Anthropic alerts enterprise customers after disputed security test

By Rebecca Stone

Anthropic’s Nov. 7 notice to enterprise Claude customers says an outside cybersecurity firm may have viewed account IDs, organization IDs, plan tiers, usage, spend metrics and business contact data.

The notice, titled “Notice Regarding Your Organization’s Account Information,” came from an Anthropic Claude email address. Security researcher Jamieson O’Reilly posted it on X on Nov. 7, addressing Anthropic chief executive Dario Amodei and other staff. His post collected more than 1,000 likes within a day.

Anthropic did not name the firm or disclose how many organizations or people were affected. It also said it could not confirm whether any particular person’s information was viewed.

What information was exposed?

For enterprise Claude accounts, the notice listed:

• Account ID
• Organization ID
• Plan tier
• Usage
• Spend metrics

The email said the exposed material was limited to business contact and account information. It excluded the content of customer conversations with Claude, passwords, payment-card information and bank-account information.

The affected fields extend beyond names and email addresses, but the notice did not say how many records the firm took or viewed. That leaves enterprise customers with little basis for determining the incident’s scale.

What did Anthropic do?

Anthropic said it disabled the third party’s access once it became aware of the activity, worked to fix the vulnerabilities the firm identified and opened an investigation.

“The cybersecurity firm has certified in writing that it has deleted the accessed data and will not use it,” Anthropic said in the notice.

Anthropic also said it had found no evidence that customer data had been altered, deleted or misused. It reported the incident to the relevant Korean authorities, although the notice did not explain why Korean authorities received the notification.

The company said it was notifying customers from an abundance of caution and left each organization to decide whether to warn its staff. Anthropic’s inability to confirm whether any individual’s information was viewed leaves that notification decision with the customer.

Is Cathedral responsible?

The unnamed firm’s description closely matches an incident Anthropic confirmed in late October. On Oct. 26, The Washington Post reported that AI agents run by Cathedral, a startup founded by four former Department of Government Efficiency staffers, reached a “limited set” of Anthropic’s sales, HR and IT systems in under 12 hours.

The agents entered through third-party administrative and sales software, not through Claude. Anthropic said those systems contained business contact details and basic user account records for some customers and partners. It said customer conversations, source code and model weights were not accessed.

Cathedral’s work ran through an Anthropic program that rewards outside researchers for reporting flaws. Anthropic said the startup did not fully follow the program’s rules because it failed to disclose all of its activity.

Anthropic told The Washington Post: “Our monitoring flagged some of Cathedral’s activity before they reported it to us,” and said it shut off the startup’s access the same day.

Cathedral’s draft report says it limited data access to the minimum required under security research practices. The draft also described paths to meeting transcripts, salary and offer details and Slack messages, which Anthropic did not confirm.

The customer email describes the outside firm as “conducting a security testing exercise on its own initiative.” Anthropic has not publicly said whether the notices concern Cathedral, and MLQ found no public Anthropic post identifying the firm in its customer notification.

What remains unanswered?

O’Reilly’s follow-up asked who the research firm was and whether Anthropic had reported the access to law enforcement. He also challenged the contrast between Anthropic’s inability to confirm whether any individual’s information was viewed and its position that recipients faced no added risk.

Anthropic’s notice did not identify the firm or say whether law enforcement had been notified. Customers seeking to learn whether their organization’s records appeared in the affected systems have only the privacy email address listed in the notice.

For enterprise customers, the next material facts are the firm’s identity, the number of affected organizations and people, and whether law enforcement becomes involved. Until Anthropic provides them, the notice documents unauthorized access without establishing that any individual’s information was viewed.