Technology
Startup Cathedral reportedly accessed Anthropic employee data and internal messages
Hacker News reports that startup Cathedral reached Anthropic's HR, sales and IT systems during a security test under Anthropic's programme for outside researchers.
The short version
- Hacker News reports that cybersecurity startup Cathedral accessed Anthropic's internal systems in under 12 hours, exposing employee information, salary details, job offers and internal messages.[Hacker News]
- A draft report reviewed by The Washington Post says Cathedral used AI agents to find weaknesses in business software Anthropic uses for administrative and sales tasks.[Hacker News]
- Anthropic confirmed access to a limited set of sales, HR and IT systems, says its monitoring flagged the activity before Cathedral reported it, and says model weights, source code and Claude customer conversations were not accessed.[Hacker News]
- Anthropic argues Cathedral overstated the national security implications and did not disclose all its activity; Cathedral says it kept data access to the minimum required for its research.[Hacker News]
Key facts
- Cathedral, an AI cybersecurity startup, reportedly accessed Anthropic's internal systems in under 12 hours.[Hacker News]
- The access was discovered during a security test conducted under Anthropic's programme for outside researchers.[Hacker News]
- Anthropic confirmed that the researchers accessed a limited set of its sales, HR and IT systems.[Hacker News]
- Anthropic says the researchers could not access Claude customer conversations, model responses, source code or model weights.[Hacker News]
- Anthropic says its monitoring flagged some of Cathedral's activity and that it shut off access the same day.[Hacker News]
What remains uncertain
- Anthropic and Cathedral dispute the scope of the access and the startup's compliance with the testing rules; Anthropic says Cathedral did not disclose all its activity, while Cathedral says it kept access to the minimum required.[Hacker News]
- The national security significance of the incident is disputed; Anthropic argues Cathedral overstated it.[Hacker News]
- Cathedral's use of AI agents and the reported exposure of employee data rest on a draft report reviewed by The Washington Post and a single outlet's reporting, not independent confirmation in the provided reporting.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.