新智元报道
就在刚刚，Anthropic被攻破了！
「用AI攻击AI」的自动化黑客时代，已经彻底降临。
短短12个小时，AI巨头Anthropic的防线被AI智能体撕得粉碎。
薪酬数据、录用详情、内部会议实录，甚至包含讨论最先进AI模型机密的Slack内部消息，全部暴露在入侵者的视野之下。
这不仅是Anthropic的「社死」瞬间，更是全球AI行业的「冯诺依曼时刻」。
美国政界震动，白宫官员惊呼，顶级安全专家开始下场。
一场关于AI安全、大国博弈与企业防线的风暴，正在席卷硅谷。
首先说明，这不是一次非法的黑客攻击，而是安全测试。
故事的起因，是Anthropic开放了一项安全测试计划，允许外部网络安全专家对公司的系统进行「压力测试」。
悬赏找漏洞，这在科技圈很常见。
但Anthropic绝对没有想到，这次引狼入室，会让自己如此难堪。
发起攻击的，是成立仅数月的网络安全初创公司Cathedral。他们不靠人工死磕，全靠AI智能体（AI Agent）自动化渗透。
AI智能体被释放进网络。它们像拥有数字嗅觉的猎犬，自动扫描、自动分析、自动寻找裂缝。
仅仅运行了不到12小时，突破口就出现了。
那些用于行政管理、销售跟进、日常办公的第三方企业软件，成为了最致命的阿喀琉斯之踵。
AI智能体顺着这些普通商业软件的安全漏洞，兵不血刃地跨过了Anthropic的护城河，直接渗透进内部系统网络。
防线，瞬间崩溃。
入侵成功后，AI智能体看到了什么？
根据《华盛顿邮报》查阅的Cathedral报告草稿，这次入侵直接触及了Anthropic的销售、HR（人力资源）与IT系统。
数据清单令人触目惊心，包括会议文字实录、薪酬与录用详情以及Slack内部消息。
最要命的是Slack内部消息。员工们在Slack上讨论Anthropic先进AI模型的聊天记录，完全敞开。
在科技公司，Slack就是事实上的「数字大脑」。无数灵光一现的代码逻辑、对未发布模型的吐槽、对竞争对手的分析，都在这里毫无保留地流动。
拿到Slack权限，就等于拿到了这家公司的「日记本」。
万幸的是，核心资产保住了。
Anthropic官方随后紧急出面「灭火」。他们确认了入侵的真实性，承认Cathedral确实访问了销售、HR和IT系统中的「有限数据」，包括部分客户和合作伙伴的商业联系信息，以及基础用户账户记录。
但Anthropic反复强调了一条红线：
客户发送给Claude的消息，没有泄露。核心代码，没有泄露。
模型权重（Model Weights），绝对没有被触及。
模型权重，是AI公司的身家性命，是「核武器级别的材料」。
如果权重被偷，等于把几百亿美元烧出来的AI模型拱手送人。
虽然「核按钮」还在，但外围阵地在12小时内全面失守，足以让Anthropic颜面扫地。
但被人指着鼻子骂「防线像纸糊的一样」，Anthropic当然咽不下这口气。
在承认被入侵的同时，Anthropic展开了猛烈的公关反击。
Anthropic声称，在Cathedral提交报告之前，公司的监控系统就在当天察觉了异常活动，并果断切断了访问权限。
Anthropic指责Cathedral夸大了这些发现所「暗示的国家安全影响」。潜台词是：你不过就是想踩着我们上位，夸大其词，兜售你的安全产品，故意制造恐慌。
在报告草稿中，Cathedral发言人冷冷地留下了一句话：「研究人员依照安全研究最佳实践，将数据访问量控制在了绝对最低限度。」
言外之意：我们不仅进去了，还手下留情了；如果没有控制访问量，你们底裤早就输光了。
这场互撕，扯下了AI行业光鲜亮丽的遮羞布。
AI编程初创公司Cognition的首席信息安全官、斯坦福互联网观察站前主任Alex Stamos在审阅了Cathedral的报告后，给出了致命一击的评价：
他们发现了一个很严重的问题。这是一个非常难解决的问题，但Anthropic本可以做得好得多。
这次事件，揭示了当前AI行业最恐怖的一个真相：
