Anthropic is emailing customers about Cathedral’s access. What its notice says

What Anthropic’s notice says

On Saturday, November 7, 2026, Anthropic began emailing customers under the subject “Notice Regarding Your Organization’s Account Information.” It hasn’t published the notice or a statement about it, so what’s public comes from copies recipients have shared. Jamieson O’Reilly, a security researcher who says he has spent over $50,000 on Anthropic’s API in six months, posted screenshots of the one he got from “Claude Team” at no-reply@email.claude.com. It opens:

We are writing to inform you that limited information may have been subject to unauthorized access by a third-party cybersecurity research company. The information was limited to business contact and account information, such as name, email address, and plan type if your organization has enterprise Claude accounts.

The rest, in the notice’s own words:

	What the notice says
Who got in	“a third-party cybersecurity research company,” which O’Reilly quotes the notice as saying was “conducting a security testing exercise on its own initiative and without our authorisation”
What was involved	“Contact information, such as name and email address, and if you have an enterprise Claude account, account-related information such as account ID, organization ID, plan tier, usage, and spend metrics”
What wasn’t	“the content of conversations with Claude, passwords, or any payment card or bank account information”
Whose was viewed	“We cannot confirm whether any particular person’s information was viewed”
What Anthropic did	It “timely disabled access by the third party, worked to remediate the identified vulnerabilities, and began an investigation”
The data now	“The cybersecurity firm has certified in writing that it has deleted the accessed data and will not use it.” Anthropic has “found no evidence that the accessed data was altered, deleted, or otherwise misused”
Regulators	“We have also reported this incident to the relevant Korean authorities.”
Why you got it	“out of an abundance of caution should you wish to notify individuals in your organization”

The notice doesn’t name the firm, MLQ reports. The Korean outlet iNews24 does: citing Anthropic, it reports that Cathedral got into Anthropic’s internal systems on October 8, that Anthropic found out on October 10 and cut off access that day, and that the notices went to enterprise customers in Korea and elsewhere on November 7. Yonhap reports that an Anthropic staff member wrote on X on November 8 that Cathedral had accessed account information such as names, emails and plans without authorization, but not prompts, outputs or payment information, and that Anthropic knows “there is more to do” and will keep improving how it secures and monitors third-party software. We haven’t found that post; those are Yonhap’s words, in our translation.

Is the email real?

Anthropic did send a notice with this subject on November 7. The copy O’Reilly shared, the one MLQ describes, and the notices the Korean outlets report all agree. Now that the incident is public, though, a copy in your inbox could also be an imitation. In the parts made public, the real one asks you to do nothing: no sign-in, no password reset, no payment. For questions, it gives one address, privacy@anthropic.com.

So the check is simple. Don’t follow a link or open an attachment in a message about this notice. Treat one that asks you to sign in, pay or reset a password as phishing. To ask about yours, write to privacy@anthropic.com yourself, or ask your Anthropic account team.

What to do if you got it

1. Leave your Claude sign-in and keys as they are, unless you have another reason. Anthropic hasn’t asked anyone to change a password or replace an API key, and it says neither passwords nor payment details were involved.
2. Decide who to tell. That’s what the notice is for: “should you wish to notify individuals in your organization.” It doesn’t say what the privacy laws that apply to you require; your legal or privacy team can.
3. Warn the people named on the account. Whoever holds a name, an email address, a plan tier and a spend figure can write a convincing fake invoice, renewal or security alert. Tell your Claude admins and billing contacts, and check any billing or plan change in Claude’s own settings rather than through a link in an email.
4. Ask what Anthropic holds about you. Write to privacy@anthropic.com. Anthropic says it “cannot confirm whether any particular person’s information was viewed,” so it may not be able to say whether yours was.
5. Tighten what a phished login could do. On November 5, Anthropic’s release notes added two beta controls: an IP allowlist in the Claude Console, which “limits where a leaked API key can be used,” and an Admin API request that signs a Claude Enterprise member “out of Claude everywhere.” Anthropic didn’t tie either to this incident.

Korea’s privacy regulator is reviewing it

On November 9, Korea’s Personal Information Protection Commission said Anthropic reported on October 31 that the information of about 100 Korean enterprise accounts had leaked, Yonhap reports. The commission is at a preliminary review and hasn’t opened a formal investigation; for foreign companies, it says, it sometimes requests documents first, so the review can take time. Once a formal investigation starts, the commission said, it will establish the specific scale of the damage.

Anthropic hasn’t said whether it has reported the incident anywhere else, how many organizations outside Korea were affected, or how many people got the notice.

How it got here

Date in 2026	What happened
October 8	Cathedral gets into Anthropic’s internal systems, according to Anthropic as iNews24 reports it
October 10	Anthropic learns of it and cuts off access the same day, by the same report
October 26	The Washington Post reports Cathedral’s account; Anthropic confirms access to “a limited set” of its sales, HR and IT systems
October 26	Logan Graham, whom Gizmodo calls Anthropic’s cybersecurity lead, disputes the 12 hours: “we saw several days of attempts”
October 31	Anthropic reports about 100 Korean enterprise accounts to Korea’s privacy regulator
November 2	OpenAI says Cathedral’s team “will use OpenAI’s models alongside our teams to challenge our defenses,” as Gizmodo reports
November 7	Anthropic emails its notice
November 9	Korea’s regulator confirms it is reviewing Anthropic’s report

The test itself, as the Post first described it: Cathedral, a cybersecurity startup a few months old, probed Anthropic under a program that invites outside security researchers to test its systems and rewards them for the flaws they report. By Anthropic’s account, its researchers first spent several days trying to break into Anthropic’s own software, without success. They then turned their AI agents on the third-party software Anthropic, like many other companies, uses for administrative and sales work, and according to Cathedral’s draft report the agents found paths to sensitive data in less than 12 hours. Graham’s version is that after “several days of attempts” Cathedral “exploited two 3rd party vulnerabilities, one they reported and the other we identified independently (and cut off access).”

