《华盛顿邮报》查阅的一份 Cathedral 报告草稿称，研究人员运行 AI Agent 不到 12 小时，就找到了进入 Anthropic 内部系统的路径。Anthropic 随后确认，Cathedral 研究人员访问了公司销售、人力资源和 IT 系统中的部分数据；公司称，客户与 Claude 的对话、模型回复、源代码和模型权重均未被访问。
不到 12 小时，研究人员通过商业软件漏洞进入 Anthropic 系统
据《华盛顿邮报》查阅的报告草稿，Cathedral 近日向 Claude 聊天机器人的开发商 Anthropic 通报，其研究人员发现了进入这家 AI 公司内部数据和消息系统的路径。
Cathedral 由美国政府效率部（DOGE）的前成员创立，为美国政府和企业客户提供 AI 驱动的网络安全工具。报告称，研究人员利用了 Anthropic 和许多其他公司用于行政及销售工作的商业软件漏洞。
运行 AI Agent 不到 12 小时后，研究人员便找到了访问 Anthropic 内部数据的路径。Cathedral 的报告称，这些数据包括会议记录、薪酬和工作邀请详情，以及讨论 Anthropic 先进 AI 模型的 Slack 消息。Cathedral 是通过 Anthropic 的一项安全测试计划开展测试的；该计划允许外部网络安全专家测试公司的系统。
Anthropic 在声明中确认，Cathedral 研究人员访问了公司销售、人力资源和 IT 系统中的“有限数据”。公司称，研究人员接触到的内容包括部分客户和合作伙伴的商业联系信息，以及一些基础用户账户记录。
Anthropic 同时表示，研究人员无法访问客户发给 AI 模型的消息、模型返回的回复，也无法访问公司 AI 系统背后的代码或“模型权重”。因此，Cathedral 报告中提到的会议记录、薪酬信息和 Slack 消息，与 Anthropic 对实际访问范围的描述并不完全相同。
Anthropic 称，公司监控系统在 Cathedral 报告之前就发现了部分活动，并在当天关闭了相关访问权限。公司还表示，没有证据显示 Cathedral 以外的人员利用了这些漏洞。
漏洞来自第三方软件，双方对披露过程说法不同
Cathedral 通过 Anthropic 的网络安全测试计划披露了相关发现。该计划会向报告漏洞的安全研究人员提供奖励。报告草稿称，Cathedral 也通知了相关商业软件供应商，但出于安全考虑，没有公开这些公司的身份。
Anthropic 表示，公司禁用了涉及的商业软件，直到供应商确认漏洞已经修复后才重新启用。Cathedral 报告则称，研究人员“依照安全研究最佳实践，将数据访问量控制在绝对最低限度”。
双方对测试过程是否符合计划规则也有不同说法。Anthropic 认为，Cathedral 夸大了这些发现所“暗示的国家安全影响”，并称这家初创公司没有完整披露其在 Anthropic 系统中的全部活动，因此没有完全遵守漏洞奖励计划的规则。
一名 Cathedral 发言人拒绝置评。接近该公司的消息人士称，研究人员尝试访问 Anthropic 系统，是为了揭示美国领先 AI 开发商面临的安全挑战。由于发现涉及敏感信息，这名人士要求匿名。
AI 编程初创公司 Cognition 的首席信息安全官 Alex Stamos 应《华盛顿邮报》请求审阅了 Cathedral 的发现。他说：“他们发现了一个很严重的问题。”Stamos 曾任斯坦福大学网络政策中心下属斯坦福互联网观察站主任。
Stamos 认为，将第三方应用连接到公司系统所带来的风险，是“所有人都面临的巨大问题”。他说，Cathedral 的发现暴露出 Anthropic 管理外部软件供应商使用方式上的“漏洞”，“这是一个非常难解决的问题，但 Anthropic 本可以做得好得多”。Cognition 使用 Anthropic 及其他 AI 公司的模型。
事件引发对 AI 公司安全防护的担忧
Cathedral 的发现，让外界再次关注 AI 公司依赖第三方企业软件所带来的安全风险。普通商业软件一旦出现漏洞，可能成为攻击者进入大型科技公司内部系统的入口。Cathedral 在报告草稿中称，这一事件“揭示了一个严重差距：新兴的攻击能力正在增强，而防御体系没有跟上”。
报告还写道：“普通企业软件中的弱点竟能危及最先进组织的基础设施，这一事实应当为每一家企业敲响警钟。”
本月早些时候，联邦调查局逮捕了一名 ChatGPT 开发商 OpenAI 的员工。该员工涉嫌在一间高管会议室里放置录音设备。上个月，曾借助 Anthropic 的 Claude 聊天机器人侵入 OpenAI 系统的黑客警告称，AI 行业尚未准备好应对自身技术带来的安全风险。
Cathedral 由 DOGE 前成员创立，正寻求政府合同和私营部门机会。投资者对这家公司的估值为 14 亿美元。Cathedral 联合创始人 Gavin Kliger 在 DOGE 任职后，曾担任五角大楼首席数据官。
据数据公司 PitchBook，Cathedral 已从投资者处融资 1.6 亿美元。知名投资人 Marc Andreessen、Shaun Maguire 均在该公司董事会任职。
Anthropic 员工 Jacob Coxon 上个月公开辞职。他表示，自己担心 Anthropic 在处理危险 AI 技术时不够负责，其中包括依赖传统商业软件。他在 X 上发文称，公司押下了“一场傲慢的赌局，而这不该从一家私营公司的 Slack 上发起”。Slack 是 Anthropic 和许多其他科技公司使用的商业消息工具。
消息来源：
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
According to a Washington Post review of a Catedral draft report, researchers run AI Agent for less than 12 hours and find a way into the Anthropic internal system. Anthropic subsequently confirmed that Cathedral researchers had visited some of the data in the company ' s sales, human resources and IT systems; the company stated that neither the client nor Claude had been visited for his conversations, model responses, source code or model weights.
