Anthropic has started telling some business customers that an outside security firm got into its internal business systems in October. Some account and contact details may have been viewed.
Anthropic says Claude conversations, payment data, source code and model weights were not touched. Here is what is confirmed, what is still unclear, and what Claude admins should do this week.
- Who got in: researchers at security startup Cathedral, through flaws in third-party business software Anthropic uses.
- What they reached: a “limited set” of Anthropic’s sales, HR and IT systems, per Anthropic.
- Customer data at risk: account and organization IDs, business contact names and emails, and plan details.
- Not touched: prompts, Claude outputs, payment information, source code and model weights.
- Scale: about 100 South Korean enterprise accounts in one regulator filing; no global count yet.
- Admin action: warn your contacts about phishing, verify any billing request, and review access controls.
What Happened
On October 26, 2026, The Washington Post reported on a draft report by Cathedral, a young cybersecurity startup. Cathedral said its AI agents found routes into Anthropic’s business systems in under 12 hours.
The route was not through Claude itself. Cathedral says it used weaknesses in ordinary third-party business tools, such as admin and sales software, that Anthropic relies on.
What Anthropic confirmed
Anthropic confirmed that researchers reached a limited set of its sales, human resources and IT systems. It says its monitoring flagged some of the activity before Cathedral reported it.
Anthropic says it cut off the exposed paths on the day it found them. It also disabled the affected software until the vendors fixed the flaws.
The dispute over the rules
The work happened under Anthropic’s program for outside security testing. Anthropic says Cathedral broke the program’s rules by not disclosing all of its activity, and that Cathedral overstated the national security risk.
Cathedral says it kept data access “to the absolute minimum” and followed research norms. Public reporting has not settled who is right.
Timeline
Here is the sequence as reported by The Washington Post, Korean media and Anthropic staff. Some dates are approximate because Anthropic has not published a full incident report.
| Date (2026) | Event |
|---|---|
| Late October | Cathedral reaches Anthropic’s sales, HR and IT tools; Anthropic blocks access the day it finds it |
| October 26 | The Washington Post reports the intrusion; Anthropic confirms limited access |
| October 31 | Anthropic reports about 100 Korean enterprise accounts to Korea’s privacy regulator (PIPC) |
| November 5 | Anthropic ships new Enterprise security controls, including a self-serve IP allowlist (beta) |
| About November 7 | Anthropic starts emailing some business customers about possible exposure |
| November 8 | Anthropic’s Lydia Hallie posts on X about what was and was not accessed |
| November 9 | The PIPC confirms a preliminary review, not yet a formal investigation |
Note: Anthropic has not said the November 5 security features were a response to this incident. They were announced as part of a wider Enterprise security update.
What Data Was Exposed (and What Was Not)
This is the part admins care about most. The confirmed list is short, but there are a few reported items that Anthropic has not confirmed in public.
Confirmed or stated by Anthropic staff
- Account IDs: account and organization identification numbers.
- Business contacts: names and work email addresses of some customer and partner contacts.
- Plan details: which subscription plan an account is on.
- Basic user account records: as described in Anthropic’s October statement.
Stated as not accessed
- Prompts and outputs: Hallie wrote that Cathedral “did not touch prompts, outputs or payment information.”
- Payment data: no card or bank details.
- Source code and model weights: per Anthropic’s October 26 statement.
- Passwords: none of the reporting says login passwords were in the affected systems.
Reported but not confirmed
Some summaries of the customer email say usage or spend data may also have been visible. Anthropic has not confirmed this in a public statement, so treat it as possible rather than proven.
Separately, Cathedral’s draft report and some outlets mention employee records and internal messages. That concerns Anthropic staff, not customers, and Anthropic has not confirmed those details.
Who Is Affected
Anthropic has not published a global number of affected customers. The only firm figure so far comes from South Korea.
- Korean enterprise accounts: about 100, per Anthropic’s filing with the PIPC. The regulator says the number may change once it confirms the scale.
- Other regions: Anthropic says it is notifying “some” business customers. Reporting does not say whether other regulators were told.
- Consumer users: nothing in the reporting points to Free, Pro or Max consumer accounts. The focus is enterprise and business accounts.
- Cloud resellers: nothing so far suggests that Claude accounts on Amazon Bedrock, Google Cloud Vertex AI or Microsoft Foundry were involved.
If you are not sure which Claude plan your company is on, our Claude plans comparison explains the tiers.
What Admins Should Do Now
No passwords or chats were reported as exposed, so this is mainly a phishing and fraud risk. Contact names, emails and plan details are exactly what a convincing fake invoice needs.
- Check for the notice. Search your admin, billing and security inboxes for an email from Anthropic sent from November 7 onward. Note which contacts it names.
- Warn named contacts. Tell anyone listed as a billing or admin contact to expect Anthropic-themed phishing, such as fake renewal or “plan upgrade” emails.
- Verify every billing request. Do not act on payment, bank-change or plan-change emails. Log in to the Claude admin console directly and check there instead.
- Review members and admins. In the admin console, remove people who left and check who holds owner or admin roles.
