AI agents gained rapid access to Anthropic systems
A cybersecurity start-up gained access to limited internal data belonging to the maker of Claude through vulnerabilities in corporate software.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Researchers at the US start-up Cathedral say their AI agents found access to parts of Anthropic's corporate infrastructure within twelve hours. Anthropic confirms that a limited amount of data from sales, personnel and IT systems was accessible.
According to available reports, the researchers were working within a programme in which external security specialists are allowed to test systems. They did not attack the Claude model itself, but exploited vulnerabilities in software from external suppliers that Anthropic used for business processes.
According to a draft report, the researchers were able to find routes to meeting transcripts, information about salaries and job offers, and messages about advanced AI models. The precise suppliers of the corporate software have not been disclosed.
Anthropic says that Cathedral had access to a limited set of sales, HR and IT systems. According to the company, customers' conversations with Claude, the model's answers, source code and model weights were not accessible. Anthropic also says it has found no indications that others exploited the vulnerabilities.
The company disabled the exposed access on the same day that the researchers reported their findings. The software involved remained disabled until suppliers, according to Anthropic, had confirmed that the vulnerabilities had been fixed.
The case shows that the security of AI companies depends not only on their models and data centres. Ordinary administrative systems and links with external suppliers can also provide access to sensitive corporate information. Anthropic and Cathedral differ in their accounts of whether the test was conducted fully in accordance with the research programme's agreements.
Anthropic says that customer conversations, source code and model weights remained out of reach. The security issue does not prove that customer data or model technology was stolen, but it may raise questions about the management of operational risks at fast-growing AI companies.
Also show the region and a close-up
One story, several perspectives
What is established
- A security start-up found access routes to limited internal Anthropic systems.
- The researchers used AI agents and vulnerabilities in external corporate software.
- Anthropic says that customer conversations, source code and model weights were not accessed.
- Anthropic says it closed the access routes and has found no evidence of misuse by third parties.
Left
Arguments AI companies process sensitive data and must therefore set higher standards for transparency, supplier oversight and the protection of employees' and customers' information.
Values Privacy, public accountability and the protection of employees and users.
Consequences This perspective supports stricter statutory audits, reporting obligations and liability for supply chains.
Centre
Arguments The test demonstrates a real security risk, but the limited access and rapid shutdown also point to the value of controlled external testing and proportionate reporting.
Values Risk management, innovation and verifiable standards.
Consequences The preference is for clear bug-bounty rules, independent audits and transparency about the scale of incidents without unnecessary panic.
Right
Arguments Companies must remain responsible for the security of their own systems and must not wait for new rules when developing critical technology.
Values Personal responsibility, freedom to innovate and protection of property.
Consequences This perspective emphasises contractual liability, investment in security and restraint regarding broad regulation that could disadvantage smaller companies.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The core facts have been confirmed by independent reporting and by Anthropic's own response as presented in the source. Unconfirmed claims about national security, full data access or misuse by third parties have not been presented as facts.
- confirmed Cathedral found access routes to Anthropic systems within twelve hours. — Description of the security investigation by Decrypt and The Washington Post. source
- confirmed Anthropic confirmed access to a limited set of sales, HR and IT systems. — Anthropic's statement as quoted by Decrypt. source
- confirmed Customer conversations, model weights and source code were not accessed. — Anthropic says these components remained out of reach. source
- confirmed The vulnerability was in external corporate software and not in Claude itself. — This distinction is described in Decrypt and The Washington Post's report. source
- uncertain The access may have been exploited by others. — Anthropic says it has found no indications of this; no independent evidence has been reported. source
Editor's note
Decrypt and The Washington Post describe the same security investigation; Anthropic confirms the limited access but disputes the most serious interpretations. The source software and full technical details have not been disclosed.Sources
More on this in Dutch media
- Trouw — „anthropic claude”
- NU.nl — „anthropic claude”
- De Telegraaf — „anthropic claude”