Less than 12 hours, researchers enter the Anthropic system through a commercial software loophole
According to the draft report consulted in the Washington Post, Catedral recently informed Claude chat robot developer Anthropic that its researchers had discovered access to the data and information system within AI.
Catedral was created by a former member of the United States Government Department of Efficiency (DOGE) to provide an AI-driven cybersecurity tool for the United States Government and corporate clients. The report states that researchers have used commercial software loopholes in Anthropic and many other companies for administrative and marketing purposes.
After less than 12 hours running AI Agent, researchers find a path to access Anthropic internal data. Catedral reports that these data include minutes of meetings, details of remuneration and work invitations, and Slack messages discussing the Anthropic Advanced AI model. Cathedral was tested through a security test programme in Anthropic, which allowed external network security experts to test the company ' s systems.
In its statement, Anthropic confirmed that Cathedral researchers had visited “limited data” in company sales, human resources and IT systems. According to the company, the researcher was exposed to commercial contact information from some clients and partners, as well as some basic user account records.
At the same time, Anthropic indicates that researchers are unable to access the information sent to the AI model by their clients, the responses to the return of the model, or the code or " model weight " behind the company AI system. Thus, the minutes of meetings, remuneration information and Slack information referred to in Catedral ' s report are not exactly the same as Anthropic ' s description of the actual scope of access.
Anthropic states that the company ' s surveillance system discovered some of its activities prior to Catedral ' s report and closed the visit to permission on the same day. The company also stated that there was no evidence that persons other than Catedral had exploited those loopholes.
The leaks came from third-party software, and the disclosure process was described differently.
Cathedral disclosed the findings through the Anthropic Cyber Security Testing Program. The scheme will provide incentives to security researchers who report loopholes. The draft report states that Cathedral also informed the relevant commercial software suppliers, but that the identity of the companies was not disclosed for security reasons.
Anthropic states that the company banned the commercial software in question until the supplier confirmed that the loophole had been repaired. According to the Catedral report, researchers “have kept data access to an absolute minimum in accordance with best practice in safety research”.
Different statements were made as to whether the test process was in accordance with the rules of the plan. According to Anthropic, Cathedral exaggerates the “implicited national security implications” of these findings and claims that the original company did not fully disclose all its activities in the Anthropic system and therefore did not fully comply with the rules of the leakage incentive scheme.
A Catedral spokesman refused to comment. According to sources close to the company, researchers tried to access the Anthropic system to reveal the security challenges faced by the leading AI developers in the United States. As sensitive information was found, the person requested anonymity.
Alex Stamos, the chief information security officer of AI Program Original, reviewed the findings of Catedral at the request of the Washington Post. He said, “They found a serious problem.” Stamos was the director of Stanford Internet Observatory, a network policy centre at Stanford University.
According to Stamos, the risk of connecting third-party applications to corporate systems is “a huge problem for all”. He said that Cathedral's discovery revealed an “a gap” in the way in which Anthropic managed external software providers, “it was a very difficult problem, but Anthropic could have done much better”. Cognition uses the Anthropic and other AI models.
The incident raised concerns about the security of AI.
Cathedral's discovery has drawn renewed attention to the security risks associated with AI's reliance on third-party enterprise software. Once there is a loophole in ordinary commercial software, it can become an entry point for the attacker to the system within large technology companies. In its draft report, Catedral states that the incident “discovered a serious gap: The emerging attack capability is increasing and the defence system is not keeping pace”.
The report also states that “the fact that weaknesses in common enterprise software can endanger the infrastructure of the most advanced organizations should be a wake-up call for every enterprise”.
Earlier this month, the FBI arrested an employee of ChatGPT developer Open AI. The employee was suspected of placing a recording device in a senior management conference room. Last month, hackers who hacked the Open AI system with a Claude chat robot from Anthropic warned that the AI industry was not ready to deal with the security risks posed by its technology.
Cathedral was created by former members of DOGE and is seeking government contracts and private sector opportunities. Investors valued the company at $1.4 billion. Cathedral co-founder Gavin Kliger served as the Chief Data Officer of the Pentagon after his appointment to DOGE.
According to the data company PitchBook, Cathedral has financed $160 million from investors. Marc Andressen and Shaun Maguire are well-known investors on the board of directors of the company.
Anthropic employee Jacob Coxon resigned publicly last month. He stated that he was concerned that Anthropic was not responsible for handling hazardous AI technologies, including relying on traditional commercial software. He wrote on X that the company had put in “an arrogant gamble, which should not be launched from a private company's Slack”. Slack is a business information tool used by Anthropic and many other technology companies.
Source:
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.