AI agents黑进了Anthropic，制造了可以说最有能力的AI网络防御模型
关键点
- 网络安全启动大教堂使用AI agents通过第三方商业软件闯入Anthropic的内部系统，作为Claude开发者自己的bug赏金程序的一部分。
- 大教堂称 AI agents在数小时内发现了Slack消息，工资数据，以及其他内部记录。 Anthropic 称的尝试持续了数天，并坚持源代码和模型重量从未曝光。
- 事件显示是一个日益严重的威胁：AI agents现在可以以最低的成本24小时地探测公司网络，甚至Anthropic也不安全。
网络安全启动大教堂利用AI agents通过第三方商业软件潜入Anthropic的内部系统，利用AI实验室自己的bug赏金程序来揭露重大弱点。
大教堂在《华盛顿邮报》审查的报告草稿中报告了它使用内部数据和通讯系统的情况。 由美国政府效率机构DOGE的前员工创办的创业者向政府机构和企业出售AI授权的安全工具。
大教堂的研究人员通过外部管理和销售程序进入。 根据他们的报告，运行高级模型的AI agents在不到12小时的时间里找到了满足记录、工资数据、职位张贴和Slack信息的途径。
Anthropic证实，研究人员进入了有限的一套销售、人力资源和信息技术系统，包括一些客户和伙伴的联系信息以及基本用户账户数据。 与Claude的聊天，源代码，模型重量从未曝光，公司称。 Anthropic在发现漏洞的当天关闭了受影响的接入点，在问题解决之前将第三方程序禁用，并通知美国联邦当局。
Anthropic和Cathedral对突破持续了多久和达到什么程度有分歧
称大教堂事件耗时不到12小时。 Anthropic 称攻击企图持续数日。 Anthropic自己的系统经过数天的探测后，启动支线才转投第三方软件，据Anthropic红队队员Logan Graham说。 在那里，大教堂发现了两个弱点，但只报告了一个弱点。 Anthropic 称它自己发现并补补了第二个。
Anthropic还指责大教堂通过不完全披露违反了bug赏金程序的规则。 Graham补充说，针对第三方供应商和提取数据超出了该方案的安全港规定，尽管他欢迎发现这些弱点。 大教堂坚持遵循标准的安全研究做法。
实际获得的数据数量仍有争议。 前OpenAI员工Will Depue称Anthropic在淡化事件，称他认为高度可靠的几个消息来源告诉他大教堂获得了Slack工作空间的完全管理员权限，可以读取每条消息，还可以登录到任何用户账户。
Anthropic和OpenAI实验室都将其所有研究秘密存储在Slack,Depue添加，管理API密钥分散在其系统中。 2026年9月离开公司的Anthropic员工雅各布·考克森(Jacob Coxon)此前曾批评Anthropic对Slack等办公室软件进行危险的AI研究。
Graham推后，说Depue的消息来源是错误的。 他以此事的敏感性为例，拒绝了解具体情况，但证实了德普的核心关切：该行业现在必须每年重新建立安全。
德普按下详细信息，询问究竟哪一个声称是假的，并呼吁Anthropic披露大教堂实际访问的内容。 他还把问题归咎于AI赛事的节奏，高管们将速度放在安全之上。
使用Anthropic模型的AI启动Cognition的首席安全官Alex Stamos告诉华盛顿邮报，他认为这些发现意义重大。 他指出，综合性第三方应用是整个行业的一个主要问题，Anthropic本可以更好地确保其外部服务。
AI agents正在改变网络安全
Anthropic在数月后，AI agents正在改变网络攻击如何运作，这一突破显示的转速如何快。 也不仅仅是任何突破，因为Anthropic很可能是最有能力防御AI主导的攻击的公司。
格雷厄姆利用这一时刻警告说，袭击者已经全天候运行AI agents，具体针对外部依赖。 即使是现在的前沿背后的半代到全代的模型，都足以进行这些攻击，他称，未来的对手将不可避免地拥有更强大的系统可供他们使用。
Graham的答案是连续的内部渗透测试和重建软件，并进行正式的验证，而AI现在在经济上是可行的。 "你可能总是想自己红队。 目前的模型很有创意，"格雷厄姆写道。
尽管Anthropic可以访问全球最强大的网络防御AI模型
AI News Without the Hype – 由人类治愈
订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。
现在订阅
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
AI agents hacked Anthropic, maker of arguably the most capable AI models for cyberdefense
Key Points
- Cybersecurity startup Cathedral used AI agents to break into Anthropic's internal systems through third-party business software as part of the Claude developer's own bug bounty program.
