Anthropic says Cathedral accessed limited business systems

Anthropic said a cybersecurity startup’s researchers accessed limited portions of its sales, human resources and IT systems during testing, after their AI agents identified routes through vulnerabilities in third-party business software in less than 12 hours. Cathedral said in a draft report that its agents found paths to sensitive internal material, including meeting transcripts, salary and job-offer information, and Slack discussions. Those details were described in reporting based on a review of the draft. Anthropic acknowledged access to some systems but disputed the extent of the exposure. The company said the researchers accessed some customer and partner business contact information and basic user-account records. It said they did not access Claude conversations, model responses, proprietary code or model weights. The incident involved business software used for administrative and sales operations, rather than Anthropic’s core AI systems. Anthropic said its monitoring detected some of Cathedral’s activity before the startup reported its findings, and the company shut off the researchers’ access that same day. Anthropic also said it disabled the affected software pending...