AI agents黑入了Anthropic，制造了可以说最有能力的AI网络防御模型
关键点
-网络安全起动大教堂使用AI agents通过第三方商业软件闯入了Anthropic的内部系统，作为Claude开发者自己的bug赏金程序的一部分。
- 教堂称 AI agents在数小时内发现了Slack消息，工资数据等内部记录。 Anthropic 称的尝试持续了好几天，并坚持源代码和模型重量从未被曝光。
- 事件显示是一个日益严重的威胁：AI agents现在可以以最低的成本24小时地探测公司网络，甚至Anthropic也不安全。
网络安全启动大教堂利用AI agents通过第三方商业软件来渗透到Anthropic的内部系统，利用AI实验室自己的bug赏金程序来暴露出主要的弱点。
大教堂在由"华盛顿邮报"审查的报告草稿中报告了其获取内部数据和消息系统的情况。 由美国政府效率机构DOGE的前员工所创立的起步器向政府机构和企业出售AI动力安全工具。
Cathedral的研究人员通过外部管理和销售程序进入。 根据他们的报告，运行高级模型的AI agents在不到12小时的时间里找到了满足记录誊本，工资数据，职位张贴，以及Slack消息的途径。
Anthropic证实，研究人员访问了一系列有限的销售、人力资源和信息技术系统，包括一些客户和伙伴的联系信息以及基本用户账户数据。 与Claude的聊天，源代码，和模型重量从未被曝光，公司称。 Anthropic在发现漏洞的同一天关闭了受影响的接入点，将第三方程序禁用到问题解决后，并通知了美国联邦当局。
Anthropic和Cathedral对突破持续了多久和达到什么程度有分歧
称大教堂事件耗时不到12小时。 Anthropic 称攻击企图持续了好几天。 Anthropic自己的系统经过了好几天的探测后，根据Anthropic红队球员Logan Graham的说法，起动支线才转投第三方软件。 在那里，大教堂发现了两个弱点，但只报告了一个弱点。 Anthropic 称它自己发现并补补了第二个。
Anthropic还指责大教堂通过不完全披露违反了bug赏金程序的规则。 Graham补充说，针对第三方供应商和提取数据超出了该方案的安全港规定，尽管他欢迎发现这些弱点。 大教堂坚持遵循标准的安全研究做法。
实际获得的数据数量仍有争议。 前OpenAI员工威尔·德普(Will Depue)称Anthropic在轻描淡写事件，表示他认为高度可靠的几个消息来源告诉他大教堂获得了Slack工作空间的完全管理员权限，可以读取每条消息，也可以登录到任何用户账户。
Anthropic和OpenAI两个实验室都将其所有研究秘密都存储在了Slack，德普也添加了，管理API密钥分散在其系统中。 2026年9月离开公司的Anthropic员工雅各布·克克森(Jacob Coxon)此前曾批评Anthropic在Slack等办公室软件上进行危险的AI研究。
Graham推后，说德普的来源是错误的。 他以此事的敏感性为例，拒绝了解具体情况，但证实了德普的核心关切：该行业现在必须每年重塑安全。
Depue)按着详细要求，询问究竟哪一个声称是假的，并呼吁Anthropic披露大教堂实际访问的内容。 他还将问题归咎于AI赛事的节奏，其中高管们将速度优先于安全。
使用Anthropic模型的AI起动Cognition的首席安全官Alex Stamos告诉"华盛顿邮报"，他认为调查结果意义重大。 他指出，综合性第三方应用是整个行业的一个主要问题，Anthropic本可以更好地确保其外部服务。
AI agents正在改变网络安全
经过数月的AI强力网络攻击和自身意外安全事件的警告后，Anthropic现在处于接收端。 AI agents正在改变网络攻击如何运作，而这一突破显示的转速如何快。 也不仅仅是任何突破，因为Anthropic很可能是防守AI所主导的攻击的最佳装备公司。
格雷厄姆利用这一时刻警告说，袭击者已经全天候运行了AI agents，具体针对的是外部依赖性。 即使是现在的前沿背后的半代到一整代的模型，都足以进行这些攻击，他称，未来的对手将不可避免地拥有更强大的系统来支配。
Graham的答案是连续进行内部穿透测试并用正式的验证重建软件，现在AI使这个软件在经济上可行。 "你可能一直想自己红队" 目前的模型很有创意，"格雷厄姆写道。
尽管Anthropic可以访问全球最强大的网络防御AI模型
AI News Without the Hype – 由人类治愈
订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。
现在订阅
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
AI agents hacked Anthropic, maker of arguably the most capable AI models for cyberdefense
Key Points
- Cybersecurity startup Cathedral used AI agents to break into Anthropic's internal systems through third-party business software as part of the Claude developer's own bug bounty program.
