timing. It also says the most sensitive things, like user chats and source code, were not touched.

What happened

Cathedral was founded this year by former staff of the US Department of Government Efficiency. It says it got in as part of a bug bounty program. That is a program where a company invites outsiders to hunt for security flaws. The Washington Post reported the story first.

The exposed data included Slack messages, meeting transcripts, staff salaries and job offers.

What Anthropic says

Anthropic says Cathedral reached only a limited set of sales, HR and IT systems. The company disputes the 12-hour claim and says the effort involved attempts over several days. It also says Cathedral went substantially beyond the bounty program's rules by targeting third-party applications.

• No conversations between users and Claude were accessed.
• Claude's source code was not compromised.
• Anthropic's monitoring flagged some of the activity before Cathedral reported it.
• Access was shut off the same day.

Why it matters

Security researchers said this was not a clever AI attack. They called it a basic hygiene failure involving third-party software that Anthropic uses. Heath Mullins of the security firm ExtraHop described it as a supply-chain attack. That means attackers go through a tool or vendor a company relies on, instead of attacking the company head on.

His broader point is the one for everyday businesses. Many organizations now build their workflows on a small number of AI platforms. If one of those platforms is compromised, the problem can spread to everyone downstream.

A senior Trump administration official, speaking anonymously, said that if a group of people who just started a company can do this, the Chinese may not be far behind.

The timing

The news came just hours after Anthropic filed for its initial public offering, the step that lets a company sell shares to the public. The IPO is expected to be the biggest listing in history, exceeding the $1.8 trillion valuation of Elon Musk's SpaceX.

What to do

If your team relies on one AI provider, ask how that company and its own vendors protect your data. This incident shows that weak spots can sit in the everyday software around an AI product, not in the AI itself.