Anthropic has started emailing enterprise customers to warn them that an outside cybersecurity firm got into some of its internal business systems in late October without authorization. According to reports on the notice, the firm may have viewed customer contact, plan, usage and spend information. Anthropic says Claude conversations, passwords and payment details were not part of it.
The emails, which began going out on November 7, are the first direct customer-facing step in an Anthropic security incident that became public two weeks ago. They confirm that the issue reached real business records, not just internal chatter.
Key takeaways
- Anthropic is notifying enterprise customers that a third-party security firm accessed internal systems in late October without authorization.
- Reported data in scope: account contacts, plan details, usage and spend. Anthropic says conversations, passwords and payment data were not included.
- The timing lines up with security startup Cathedral’s claim that its AI agents got into Anthropic’s sales, HR and IT tools in under 12 hours through third-party software.
- Anthropic’s own code, model weights and Claude infrastructure were not reached, the company has said.
- For builders, the real lesson is vendor risk: the weak point was ordinary business SaaS, not the AI stack.
What happened
On November 7, Anthropic began sending emails to enterprise customers about unauthorized access to its internal systems. RuntimeWire reported that the notice describes the intruder only as an unnamed cybersecurity firm, says Anthropic could not confirm exactly whose information was viewed, and tells recipients they face no heightened risk.
Per MLQ.ai’s account of the email, the firm accessed the systems in late October and could see account, plan, usage and spend data. The notice says customer conversations, passwords and payment information were not included. Anthropic has not published a public blog post or incident page on the notice, and we have not seen the full email text ourselves, so some details may still change.
The backstory is public. On October 26, The Washington Post reported on a draft report from Cathedral, a young AI security startup founded by former Department of Government Efficiency staff. Cathedral said its researchers spent several days failing to break into Anthropic’s own software. Then its autonomous AI agents turned to the third-party business tools Anthropic uses and found a way in within less than 12 hours.
Anthropic confirmed to reporters at the time that Cathedral reached a “limited set” of its sales, human resources and IT systems, and that contact details for some customers and partners, plus basic user account records, were reachable. Cathedral’s draft report claimed its agents could also see meeting transcripts, salary and job-offer records, and Slack messages about advanced models. Anthropic said its monitoring flagged some of the activity before Cathedral reported it, and that it cut off access the same day.
The new customer notice does not name Cathedral, according to RuntimeWire. The timing and the type of systems involved match Cathedral’s reported intrusion, but Anthropic has not publicly confirmed they are the same event. We treat that link as likely, not confirmed.
A dispute over the rules
Cathedral submitted its findings through Anthropic’s HackerOne bug bounty program. Anthropic has pushed back hard on how the work was carried out. It said Cathedral broke the program’s rules by not disclosing the full extent of its activity, and that the startup overstated the national security angle. Cathedral, for its part, said its “data accesses were kept to the absolute minimum.”
That tension explains the wording of the customer email. Calling the access “without authorization” signals that Anthropic does not see this as ordinary, in-scope security research. It also means customers are being told about the access even though the party involved says it was acting as a white-hat tester.
According to Data Studios’ summary of Anthropic’s statements, the company disabled the affected third-party software and only switched it back on after vendors confirmed fixes. It also said it has no evidence that anyone besides Cathedral used the same weaknesses. The vendors have not been named.
Why it matters
This is not a breach of Claude itself. Nothing reported so far suggests prompts, outputs, API keys or model weights were exposed. But it still matters for three reasons.
First, usage and spend data is commercially sensitive. For an enterprise, how much it pays for Claude, which plan it is on and how heavily its teams use it can reveal product plans and budgets. That is useful information for competitors, and for anyone trying to craft a convincing phishing email that looks like it came from an Anthropic account manager.
Second, the method is the story. The agents reportedly did not beat Anthropic’s core defenses. They went around them through the sales and HR tools every company uses. As one security analyst put it to TechRadar, the agents got in “the same way attackers get into everyone else, through the vendors.”
Third, it shows how fast AI-driven attacks have become. Days of failed human effort followed by success in under 12 hours once agents took over is exactly the shift we flagged when OpenAI launched its gated GPT-6 Cyber model. Offensive automation is now cheap enough for a startup to run against one of the best-defended AI labs in the world.
It also lands in a rough week for Anthropic on security. Just days ago, researchers showed how Claude Code’s permission file was leaking thousands of secrets into public GitHub repos. The two issues are unrelated, but together they put the company’s security posture under a brighter spotlight as it prepares to go public.
What it means for developers and businesses
If you are an Anthropic enterprise customer, there is no reported need to rotate API keys or passwords because of this notice. A few sensible steps still apply:
- Watch for targeted phishing. Anyone holding your contact and spend details can write a very believable fake invoice or “plan change” email. Verify billing requests through your known Anthropic contacts or console.
- Ask your account team directly. The notice reportedly says Anthropic cannot confirm whose records were viewed. You can still ask what data about your organization sat in the affected systems.
- Audit your own SaaS sprawl. List the CRM, HR and admin tools that hold customer or employee data, check their permissions and integrations, and remove what you no longer use.
- Assume attackers have agents too. Test vendor-facing paths, not just your main app. If a well-funded AI lab could be reached through its business tools, so can you.
For security teams, the case is a strong argument for treating third-party SaaS as part of the attack surface in every red-team exercise and bug bounty scope, with clear rules on how far testers may go once they get in.
What to watch next
Several open questions remain. Anthropic has not said how many customers received the email, which vendors were involved, or whether it will pay Cathedral’s bounty. Cathedral’s full report has not been published, so its claims about transcripts, salary data and Slack messages have not been independently checked.
Watch for a public incident write-up from Anthropic, any statement from the unnamed SaaS vendors, and whether regulators or enterprise buyers start asking AI labs harder questions about the business tools that sit around their models. For now, the clearest message is simple: the AI model was not the weak link. The everyday software around it was.