AI 初创公司 Cathedral 利用自主 Agent 攻破 Anthropic，获取员工信息与内部消息

• AI 初创公司 Cathedral 利用自主 Agent，通过第三方软件漏洞攻破了 Anthropic 的系统
• Agent 访问了人力资源、销售及 IT 数据，暴露了有限的客户和合作伙伴信息
• 该事件凸显了由 AI 驱动的攻击者如何无视强大的内部防御，快速利用供应商脆弱性

一家 AI 初创公司利用 AI Agent 攻入 Anthropic 并曝光敏感数据，似乎让 Anthropic 尝到了自己技术的厉害。

这家涉事公司名为 Cathedral，由已解散的美国政府效率部（DOGE）前成员创立。该政府计划旨在削减联邦开支与官僚机构，同时推动政府技术和运营的现代化。

Anthropic 目前正通过 HackerOne 运行一项双轨漏洞赏金计划：一部分专注于发现 Anthropic 系统中的技术缺陷；另一部分则是邀请制专项计划，奖励发现能够绕过 Claude 安全防护的通用越狱方案的研究人员。

Cathedral 显然通过该漏洞赏金计划向 Anthropic 提交了研究成果。在人类研究人员尝试入侵数天未果后，他们部署了 AI Agent，后者在不到 12 小时内便利用第三方商业软件的缺陷找到了突破口。

违反规则

在成功进入该公司网络后，Agent 访问了会议纪要、薪资与录用通知（Job Offers）信息，以及 Slack 消息。员工与 Claude 的对话记录似乎未被泄露。

Anthropic 证实了这一消息，表示 Cathedral 访问了“有限范围”的销售、人力资源和 IT 系统，并获取了属于某些客户和合作伙伴的联系方式及基础用户账户记录。源代码和 AI 模型权重未被访问。

Anthropic 在提供给《华盛顿邮报》的声明中表示：“在 Cathedral 向我们报告之前，我们的监控系统就已经标记了他们的部分活动。我们在当天就切断了他们的访问权限。”

据 Gizmodo 报道，Anthropic 指责 Cathedral 未完全披露其行动范围，违反了该计划的规则。目前尚不清楚这是否意味着 Anthropic 将拒发赏金，但形势看起来确实如此。

不过，支付赏金可能是 Anthropic 目前最不担心的事情。该公司目前估值为 14 亿美元，正积极筹备首次公开募股（IPO）。向任何人（即便是白帽黑客）泄露敏感数据，显然都不是一个好信号。

一群“制造混乱的小孩”？

《华盛顿邮报》援引 Cathedral 的报告称：“普通企业软件中的弱点足以瓦解哪怕最先进机构的基础设施，这一事实应为全美所有企业敲响警钟。”

与此同时，据《独立报》报道，特朗普政府的一位高级官员据称表示：“如果一群刚创立公司的小孩都能做到这一点，那么潜在对手也落后不了多少。”

然而，Cathedral 绝非“一群小孩”——它是一家专注于为美国军方和政府提供攻防网络行动的 AI 初创公司。其创始人包括前五角大楼首席数据官 Gavin Kliger、因利用机器学习破译古罗马卷轴而闻名的 Luke Farritor、前 SpaceX 员工 Marko Elez，以及在加入 DOGE 前曾在 Salem Partners 担任投资银行分析师的 Jack Stein。

网络安全界对此展开了讨论。Suzu Labs 安全 AI 解决方案与网络安全高级总监 Jacob Krell 对此并不感到意外，他表示如果第三方供应商在任何地方都是风险，那么在 Anthropic 也是同样的风险。

“Cathedral 的 Agent 攻入 Anthropic 的方式与攻击者入侵其他所有人的方式如出一辙，都是通过供应商，”Krell 说道。“安全成熟度的上限取决于你接入的最脆弱的供应商，无论内部工程技术多么雄厚都无法改变这一点。”

