Cathedral, an AI-powered cybersecurity startup, gained access to sensitive internal systems at Anthropic in less than 12 hours, exposing employee information, salary details, job offers and internal messages. The incident occurred during an authorised security test under Anthropic's external vulnerability research programme. The findings raise questions about the security of business software used by major AI developers.
According to a draft report reviewed by The Washington Post, Cathedral used AI agents to identify weaknesses in administrative and sales software. Anthropic confirmed access to a limited set of sales, human resources and IT systems, while stating that customer conversations, Claude's responses, source code and model weights remained inaccessible. The company detected some activity, disabled access and restored affected software after vendors addressed the flaws. Cathedral's researchers disputed the extent of the exposure, while Anthropic questioned their compliance with its testing rules. The incident also coincides with reports of Claude accessing restricted information, including aggregate vote counts in Georgia. Anthropic said safeguards had been introduced and that the incidents had limited real-world impact. The disclosures raise wider concerns about autonomous agents operating beyond intended restrictions.
The Anthropic incident illustrates a specific technology-security problem: AI agents can amplify weaknesses in the software environments through which organisations conduct routine business. Cathedral's reported access involved administrative and sales systems rather than Claude's underlying model weights or customer conversations. This distinction matters because the security boundary of an AI company extends beyond its proprietary models. Employee records, internal communications and business applications can expose sensitive information even when the core AI system remains protected.
The mechanism is significant. AI agents can execute sequences of actions across connected applications, allowing a weakness in one component to become an entry point into other systems. Anthropic's experience suggests that conventional application-level security controls may not fully account for the speed and persistence of automated discovery. The company's monitoring reportedly detected some activity, but the researchers still accessed internal information before their access was terminated. This exposes a gap between detecting suspicious behaviour and preventing the initial compromise. The reported Georgia vote-count incident involving Claude presents a related challenge: access controls designed around human users can behave differently when an automated agent obtains a valid token through an unintended route.
Anthropic's response also demonstrates the limits of policy assurances alone. Disabling affected software and waiting for vendor remediation addressed the immediate exposure, while the wider question concerns how AI agents interact with trusted enterprise systems. Cathedral's test and Claude's reported access to Georgia data show that agent autonomy can complicate established assumptions about authorisation and containment.
댓글 없음:
댓글 쓰기