黑客根本不需要去硬刚你最坚固的防盗门，他们只需要搞定给你送外卖的小哥。
Cathedral的AI智能体之所以能势如破竹，根本原因在于利用了「第三方企业软件」的漏洞。
今天的AI巨头，往往把99%的安全预算和精力，投入到保护模型权重和核心算法上。他们建立了坚不可摧的「金库」。
但是，这家公司的HR依然要发工资，销售依然要跟进客户，员工依然要用Slack聊天。
这就必须接入大量的普通商业软件。
普通的行政软件一旦被撕开口子，就会成为攻击者向内部网络横向移动的跳板。
Cathedral发出警告：
普通企业软件中的弱点竟能危及最先进组织的基础设施，这一事实应当为每一家企业敲响警钟。
新兴的攻击能力正在增强，而防御体系没有跟上。
Anthropic对安全的重视是出了名的。
这件事确实凸显了一个问题：AI公司究竟该在哪些环节、以什么方式使用第三方SaaS服务？至少目前看来，似乎没有什么服务用起来能真正让人放心。
早在上个月，Anthropic的员工Jacob Coxon就以公开辞职的方式，发出了吹哨人的警告。
他强烈抨击公司在处理危险AI技术时不够负责，过度依赖传统商业软件。
他一语成谶：「这是一场傲慢的赌局，而这不该从一家私营公司的Slack上发起。」
不仅是Anthropic。本月早些时候，FBI逮捕了一名OpenAI员工，他竟然在公司高管会议室放置录音设备。
此前，OpenAI也发生了类似的事件——三名研究员用Claude链式利用两个漏洞，接管多名OpenAI员工的ChatGPT和Codex账户。
AI巨头内部管理的脆弱，已经到了令人发指的地步。
如果是Cathedral攻破了Anthropic，那叫商业测试。如果是别国情报机构攻破了Anthropic，那叫国家灾难。
这份测试报告，目前正在美国政府高层内部紧急传阅。
AI技术，已经被美国政府及其对手视为「维持或挑战全球实力的关键」。前沿AI模型的战略价值，已经与核武器划等号。
一位匿名的特朗普政府高级官员在接受采访时，表达了极度的震惊与担忧。
他无法相信，一家掌握着「几乎达到核武器级别材料」的企业，其敏感系统竟然在如此短的时间内被长驱直入。
这位官员说的一句话让整个华盛顿后背发凉：
「如果一群刚刚创办公司的年轻人都能做到这一点，那么其他人可能也离做到这一步不远了。」
这正是特朗普政府急于与Cathedral展开合作，推演AI对抗性情景的原因。
当攻击工具从人类黑客，进化为不知疲倦、每秒能尝试数万种渗透路径的AI智能体时，传统的网络安全防御体系，已经形同虚设。
把Anthropic逼入墙角的Cathedral，到底什么来头？
这是一支武装到牙齿的「数字特种部队」，而且带着浓厚官方背景。
我们不贩卖恐惧，我们提供清晰的判断。
我们模拟真实攻击者的思维与行动方式，让防守团队在贴近实战的环境中训练，也让管理层如实了解自身抵御攻击、恢复运转的能力。
创始人Gavin Kliger，履历极其硬核。在美国 「政府效率部」DOGE任职后，他曾直接出任五角大楼（美国国防部）首席数据官。
这批人，是真正在国家暴力机器中见识过顶级数据对抗的狠角色。
成立仅仅数月，这家公司已经从投资者手中狂揽1.6亿美元融资，估值直接飙升至14亿美元。
硅谷风投教父Marc Andreessen、Shaun Maguire亲自坐镇公司董事会。
据特朗普政府高级官员透露，最近已有三家美国联邦机构与Cathedral签订了网络安全服务合同。
在五角大楼任职期间，Gavin Kliger就曾反复参与美国高层的一个「情景推演」：
如果某个外国国家获得了硅谷前沿AI实验室的研究资料，会发生什么？
如今，他辞职下海，创办Cathedral，用12个小时的时间，亲自向全美国证明了：这个原本只存在于兵棋推演中的末日情景，离现实只有半天的距离。
参考资料：
编辑：大卫
不喜欢
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
New Ji-won.
