Anthropic says Cathedral exceeded its security testing program

Anthropic, which makes the Claude AI assistant, says cybersecurity startup Cathedral’s testing lasted several days and exceeded its bug bounty program for reporting security flaws. A spokesperson told The Independent on October 28 that Cathedral went substantially beyond the program by targeting third-party applications. Direct company response

Cathedral said AI agents found paths to Anthropic’s business systems and Slack messages in under 12 hours, according to Decrypt’s account of Washington Post reporting.

Decrypt published its account on October 26; The Independent’s additional company response appeared on October 28. These are reporting dates. The reports do not show whether both durations cover the same phase of testing, or give calendar dates for it.

Anthropic’s published policy excludes vendor systems

Anthropic’s public Responsible Disclosure Policy, last updated February 14, 2025, excludes systems owned, operated or controlled by third parties, including providers or contractors even when those systems sit under Anthropic domains. It requires researchers to limit testing to the minimum needed to demonstrate a vulnerability and restricts access to other people’s accounts and communications. Published policy

The document says disclosures made before an update follow the policy in effect at that time. Cathedral’s exact engagement terms have not been established in the public material reviewed here. The published policy supplies context for Anthropic’s objection; the specific authorization Cathedral received remains unresolved.

Slack roles, app credentials and exports differ

Slack, a workplace messaging service, separates roles such as Workspace Admin, Security Admin and Export Admin. Its permissions table gives them different powers. A role that can manage settings does not itself show that its holder can obtain all conversations. Establishing read access requires identifying the role and relevant permissions, or another route into stored messages. Slack’s role guide

Slack apps can also act through a token, a digital credential. A bot token represents an app’s bot; a user token represents a particular user. Both operate with permissions Slack calls scopes. Those permissions describe allowed actions. Knowing only that an app or account was compromised leaves open which credential was available and what it allowed. Slack’s token documentation

For its message-history interface, which lets software retrieve messages, Slack documents different access by token type. A bot needs the required permission and membership in a conversation. A user token with the relevant permission can cover public conversations and private conversations the user belongs to. To establish broader access through this interface, an incident account would need to identify which conversations those credentials could reach. Message-history permissions

Slack’s export tools follow another set of rules. Business+ and Enterprise plans offer exports that can include private channels and direct messages, with separate approval or enabling requirements. Workspace or organization owners must apply for those export types. This process differs from an app fetching conversations it already has permission to read. Anthropic’s Slack subscription, export settings and any export activity during Cathedral’s test have not been verified. Slack’s export guide

OpenAI’s earlier intrusion reached employee discussions

In July 2024, The New York Times reported that a hacker had entered OpenAI’s internal employee discussion forum in early 2023. Citing two people familiar with the episode, it said the intruder took details from employee discussions about AI technology but did not reach systems where the company housed and built its models. Staff learned of the incident in April 2023. The Times report, syndicated by WRAL

The reported target was an employee forum. The account does not identify Slack or establish the same method of entry as Cathedral’s testing.

What a fuller incident account would need to show

Slack’s Enterprise audit interface can record administrative and access-related actions, identifying an actor, action and affected item. It provides only a subset of possible events and does not expose message content or automatically decide whether an action was appropriate. Slack’s audit documentation

Public accounts leave concrete questions unanswered: which vendors and dates were involved, whether Cathedral obtained credentials, and which records, if any, its researchers viewed. A technical incident report with a dated timeline, affected services and demonstrated permissions would let readers assess the reach of the test and Anthropic’s objection to how it was conducted.