Anthropic confirms AI startup Cathedral reached a "limited set" of its sales, HR and IT systems during a bug bounty probe; Anthropic says Claude conversations and model source code were not accessed and disputes Cathedral's under-12-hours claim
The Independent reported on 28 October 2026 that US-based AI startup Cathedral, which The Independent says was founded this year by former staff of the US Department of Government Efficiency, claimed it breached Anthropic's internal network in less than 12 hours as part of a bug bounty program that encourages outsiders to look for security flaws. (source: The Independent)
According to The Independent, Anthropic confirmed that Cathedral had reached a "limited set" of sales, HR and IT systems but did not access users' conversations with Claude, and the model's source code was not compromised.
Anthropic said in a statement quoted by The Independent: "Our monitoring flagged some of Cathedral's activity before they reported it to us," and "We shut off their access the same day." (source: The Independent)
An Anthropic spokesperson told The Independent that the activity "involved attempts over several days", pushing back on the 12-hour claim, and that Cathedral's actions went "substantially beyond" the company's bug bounty program by targeting third-party applications. (source: The Independent)
- Product
- Anthropic internal business systems (sales, HR and IT) and third-party applications it uses
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- No customer action has been announced. Organisations running bug bounty or penetration-test programmes: set written scope that covers third-party SaaS applications, and monitor for out-of-scope activity. Review third-party SaaS access to sales, HR and IT data.