AI agents helped researchers find sensitive data in Anthropic's internal systems

The AI-powered breach

Anthropic, the creator of the Claude AI model, recently faced a security challenge when researchers from the startup Cathedral discovered vulnerabilities in its internal systems. The researchers utilized AI agents to scan for potential entry points, completing the task in less than 12 hours. This speed demonstrates how automated tools can rapidly identify weaknesses in complex digital infrastructures.

The security testing was conducted as part of an authorized program where outside researchers report flaws to the company. However, the discovery revealed that the company's internal data was more accessible than expected. The researchers were able to navigate through various systems to find information that most organizations would prefer to keep confidential.

While the incident was a controlled research exercise, it serves as a practical example of modern cyber warfare. It shows that the same technology used to build helpful AI can also be turned into a tool for finding and exploiting digital cracks. The speed of the discovery highlights a new era of automated vulnerability research.

Targeting everyday software

One of the most significant findings from the Cathedral report was that the researchers did not need to attack Claude itself. Instead, they targeted ordinary business applications that Anthropic uses for daily operations like customer management and administrative tasks. This suggests that the weakest link in a company's security is often the software used for routine office work.

By exploiting these third-party applications, the researchers gained access to a variety of sensitive internal documents. These included details on employee salaries, various job offers, and transcripts from internal meetings. They also managed to view internal Slack conversations that discussed the company's advanced AI models.

This distinction is important because it shifts the focus from core infrastructure to the periphery of a company's tech stack. Even if a company builds a highly secure AI model, their employees might still use less secure tools for HR or sales. These everyday tools can become unintended gateways for unauthorized access to private corporate data.

Impact and response

Anthropic acknowledged that the researchers accessed a limited number of systems related to sales, human resources, and IT. The company was quick to clarify that no customer conversations with Claude were compromised. Additionally, the core source code and model weights remained secure throughout the incident.

The company's security systems did manage to detect some suspicious activity before the researchers submitted their final findings. In response, Anthropic blocked access to the affected areas and disabled the specific applications until the third-party vendors could fix the underlying issues. They maintain that they have seen no evidence of any other malicious actors exploiting these same flaws.

Despite the company's response, the incident has drawn significant attention due to the nature of the startup involved. Cathedral was founded by former members of the US government's DOGE initiative and has secured federal contracts. This has led to discussions about the potential national security risks of such vulnerabilities, though Anthropic disputes the startup's specific characterization of those risks.

The broader security landscape

This event comes at a time when governments are increasingly worried about protecting advanced AI research from foreign intelligence and cybercriminals. The ability of AI to identify and exploit software vulnerabilities means that the barrier to entry for sophisticated attacks is lowering. Companies must now defend against tools that can think and act at machine speed.

The discovery underscores that securing the technology itself is only one part of the security puzzle. Organizations must also ensure that the entire ecosystem of tools their employees use is hardened against automated probes. As AI becomes more integrated into business workflows, the surface area for potential attacks continues to expand.

Moving forward, the industry will likely see a shift toward more rigorous auditing of third-party software. Companies may need to implement stricter controls on how internal data flows between different business apps. The goal is to ensure that a vulnerability in a simple HR tool doesn't lead to a leak of a company's most sensitive intellectual property.