By Basant El-Faramawy
An AI startup called Cathedral has claimed it breached Anthropic’s internal systems in less than 12 hours, exposing internal communications and personnel data as part of a bug bounty program.
Breach Details
Cathedral, founded this year by former staff of the U.S. Department of Government Efficiency, accessed a limited set of Anthropic’s sales, human resources and IT systems. The breach revealed Slack messages, meeting transcripts, staff salaries and job offers. Anthropic confirmed that user conversations with its Claude model and the model’s source code were not compromised.
Company Response
Anthropic said its monitoring systems flagged some of Cathedral’s activity before the startup reported it, and access was revoked the same day. The incident occurred hours after Anthropic filed for an initial public offering on October 26.
Official Reaction
A senior Trump administration official, speaking anonymously, warned that the breach demonstrates how vulnerable leading AI companies are: “If a bunch of kids who have just started a company can do this, then potentially the Chinese aren’t far behind.”
Security Analysis
Researchers characterized the intrusion as a basic “hygiene failure” involving third‑party software rather than a sophisticated AI attack. Heath Mullins, chief evangelist at cybersecurity firm ExtraHop, said the episode shows how even innovative firms can fall victim to supply‑chain attacks, noting that AI providers are becoming primary targets because many businesses build workflows on top of them.
IPO Ambitions
Anthropic’s IPO filing outlines ambitions to develop AI systems capable of curing diseases such as cancer and Alzheimer’s, while also acknowledging that its models may pose “catastrophic or existential risks to humanity.” The offering is expected to surpass the $1.8 trillion valuation of SpaceX, potentially becoming the largest listing in history.