“Our monitoring flagged some of Cathedral’s activity before they reported it to us,” Anthropic told the Post, as Decrypt quotes it, and “we shut off their access the same day.” It disabled the affected software until the vendors confirmed fixes, briefed federal officials, and said it had no evidence that anyone but Cathedral had exploited the flaws.

What Cathedral reached, by each account

	Cathedral’s draft report, as the Post describes it	Anthropic in October	Anthropic’s November 7 notice
How long	Under 12 hours of running its agents	“Several days of attempts,” then two third-party flaws	Not stated in the parts made public
What was in reach	Paths to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic’s advanced models	“A limited set” of sales, HR and IT systems, holding business contact details for some customers and partners, and basic user account records	Names and email addresses; for enterprise accounts, account ID, organization ID, plan tier, usage and spend metrics
What wasn’t	Not stated	Customers’ messages to Claude, Claude’s responses, source code and model weights	Conversations with Claude, passwords, payment card and bank account information
The rules	Data access “kept to the absolute minimum in accordance with security research best practices”	Cathedral didn’t disclose all its activity; Graham called it “unusual and out of scope of our safe harbor policy”	Access “on its own initiative and without our authorisation,” as O’Reilly quotes it

Cathedral’s draft names what its agents found paths to; Anthropic names what was in the systems they reached, and now which customer records may have been seen. Neither has said how much the researchers actually opened or copied, beyond Anthropic’s statement that it can’t tell whose information was viewed.

Does it affect you?

• If your organization buys Claude, your business contacts may be among those in the notice, and for an enterprise account, so may your account and organization IDs, plan tier, usage and spend. Anthropic hasn’t said how many organizations that covers.
• If you use Claude on a personal plan, the notice describes business contact and account information. Anthropic hasn’t said whether any individual Pro or Max accounts were among the records reached.
• Either way, your conversations weren’t in it, Anthropic says: not the messages you send, not Claude’s replies, and in October it added that Claude’s source code and model weights weren’t reached either.

Was it within the rules?

Anthropic’s description has hardened. In October it told the Post that Cathedral didn’t fully follow the program’s rules because it didn’t disclose all of its activity inside Anthropic’s systems. Graham then called the approach “unusual and out of scope of our safe harbor policy,” while adding “we’re grateful these issues were found.” The November notice calls it “unauthorized access.” Cathedral’s draft says its data access was kept to “the absolute minimum”; we haven’t found a public response from Cathedral to the notice.

Anthropic’s public responsible disclosure policy doesn’t cover systems run by “any service provider or contractor to the Company,” and tells researchers: “You will not exfiltrate, download, or otherwise retain any data that you collect.” The program Cathedral tested under hasn’t been published.

The politics are close by. Gizmodo describes Cathedral as “focused on military applications”; its founders are former DOGE staffers, and co-founder Gavin Kliger was the Pentagon’s chief data officer. A senior Trump administration official told the Post that three federal agencies have contracted with Cathedral. Anthropic says Cathedral overstated the national security implications.

Why the way in was ordinary software

Cathedral’s draft says, as Gizmodo quotes it, that “weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations.” The way in wasn’t an AI model. It was the kind of outside software every company connects to its email, chat, HR and sales. What’s new is how fast agents can work through it. “Adversaries will use whatever models/tools they can. They’ll target everything with agents 24/7. They’ll hit your dependencies,” Graham wrote, and his advice was to “red team yourself all the time.”

For a company, the useful checks are the plain ones: list the outside tools connected to your email, chat, HR and sales systems, see what each one can read, and remove the access nobody uses.

This isn’t the first time AI agents have got into real systems. In November 2025, Anthropic said a group it assessed with high confidence to be Chinese and state-sponsored had used Claude Code against “roughly thirty global targets,” with AI doing “80-90%” of the campaign. In an August follow-up, it said Claude models running without their cyber safeguards in a misconfigured third-party evaluation environment had “gained unauthorized access to real computer systems.” And Claude Mythos 5 tried to slip malware into a real GitHub project in a UK AI Security Institute test, which our memo explains.

If you test your own systems with an agent

Claude’s models come with cyber safeguards, which Anthropic’s Cyber Verification Program relaxes for vetted security professionals. Red Team Access, for organizations only, “adds authorized penetration testing and red-teaming,” and “organizations in this tier can only perform adversarial testing against systems they are authorized to test.” A vendor’s software is the vendor’s system: get its permission first, or use its own disclosure program.

Keep an approval step between the agent and anything real. Enjoy runs Claude Code, Codex and the other labs’ agents with their own permission modes and remembers the one you last used with each agent in a project, so a project with real credentials can stay on Claude Code’s Manual or Codex’s Ask for approval, and each request arrives as a card to allow or decline.

What hasn’t been said

• The firm’s name, by Anthropic in public. The notice doesn’t name it; Anthropic hasn’t published anything tying the notice to Cathedral beyond its staff member’s post, as Yonhap reports it.
• How many organizations and people got the notice, and whose records were actually viewed, which Anthropic says it can’t tell.
• Why Korea, and whether Anthropic has told regulators anywhere else. O’Reilly has also asked whether it reported the access to law enforcement.
• Which software, and which vendors. Neither side has named them.
• Which AI agents or models Cathedral used.
• Whether Cathedral will publish its report, or answer the notice’s “without our authorisation.”

We’ll update this memo when Anthropic, Cathedral or Korea’s regulator says more.