Just now, Anthropic was broken!
The age of automated hackers with "Ai attack " has come to an end.
In a matter of 12 hours, the line of the AI giant Anthropic was torn apart by AZAI agent.
Remuneration data, details of admissions, minutes of internal meetings, and even internal Slack messages that discuss the confidentiality of the most advanced AI models, were all exposed to the eyes of the invaders.
This is not only Anthropic's "social death" moment, but also the global AI industry's "Von Noyman" moment.
The United States political vibrating, White House officials were shocked and top security experts began to die.
A storm about AI's security, big country games and corporate defense lines is sweeping the Silicon Valley.
First, it was not an illegal hacker attack, but a security test.
The story stems from the fact that Anthropic has opened a security test programme to allow external network security experts to "pressure" the company's systems.
Rewards for loopholes are common in the tech world.
But Anthropic had absolutely no idea how embarrassing it would be to lure a wolf into the room.
The attack was carried out by the company Catedral, which had been in existence for only a few months. They don't do it manually, they do it by automating AIAI agent.
AIAI agent was released into the network. They are like dogs with digital smell, automatically scan, automatically analyze, and automatically search for cracks.
It's only been running for less than 12 hours, and the break-through is happening.
Third-party enterprise software for administration, sales follow-up and day-to-day operations has become the deadliest of Achilles.
AZAI agent, following the security loopholes in these ordinary commercial software, crossed the Anthropic moat unscathed and directly infiltrated the internal system network.
Line of defense, instant breakdown.
What did AZAI agent see after the invasion?
According to Catedral ' s draft report, which was consulted in the Washington Post, the invasion directly touched Anthropic ' s sales, HR (human resources) and IT systems.
The list of data is impressive, including the transcript of the meeting, details of remuneration and admissions, and internal Slack news.
The worst news is from inside Slack. Staff members on the Slack chat record on the Anthropic Advanced AI model are completely open.
In technology companies, Slack is the actual "digital brain." Countless code logic, vomiting of non-publish models, analysis of competitors are flowing here without reservation.
Having Slackpermission is equivalent to getting the company's "diary book".
Fortunately, the core assets were preserved.
Anthropic official then made an emergency "outbreaker". They confirmed the authenticity of the invasion and acknowledged that Cathedral did visit “limited data” in the sales, HR and IT systems, including business contact information for some clients and partners, as well as base user account records.
But Anthropic has repeatedly emphasized a red line:
The client's message to Claude was not leaked. Core code, no leak.
Model Weights, absolutely untouched.
The weight of the model is the life of AI, the "nuclear weapons-grade material".
If the weight was stolen, it would be equivalent to handing over the multi-billion dollar AI model.
Although the "nuclear button" is still in place, the perimeter position was completely compromised within 12 hours, enough to wipe out Anthropic.
But Anthony couldn't swallow it when he was pointed at his nose and yelled at it as if it was a paper line.
While acknowledging the invasion, Anthropic responded with intense publicity.
Anthropic claims that prior to Cathadral ' s submission of its report, the company ' s surveillance system detected unusual activity on the same day and decisively cut off access to permission.
Anthropic accused Cathedral of exaggerating the "implicited national security implications" of these discoveries. Sniper dialogue line is: You just want to step on us, exaggerate, sell your safety products, create panic.
In the draft report, the spokesman for Catedral left a cold sentence: “Researchers have kept data access to absolute minimum according to best practice in safety research”.
It goes without saying: not only are we in, but we're being generous; if you don't have access control, your underpants are gone.
This ripping off each other and ripping off the beautiful veil of the AI industry.
