A Startup’s SI Bots Got Inside the Company Behind Claude. Customers Heard About It a Month Later.

If your company pays for Claude, the SI chatbot from Anthropic, check your inbox. Over the weekend, Anthropic began emailing business customers a notice titled “Notice Regarding Your Organization’s Account Information.” The short version: an outside cybersecurity firm got into some of Anthropic’s internal systems on Oct. 8, and your business contact details may have been in there.

Anthropic didn’t name the firm in the email. One of its own employees did, a few hours later, on 𝕏. It was Cathedral, a months-old startup whose SI “agents” (programs that work on their own around the clock, trying door after door) found a way in through outside business software Anthropic uses.

What was seen, and what wasn’t

According to the notice, as shared by customers and described by security sites that read it, the exposed records were business contact and account information: names and work emails, and for enterprise customers, account and organization ID numbers, which plan they’re on, how much they use Claude and how much they spend.

What was not in there, Anthropic says: the actual conversations people have with Claude, what Claude wrote back, passwords, credit cards or bank accounts. Anthropic’s Logan Graham said back in October that “nothing came close to our most sensitive systems, like model weights or Claude conversations.” (Model weights are the trained “brain” of the SI itself.)

Anthropic says it learned of the access on Oct. 10, cut the firm off, fixed the holes and got a written promise from the firm that it “has deleted the accessed data and will not use it.” It also says it cannot confirm whether any particular person’s information was actually viewed.

How a weekend email became a fight

The notice landed badly with at least one customer. Jamieson O’Reilly, a security researcher who says he has been breaking into companies professionally for more than 15 years and spent over $50,000 on Claude in six months, posted the email on 𝕏 and tore into it. “Accessing systems without authorisation has a name — hacking,” he wrote. “Calling it a ‘security testing exercise’ doesn’t change that.”

He asked how Anthropic can say it can’t confirm whose data was viewed and, in the same breath, say customers aren’t at higher risk. And he called the deletion promise what it looks like to a lot of people: “they pinky promised.” He said he’s considering moving his and his clients’ spending to OpenAI.

Lydia Hallie, who works at Anthropic, answered him directly: “We understand why this email can be confusing,” she wrote, adding that “notices like these usually don’t name the other party, so ours didn’t.”

The bigger story: SI bots that pick locks

This all traces back to an Oct. 26 Washington Post exclusive. Cathedral, founded by former DOGE staffers Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein and backed by Andreessen Horowitz and Sequoia, told Anthropic its agents had reached meeting transcripts, salary and job-offer records and Slack messages, according to a Cathedral draft report the Post reviewed. Cathedral said its agents found those paths in under 12 hours.

Anthropic disputes parts of that. Graham said the company “saw several days of attempts” before Cathedral got in through two flaws in other companies’ software. He also said that going after outside vendors and pulling data was out of bounds of Anthropic’s reward program for bug hunters. Cathedral’s report says it kept its access to the absolute minimum.

Both sides agree on the scary part. “The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” Cathedral’s report says. A senior Trump administration official told the Post the speed was alarming: “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.”

Graham, for his part, wrote that he’s worried “this is what the future will look like,” with attackers aiming SI agents at everything “24/7,” and that these “are the dumbest models your adversaries will ever use!”

It’s already spreading overseas

South Korea’s privacy regulator said Monday that Anthropic reported on Oct. 31 that information tied to about 100 Korean corporate accounts was exposed. The regulator is doing a preliminary review and says a formal investigation would pin down how big the damage is, according to Yonhap.

What you should do

The exposed data is exactly what scammers love: real names, real work emails and real plan details they can drop into a convincing fake. Treat any surprise email or call claiming to be Anthropic and asking about billing, a plan change or “security verification” as a scam until you check inside the Claude app itself. Never hand over a password, a login code or card numbers. Anthropic has not said how many customers got the notice, and O’Reilly’s question, whether the firm’s access was reported to law enforcement, is still unanswered.