- Cathedral says AI agents found Slack messages, salary data, and other internal records within hours. Anthropic says the attempts lasted several days and insists that source code and model weights were never exposed.
- The incident shows a growing threat: AI agents can now probe corporate networks around the clock at minimal cost, and even Anthropic isn't safe.
Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities.
Cathedral reported its access to internal data and messaging systems in a draft report reviewed by The Washington Post. The startup, founded by former employees of DOGE, the U.S. government efficiency agency, sells AI-powered security tools to government agencies and businesses.
Cathedral's researchers got in through external admin and sales programs. According to their report, AI agents running advanced models found paths to meeting transcripts, salary data, job postings, and Slack messages in under twelve hours.
Anthropic confirmed that the researchers accessed a limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data. Chats with Claude, source code, and model weights were never exposed, the company said. Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities.
Anthropic and Cathedral disagree on how long the breach lasted and how far it reached
Cathedral says the incident took less than twelve hours. Anthropic says the attempted attack stretched over several days. Only after days of probing Anthropic's own systems did the startup pivot to third-party software, according to Anthropic red teamer Logan Graham. There, Cathedral found two vulnerabilities but reported only one. Anthropic says it discovered and patched the second on its own.
Anthropic also accuses Cathedral of violating the bug bounty program's rules through incomplete disclosure. Graham added that targeting third-party providers and pulling data went beyond the program's safe harbor provisions, though he welcomed the discovery of the vulnerabilities. Cathedral maintains it followed standard security research practices.
How much data was actually accessed is still disputed. Former OpenAI employee Will Depue has claimed that Anthropic is downplaying the incident, saying several sources he considers highly reliable told him Cathedral gained full admin access to the Slack workspace, could read every message, and could log into any user account.
Both the Anthropic and OpenAI labs stored all of their research secrets in Slack, Depue added, with admin API keys scattered across their systems. Jacob Coxon, an Anthropic employee who left the company in September 2026, had previously criticized Anthropic for running dangerous AI research on office software like Slack.
Graham pushed back, saying Depue's sources were wrong. Citing the sensitivity of the matter, he declined to get into specifics but confirmed Depue's core concern: the industry now has to reinvent its security every year.
Depue pressed for details about exactly which claims were false and called on Anthropic to disclose what Cathedral actually accessed. He also blamed the problem on the pace of the AI race, where executives prioritize speed over security.
Alex Stamos, chief security officer at the AI startup Cognition, which uses Anthropic's models, told the Washington Post that he considered the findings significant. He noted that integrated third-party apps are a major problem across the industry and that Anthropic could have done a better job securing its external services.
AI agents are transforming cybersecurity
After months of warnings about AI-powered cyberattacks and its own accidental security incidents, Anthropic is now on the receiving end. AI agents are changing how cyberattacks work, and this breach shows how fast the shift is happening. It's also not just any breach, since Anthropic is likely the company best equipped to defend itself against AI-led attacks.
Graham used the moment to warn that attackers already run AI agents around the clock, specifically targeting external dependencies. Even models half a generation to a full generation behind the current frontier are capable enough for these attacks, he said, and future adversaries will inevitably have more powerful systems at their disposal.
Graham's answer is continuous in-house penetration testing and rebuilding software with formal verification, which AI now makes economically viable. "You probably want to red team yourself all the time. Current models are very creative," Graham wrote.
What he did not address is how Cathedral managed to penetrate this deeply despite Anthropic having access to what are arguably the world's most powerful AI models for cyberdefense.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Auto-fetched and translated by AI Atlas. All rights belong to the original author.