- Review API keys. In the Claude Console, delete unused keys and set expirations. Rotating keys is optional here, since keys were not reported as exposed.
- Turn on stronger controls. Consider SSO, the IP allowlist and member sign-out, covered in the next section.
- Loop in legal and privacy. Ask whether your own contracts or local law need you to log or report a vendor incident like this.
Warning: Treat any email that asks for payment, new bank details or login credentials as a scam until you confirm it inside the console. Attackers love to strike right after a breach makes the news.
Security Controls Worth Turning On
Anthropic announced several Enterprise security features on November 5. None of them would have stopped this specific incident, but they shrink what an attacker can do with stolen contact details.
| Control | Status | What it helps with |
|---|---|---|
| IP allowlist | Beta | API and app access only from your networks; up to 1,000 IPv4/IPv6 entries or CIDR ranges |
| Member sign-out via Admin API | Beta | Ends a member’s sessions on all devices if an account looks phished |
| Security center | Beta | Compares your settings with Anthropic’s recommended setup |
| SSO and SCIM (centralized management) | Beta | Central login and automatic removal of leavers |
| Inference hooks | Generally available | Sends prompts and tool calls to your own data security tools |
Setting up the IP allowlist
Per Anthropic’s docs, an org admin or owner sets it on the Identity and access page of the Claude Console. Blocked API calls get an HTTP 403 permission_error, and changes can take up to 15 minutes.
Tip: Tick the option that lets admins reach the settings page from any IP before you save. It stops you from locking yourself out.
Our full walkthrough is in the Claude Enterprise security controls guide. To spot strange spend after an incident, see our Claude API cost tracking guide.
What We Still Do Not Know
Anthropic has not published a formal incident report. These are the gaps worth watching:
- Global count: how many customers worldwide got the notice.
- Vendor name: which third-party software had the flaw.
- Spend data: whether usage or spend figures were in scope.
- Other regulators: whether EU, UK or US authorities were notified.
- Program changes: whether Anthropic will tighten its outside testing rules.
The PIPC says it will confirm the scale once a formal investigation starts. That may be the first official number we get.
My Take
The headline sounds scarier than the confirmed facts. No chats, no prompts, no payment data. For most admins, the real risk is a well-crafted phishing email that knows your name, your company and your Claude plan.
The bigger lesson is about the supply chain. An AI lab with strong model security was reached through ordinary business software. Every company that uses SaaS tools has the same weak spot.
I would like to see a public incident report with a global count. Until then, warn your contacts, verify bills in the console, and switch on the new controls.
Troubleshooting: Common Problems and Fixes
I did not get an email but I am an Enterprise customer
Anthropic says it is contacting “some” customers, so no email may mean you were not in scope. Ask your Anthropic account team directly to be sure.
I cannot tell if an Anthropic email is real
Do not click links in it. Open the Claude admin console or Console by typing the address yourself, and contact your account team through a channel you already use.
The IP allowlist blocked our own app
Your app’s outbound IP is missing. Add your server or NAT gateway’s public IP, then wait up to 15 minutes for the change to apply.
I locked myself out of the settings page
This happens if the admin bypass option was not ticked. Connect from an allowed network, or contact Anthropic support for help.
Member sign-out did not stop API calls
That is expected. Per Anthropic, sign-out ends browser and device sessions but does not revoke API keys, so delete keys separately in the Console.
Frequently Asked Questions
Was Claude hacked?
No model or chat system was reported as breached. Researchers reached some of Anthropic’s internal sales, HR and IT tools through third-party software.
Were my Claude conversations exposed?
Anthropic says prompts and outputs were not accessed. Customer messages to Claude and Claude’s replies were not in the affected systems.
What customer data may have been viewed?
Account and organization IDs, business contact names and emails, and plan details. Some reports also mention usage or spend data, which Anthropic has not confirmed publicly.
Who is Cathedral?
Cathedral is a cybersecurity startup that tests systems with AI agents. It says its agents reached Anthropic’s business tools in under 12 hours, while Anthropic says it broke its testing program’s disclosure rules.
Do I need to reset passwords or API keys?
Passwords and keys were not reported as exposed. Rotating unused or old keys is still good hygiene, and turning on SSO helps more than a reset.
How many customers are affected?
The only official figure is about 100 enterprise accounts in South Korea, from Anthropic’s filing with the PIPC. Anthropic has not given a global number.
Are Bedrock or Vertex AI customers affected?
Nothing in the reporting so far suggests that Claude accounts on Amazon Bedrock, Google Cloud Vertex AI or Microsoft Foundry were involved.
Sources
- The Washington Post: Researchers at Cathedral got inside Anthropic
- eSecurity Planet: AI agents breached Anthropic’s business systems
- Seoul Economic Daily: Data breach hits about 100 Korean corporate accounts
- PANews: Anthropic reports Claude leak to South Korea
- RuntimeWire: Anthropic notifies customers after security firm access
- Anthropic: More visibility and control over Claude Enterprise
- Claude docs: IP allowlisting