Alex Stamos, Chief Information Security Officer and former Director of the Stanford Internet Observatory, Inc., an AI Program Original, reviewed Catedral's report and gave a fatal assessment:
They found a very serious problem. It's a very difficult problem, but Anthropic could have done much better.
The incident revealed one of the most terrible truths in the current AI industry:
Hackers don't have to go to your toughest security door. They just have to take care of your delivery boy.
The power of Catedral's AZAI agent is based on the use of the "third-party enterprise software" loophole.
Today ' s AI giants often devote 99 per cent of their security budgets and energy to protecting model weights and core algorithms. They set up an indestructible vault.
However, HR of the company was still paid, sales were still followed by customers and employees were still talking on Slack.
This requires access to a large number of ordinary commercial software.
Once the ordinary administrative software is torn open, it becomes a springboard for the attackers to move horizontally to the internal network.
Cathedral warns:
The fact that weaknesses in ordinary enterprise software could endanger the infrastructure of the most advanced organizations should be a wake-up call for each enterprise.
The emerging attack capability is increasing and the defence system is not keeping pace.
Anthropic's focus on security is famous.
This does highlight the question of where and in what way does AI use third-party SaaS services? At least for the time being, there seems to be little service that can be really reassuring.
As early as last month, the employee of Anthropic, Jacob Coxon, issued a warning to whistleblowers by resigning publicly.
He strongly criticized the company ' s lack of accountability in dealing with dangerous AI technologies and its excessive reliance on traditional commercial software.
And he said, “This is an arrogant gamble, and it is not from the Slack of a private company.”
Not only Anthropic. Earlier this month, the FBI arrested an Open AI employee who planted recording equipment in the company ' s executive conference room.
A similar incident occurred in Open AI, where three fellows used the Claude chain to exploit two loopholes to take over the ChatGPT and Codex accounts of several Open AI employees.
The internal management weaknesses of the AI giant have reached appalling proportions.
If Cathedral broke Anthropic, it was a commercial test. If the intelligence agencies of another country had broken Anthropic, it would have been a national disaster.
This test report is currently being urgently circulated within the United States Government at a high level.
AI technology has been recognized by the United States government and its hands as "the key to maintaining or challenging global power". The strategic value of the front-line AI model has been equated with nuclear weapons.
An anonymous senior government official in the Trump administration expressed extreme shock and concern during the interview.
He could not believe that the sensitive system of an enterprise with "materials of near-nuclear-weapon grade" had been pushed into it for such a short period of time.
The official said something that cooled the back of Washington:
“If a group of young people who have just started a company can do this, others may not be far from it.”
This is why the Trump government is eager to work with Catedral to advance the anti-AI scenario.
When the instruments of attack evolved from human hackers to an AZAI agent that could try tens of thousands of infiltration routes every second, the traditional system of cyber-security defence was rendered ineffective.
What's going on?
This is an armed "Digital Special Forces" with a strong official background.
We do not traffic in fear, we provide clear judgement.
We simulate the way real attackers think and act, so that defence teams are trained in close combat environments, and so that management is properly aware of its ability to withstand attacks and resume operations.
Founder Gavin Kliger, with a very hard curriculum vitae. After his appointment to the United States Department of Government Efficiency DOGE, he served directly as Chief Data Officer in the Pentagon (United States Department of Defense).
This group of people is a tough player who has really seen the best data confrontation in the State violence machine.
Only a few months after its establishment, the company has mobilized $160 million in financing from investors and the valuation has skyrocketed to $1.4 billion.
The Silicon Valley Chaplain Father, Marc Andressen and Shaun Maguire, sit on the board of the town company themselves.
According to senior government officials in Trump, three United States federal agencies have recently signed a contract with Catedral for cybersecurity services.
During his tenure in the Pentagon, Gavin Kliger repeatedly participated in a "situation" at the top of the United States:
What would happen if a foreign country obtained research information from the forward AI laboratory in Silicon Valley?
Today, he resigned to the sea and founded Catedral, proving for 12 hours to the whole of the United States: this is only half a day away from reality from the end of the day, which would have existed only in the game of chess.
References:
Editor: David
I don't like it.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.