- Cathedral says AI agents found Slack messages, salary data, and other internal records within hours. Anthropic says the attempts lasted several days and insists that source code and model weights were never exposed.
- The incident shows a growing threat: AI agents can now probe corporate networks around the clock at minimal cost, and even Anthropic isn't safe.
Cybersecurity startup Cathedral used AI agents to infiltrate Anthropic's internal systems through third-party business software, exploiting the AI lab's own bug bounty program to expose major vulnerabilities.
Cathedral reported its access to internal data and messaging systems in a draft report reviewed by The Washington Post. The startup, founded by former employees of DOGE, the U.S. government efficiency agency, sells AI-powered security tools to government agencies and businesses.
Cathedral's researchers got in through external admin and sales programs. According to their report, AI agents running advanced models found paths to meeting transcripts, salary data, job postings, and Slack messages in under twelve hours.
Anthropic confirmed that the researchers accessed a limited set of sales, human resources, and IT systems, including contact information for some customers and partners along with basic user account data. Chats with Claude, source code, and model weights were never exposed, the company said. Anthropic shut down the affected access points the same day it found the breach, disabled the third-party programs until the issue was resolved, and notified U.S. federal authorities.
Anthropic and Cathedral disagree on how long the breach lasted and how far it reached
Cathedral says the incident took less than twelve hours. Anthropic says the attempted attack stretched over several days. Only after days of probing Anthropic's own systems did the startup pivot to third-party software, according to Anthropic red teamer Logan Graham. There, Cathedral found two vulnerabilities but reported only one. Anthropic says it discovered and patched the second on its own.
Anthropic also accuses Cathedral of violating the bug bounty program's rules through incomplete disclosure. Graham added that targeting third-party providers and pulling data went beyond the program's safe harbor provisions, though he welcomed the discovery of the vulnerabilities. Cathedral maintains it followed standard security research practices.
How much data was actually accessed is still disputed. Former OpenAI employee Will Depue has claimed that Anthropic is downplaying the incident, saying several sources he considers highly reliable told him Cathedral gained full admin access to the Slack workspace, could read every message, and could log into any user account.
Both the Anthropic and OpenAI labs stored all of their research secrets in Slack, Depue added, with admin API keys scattered across their systems. Jacob Coxon, an Anthropic employee who left the company in September 2026, had previously criticized Anthropic for running dangerous AI research on office software like Slack.
Graham pushed back, saying Depue's sources were wrong. Citing the sensitivity of the matter, he declined to get into specifics but confirmed Depue's core concern: the industry now has to reinvent its security every year.
Depue pressed for details about exactly which claims were false and called on Anthropic to disclose what Cathedral actually accessed. He also blamed the problem on the pace of the AI race, where executives prioritize speed over security.
Alex Stamos, chief security officer at the AI startup Cognition, which uses Anthropic's models, told the Washington Post that he considered the findings significant. He noted that integrated third-party apps are a major problem across the industry and that Anthropic could have done a better job securing its external services.
AI agents are transforming cybersecurity
After months of warnings about AI-powered cyberattacks and its own accidental security incidents, Anthropic is now on the receiving end. AI agents are changing how cyberattacks work, and this breach shows how fast the shift is happening. It's also not just any breach, since Anthropic is likely the company best equipped to defend itself against AI-led attacks.
Graham used the moment to warn that attackers already run AI agents around the clock, specifically targeting external dependencies. Even models half a generation to a full generation behind the current frontier are capable enough for these attacks, he said, and future adversaries will inevitably have more powerful systems at their disposal.
Graham's answer is continuous in-house penetration testing and rebuilding software with formal verification, which AI now makes economically viable. "You probably want to red team yourself all the time. Current models are very creative," Graham wrote.
What he did not address is how Cathedral managed to penetrate this deeply despite Anthropic having access to what are arguably the world's most powerful AI models for cyberdefense.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.