Cybersecurity Startup Cathedral Used AI Agents to Access Anthropic Systems
The cybersecurity startup Cathedral used AI agents to break into Anthropic's internal systems via third-party software. The company confirms access to sales, personnel and IT data, but disputes the portrayal of a deep intrusion.
The cybersecurity startup Cathedral used AI agents to break into the internal systems of Anthropic. According to available reports, the access was gained through third-party software and took place within a so-called bug bounty program, in which security researchers deliberately search for vulnerabilities. Anthropic confirms that data from the areas of sales, human resources and IT could be viewed. However, there are differing views on the extent of the intrusion, and the question of how far the access actually reached is disputed between the parties involved.
Anthropic is one of the best-known developers of large AI models and is regarded in the industry as one of the most capable providers in the field of cyber defense. That such a company was vulnerable through an external dependency highlights a fundamental problem for the industry. Leading AI labs also rely on a multitude of software components from external vendors, and each of these connections can become an entry point. The incident makes clear that a company's security depends not only on its own systems, but equally on all suppliers and tools integrated into its infrastructure.
The role of the technology used is particularly noteworthy. The case shows that autonomous AI agents are now capable of detecting and exploiting security gaps in complex systems. What began as a test within a bug bounty program thus illustrates a dual development: the same capabilities that make AI usable for defense can also be deployed for attacks. For companies that develop AI models and at the same time depend on their protection, the question arises of how internal data can be better shielded against automated attacks.
Whether the incident had concrete consequences for customer data or the operation of the models cannot be conclusively assessed on the basis of the information available. It is only clear that Anthropic has confirmed access to internal areas, while the parties differ in their account of the extent. The final assessment of the damage therefore remains outstanding.
5