Ridge Security 技术营销工程高级总监 Darin Fredde 对 Anthropic 的应对给予了肯定：“Anthropic 值得肯定的是其监控系统检测到了部分活动并采取了遏制措施。但补救措施的真正衡量标准在于独立验证这些攻击路径是否确实被阻断。我们不能再把打补丁成功与确切的安全成果混为一谈。否则，我们只是锁上了前门，寄希望于没人发现备用钥匙而已。”

Follow us

Add us as a preferred source on Google

Newsletter

Subscribe to our newsletter

• AI startup Cathedral used autonomous agents to breach Anthropic systems through weaknesses in third-party software
• Agents accessed HR, sales, and IT data, exposing limited customer and partner information
• Incident highlights how AI-powered attackers can rapidly exploit vendor weaknesses despite strong internal defenses

An AI startup seemingly gave Anthropic a taste of its own medicine when it used AI agents to break into the company and expose sensitive data.

The company in question is called Cathedral, which was founded by former members of the defunct US Department of Government Efficiency (DOGE), a US government initiative established to reduce federal spending and bureaucracy, while modernizing government technology and operations.

Anthropic is running a two-fold bug bounty program through HackerOne. One part is focused on finding technical flaws in Anthropic’s systems, while the other is an invite-only program that rewards researchers for finding universal jailbreaks that bypass Claude’s safety protections.

Latest Videos FromTechRadar

Cathedral apparently shared its results with Anthropic through the bug bounty program. After its human researchers unsuccessfully tried breaking in for a few days, they deployed AI agents which took less than 12 hours to find a way in, by exploiting flaws in third-party business software.

Violating the rules

After accessing the company’s network, the agents accessed meeting transcripts, information on salaries and job offers, as well as Slack messages. Employee conversations with Claude were not exposed, it seems.

Anthropic confirmed the news, saying Cathedral accessed a “limited set” of sales, human resources, and IT systems, and compromised contact information and basic user account records belonging to certain customers and partners. Source code and AI model weights were not accessed.

“Our monitoring flagged some of Cathedral’s activity before they reported it to us,” Anthropic said in a statement shared with The Washington Post. “We shut off their access the same day.”

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

According to Gizmodo , Anthropic accused Cathedral of violating the program’s rules by failing to disclose the full extent of its activity. We don’t know if that means Anthropic won’t release the payment for the bounty, but it sure sounds like it.

Paying the bounty could be the least of Anthropic’s concerns, though. The company is currently gearing up for its Initial Public Offering (IPO), with a valuation of $1.4 billion. Leaking sensitive data to anyone, including white hat hackers, is definitely not a good signal.

A 'bunch of kids' wreaking havoc

“The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” the Washington Post cited Cathedral’s report as saying.

At the same time, a senior Trump administration official allegedly told Via The Independentthat “if a bunch of kids who have just started a company can do this, then potentially the Chinese aren’t far behind.”

Cathedral can hardly be described as “a bunch of kids” - it is an AI startup focused on offensive and defensive cyber operations for the US military and government. Its founders include Gavin Kliger (former Pentagon chief data officer), Luke Farritor (best known for helping decipher ancient Roman scrolls using machine learning), Marko Elez (former SpaceX staffer), and Jack Stein (apparently worked as an investment banking associate at Salem Partners before joining DOGE).

The cybersecurity community had something to say about it. Jacob Krell, Senior Director for Secure AI Solutions & Cybersecurity at Suzu Labs, wasn’t particularly phased, saying if third-party vendors are a risk everywhere, then they’re a risk at Anthropic.

"Cathedral's agents got into Anthropic the same way attackers get into everyone else, through the vendors,” Krell said. “Security maturity is capped by the weakest vendor you integrate with, and no amount of in-house engineering changes that."

Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, praised Anthropic’s response: "Anthropic deserves credit for reporting that its monitoring detected some of the activity and for taking containment measures. But the real measure of remediation is independent verification that those attack paths are closed. We need to stop confusing a successful patch with a verified security outcome. Otherwise, we're just closing the front door and hoping nobody discovered the spare key."

The best antivirus for all budgets

Our top picks, based on real-world testing and comparisons

Follow TechRadar on Google News and __add us as a preferred source to get our expert news, reviews, and opinion in your feeds.