Skip to content

Back to the catalog

Anthropic security breach exposed salaries and messages, not model weights
en.cryptonomist.charticle

Anthropic security breach exposed salaries and messages, not model weights

Anthropic security incident in which researchers from the startup Cathedral reached Anthropic's commercial, HR and IT systems through vulnerable third-party administrative applications. Exposed data included salaries, job offers, meeting transcripts and Slack messages; Anthropic says customer prompts, source code and model weights were not accessed. Anthropic cut access the same day and kept the apps disabled until vendors patched. The companies dispute whether Cathedral reported all its activity.

TL;DR Researchers testing under Anthropic's external program reached HR and business data via vulnerable third-party apps, but not model weights or customer prompts.
Open original ↗

Organisations named here

  • Cathedral
  • DOGE
  • External Researchers Program

Technologies named here

  • AI agents
  • Slack
  • Anthropic
  • External Researchers Program

Techniques named here

  • Continuous security testing
  • Exploitation of vulnerabilities in third-party applications

Concepts named here

  • Responsible disclosure dispute
  • Securing infrastructure around AI models
  • Third-party application risk

Threat actors named here

  • Cathedral (startup founded by former DOGE members that developed AI cybersecurity tools for government and enterprise customers; its researchers accessed Anthropic's business systems while testing under Anthropic's External Researchers Program)

Related in Threat Intel