What happened
Cybersecurity startup Cathedral used AI agents to break into Anthropic's internal systems as part of the company's bug bounty program. The intrusion did not come through Anthropic's own infrastructure but through third-party software it relies on.
What Anthropic says
Anthropic confirmed that sales, HR and IT data were accessed. However, the company disputes Cathedral's account of how deep the breach went, leaving the two sides at odds over the scope of the incident.
Why it matters
Anthropic is considered one of the developers of arguably the most capable AI models for cyberdefense. Yet its systems could still be reached through external software dependencies, exposing the supply-chain security gap facing AI labs.
What a bug bounty is
Bug bounty programs let security researchers look for vulnerabilities with permission and receive rewards for reporting them. In this case the access took place under that program, meaning the goal was a security test rather than a malicious attack.
