An AI Startup Hacked Anthropic in 12 Hours? How Was This Possible?

By Gi Pyeong Lee
AI Security Anthropic AI Agents Hacking Cybersecurity
Abstract graphic symbolizing security threats with digital circuits overlapping with AI neural network images
AI Summary

We analyze the incident where cybersecurity startup Cathedral used AI agents to infiltrate AI company Anthropic's internal systems in just 12 hours, stealing salary information and internal messenger data.

Imagine this: how would you feel if someone stole your company’s internal messenger logs, secret meeting transcripts, and even your colleagues’ salary details—all in just 12 hours? This is exactly what recently happened at Anthropic, a giant in the AI industry. What is truly astonishing is that this wasn’t carried out by a human hacker, but by an automated program called an ‘AI Agent.’

Why Does This Matter?

This incident clearly demonstrates how quickly AI can uncover weaknesses in our systems. For a long time, we have thought of AI merely as a ‘smart assistant’ that summarizes documents or draws pictures. Now, it has been proven that when that ‘assistant’ falls into the hands of someone with malicious intent, it can become a ‘skilled thief’ capable of tearing down our corporate security walls. This is a critical case warning us of how vulnerable the many business software suites used by enterprises are to AI-driven automated attacks.

Easy to Understand: What Are AI Agents?

‘AI Agents’ are not just ordinary chatbots that answer questions. They are active artificial intelligences that can plan for themselves, navigate websites, and manipulate programs to achieve their goals.

To use a simple analogy: if traditional hacking is like a thief struggling to climb over a wall, an attack using AI agents is like unleashing thousands of ‘super-powered thieves’ that can scan every crack in that wall tens of thousands of times per second. Cathedral, a cybersecurity startup, used these AI agents to instantly find small cracks (vulnerabilities) in enterprise software.

Like solving a puzzle, the AI analyzed vast amounts of software documentation and conversation records, successfully breaching Anthropic’s internal system defenses in just 12 hours.

Current Situation

Cathedral, the startup behind this attack, is known to have been founded by former employees of the Department of Government Efficiency (DOGE) linked to Elon Musk. When they breached Anthropic’s security, highly sensitive data such as employee salary information, job offers, meeting transcripts, and internal messenger records were fully exposed.

In fact, this is not the first time security threats utilizing AI have emerged. Recently, new terms like ‘vibehacking’ (creatively infiltrating systems using AI) have appeared, as AI has even written code to hack over 17 organizations, making the threat a reality. The report on the breach of Anthropic’s systems proves that even giant IT companies are no longer safe from automated AI attacks.

What Happens Next?

From now on, a security war of ‘AI versus AI’ will intensify. Companies will find themselves in a position where they must adopt ‘defensive AI agents’ that detect and block threats in real-time to counter the ‘offensive AI agents’ that attempt to hack them. Following this incident, it is expected that business software will adopt stronger authentication and data access control technologies to prevent AI agents from arbitrarily requesting information or issuing commands. This means that security is no longer just a system issue; it has become an intelligent battle of wits against AI.

The Perspective of AI

Technology is like a knife. For a chef, it is an essential tool for creating delicious food, but for a criminal, it can be a threatening weapon. The capabilities of AI agents have already evolved far beyond what we imagined. It is time for everyone who uses technology to seriously consider how much higher and stronger we must build our digital walls to keep pace with the speed of that evolution.

References

  1. AI startup hacks Anthropic in 12 hours, gains access to employee details and internal messages
  2. [Vue HN 2.0 AI startup hacked Anthropic, gains access to…](https://vue-hackernews-ssr-5cavbdjcta-ew.a.run.app/item/50284115)
  3. Founded by ex-employees of Musk’s department, the Cathedral…
  4. Elon Musk-Linked Startup Says Its AI Agents Hacked Anthropic in…
  5. Former DOGE Staffers’ New Startup Claims It Hacked Anthropic
  6. Hackers used Anthropic AI to ‘commit large-scale theft’
  7. Months-old US startup accessed Anthropic’s sensitive data in under 12 hours
AD
Test Your Understanding
Q1. What core technology was used in the attack during this hacking incident?
  • Traditional phishing emails
  • AI Agents
  • Manual software reverse engineering
A startup called Cathedral utilized AI agents to automatically scan for and exploit vulnerabilities in enterprise software.
Q2. How long did it take from the hacking attempt to infiltrating Anthropic's internal systems?
  • Within 1 hour
  • Under 12 hours
  • About 3 days
According to reports, it took less than 12 hours from the hacking attempt to gaining access to sensitive data.
Q3. Which of the following was NOT leaked from Anthropic as a result of this incident?
  • Internal messengers and meeting minutes
  • Users' payment card information
  • Employee salary information and job offers
While employee salaries, recruitment information, internal meeting minutes, and messenger records were stolen in this incident, no leakage of user payment card information was reported.
    An AI Startup Hacked Anthro...
    0:00