Bug Bounty
Security incidents tagged Bug Bounty. Newest first.
1 Bug Bounty incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 3 days (Oct 27–Oct 29)
- MediumPartly patched
Cathedral researchers get into Anthropic's sales, HR and IT systems through third-party software
Researchers at Cathedral, a months-old security start-up, got into a limited set of Anthropic's sales, HR and IT systems while testing under Anthropic's external security (bug bounty) program, The Washington Post reported on Oct 26 2026. Cathedral's draft report says its AI agents found paths in through flaws in third-party admin and sales software in under 12 hours, reaching meeting transcripts, salary and job-offer details and Slack messages. Anthropic confirmed access to systems holding business contact details for some customers and partners and basic user account records, but says Claude conversations, source code and model weights were not reached. It says its monitoring flagged the activity, it cut off access the same day, disabled the affected third-party apps until their vendors fixed the flaws, and found no evidence anyone else exploited them. Anthropic also says Cathedral did not disclose all of its testing as the program rules require and overstated the national-security implications.
Anthropic internal business systems (third-party sales, HR and IT software)Since Oct 26, 2026
