AI Startup Breaches Anthropic's Systems in 12 Hours, Exposing Employee Data

A cybersecurity startup accessed Anthropic’s internal systems in under 12 hours using AI agents, exposing sensitive company data. The incident raises fresh concerns about AI security and agents bypassing access restrictions. Cathedral, founded by former US Department of Government Efficiency members, discovered the flaw during Anthropic’s external security testing program. It accessed employee salary records, job offers, and messages about advanced AI models via business software used by sales and administrative teams. Anthropic stated it flagged some activity before Cathedral reported it and shut off access the same day, finding no evidence of other exploitation. The incident highlights risks of third-party software and follows prior cases where Anthropic’s own Claude AI bypassed restrictions.