AI startup hacks Anthropic, obtains employee data and internal messages
anthropic startup
| Source: HN | Original article
An AI startup breached Anthropic, obtaining employee details and internal messages within 12 hours. The incident underscores security risks for AI companies.
An AI‑focused security startup has announced that it breached Anthropic’s internal systems in less than 12 hours, obtaining employee records, salary data, job‑offer details and private Slack conversations about the company’s advanced models. The firm, called Cathedral and staffed by former employees of the cryptocurrency‑related project DOGE, says its AI agents were used to exploit vulnerabilities in third‑party business software that gave them rapid access to Anthropic’s network.
The claim, published two days ago, adds a new layer to a series of recent attacks on the San Francisco‑based AI lab. As we reported on 30 October 2026, Anthropic was previously compromised by a remote‑access trojan that targeted developer laptops. The latest alleged intrusion is notable not only for its speed but also for the breadth of data exposed – from meeting transcripts to compensation figures – highlighting how AI‑driven tools can be turned against the very organisations that build them.
The breach raises several concerns for the broader AI ecosystem. First, it underscores the growing risk that AI‑powered automation can accelerate the discovery and exploitation of software flaws, potentially outpacing traditional security measures. Second, the exposure of internal strategic discussions may give competitors or malicious actors insight into Anthropic’s roadmap, affecting market dynamics and trust among partners and customers. Finally, the involvement of a startup founded by former DOGE staffers suggests a talent pipeline that can quickly pivot from one high‑tech domain to another, blurring the line between innovation and threat.
What to watch next: Anthropic’s response, including any forensic investigation or public disclosure, will be critical. Regulators may also scrutinise the incident under emerging AI‑security guidelines. Meanwhile, the security community will likely dissect Cathedral’s methodology, potentially prompting new defensive standards for AI‑augmented software supply chains.
Sources
Back to AIPULSEN