Washington (The COW News Digital) A US-based artificial intelligence startup has claimed it gained access to parts of Anthropic’s internal network in less than 12 hours, exposing internal communications and sensitive corporate information during a bug bounty programme designed to identify security vulnerabilities.
According to a report by The Washington Post, the startup, known as Cathedral, said it had penetrated parts of the AI company’s internal systems as part of an initiative encouraging external researchers to discover and report security weaknesses.
Cathedral was founded this year by former employees of the US Department of Government Efficiency, according to the report. The company’s claimed access reportedly exposed internal Slack messages, meeting transcripts, employee salary information and details related to job offers.
The incident has drawn attention to cybersecurity risks facing major artificial intelligence companies as they expand their operations and manage growing volumes of confidential business information.
Anthropic, the company behind the Claude family of AI models, confirmed that Cathedral had accessed a limited portion of its sales, human resources and information technology systems. However, the company said the incident did not compromise customer conversations with its cloud-based AI services or expose its AI model source code.
The distinction is significant because internal corporate systems may contain sensitive employee and business information, while customer conversations and proprietary model code represent separate categories of potentially valuable data.
In a statement provided to The Washington Post, Anthropic said its monitoring systems had detected some of Cathedral’s activities before the company was notified of the breach. Anthropic added that it disabled the startup’s access on the same day.
The reported incident occurred under a bug bounty programme, a cybersecurity initiative in which companies invite independent security researchers to identify vulnerabilities under defined rules. Such programmes can help organisations uncover weaknesses before malicious actors exploit them.
However, the incident also raises questions about the scope of access granted to external researchers and the safeguards required to prevent security testing from exposing information beyond its intended boundaries.
For technology companies working with advanced AI systems, protecting internal communications, employee records and proprietary information remains an important part of maintaining operational security. Even when customer-facing services and core intellectual property remain unaffected, unauthorised or unexpected access to internal systems can create privacy and confidentiality concerns.
The case also highlights the importance of monitoring systems capable of identifying unusual activity and responding quickly to potential security incidents. Anthropic’s statement indicates that its monitoring tools detected certain activities and that access was subsequently revoked.
Details about the full scope of the incident, the precise vulnerabilities involved and whether any information was copied or further distributed were not provided in the supplied report.
The episode underscores the increasingly complex cybersecurity environment surrounding the artificial intelligence industry. As companies develop more powerful models and expand their commercial operations, security testing, access controls and rapid incident response are becoming essential elements of protecting sensitive information.
While Anthropic said its customer conversations and AI model source code remained secure, the reported exposure of internal business information demonstrates why cybersecurity programmes must carefully balance external testing with strict safeguards.
