A cybersecurity firm founded by former DOGE employees claims its AI tools infiltrated Anthropic's internal systems in under 12 hours, according to a report by the Washington Post. The breach accessed meeting transcripts, salary details, and Slack messages related to Anthropic's advanced models. The exploit targeted third-party business software, not the AI model itself. Anthropic stated the breach was limited to sales, HR, and IT systems, with no access to user conversations or source code. The company cut off the startup's access immediately and claims its monitoring systems flagged the activity before the breach was reported.
The startup, Cathedral, reported the findings through Anthropic's bug bounty program, but Anthropic accused it of violating program rules by not disclosing all activities and overstating national security risks. A security expert reviewing the findings called the breach significant, noting Anthropic could have improved oversight of its third-party vendors. The incident raises concerns about the security of AI development, especially as Anthropic seeks public investment.
The breach highlights growing vulnerabilities in the AI industry, with security experts warning that even small startups can exploit weaknesses in third-party tools. Anthropic's recent financial disclosures show a $974 million operating profit against a massive $800 billion compute bill, underscoring the high stakes of securing its systems. The company has since disabled the affected software and is working with vendors to fix the issues. The incident also reflects broader tensions over national security and AI development, with government officials expressing concern over potential foreign exploitation.
Cathedral, backed by major venture capital firms, has a notable track record, including ties to the Pentagon and a $1.4 billion valuation. The breach adds to ongoing scrutiny of Anthropic's security practices as it prepares for public investment. The disagreement over the breach's scope underscores the challenges in assessing and mitigating risks in the rapidly evolving AI landscape.