South Korea reviews Anthropic breach that hit 100 corporate accounts

South Korea’s privacy regulator is reviewing a data breach at Anthropic that exposed about 100 Korean business accounts.

The Personal Information Protection Commission (PIPC) said on Monday that it received Anthropic’s report about the breach, which the company filed on October 31. 

What did Anthropic report to the PIPC?

South Korea’s privacy regulator, the Personal Information Protection Commission (PIPC), confirmed today that Anthropic filed a report with it regarding a data breach. The report was filed on October 31 and says about 100 business accounts were exposed. Those accounts all belong to Korean companies. 

The review is still early, and the PIPC has not yet opened a formal investigation. However, it noted that reviews of foreign firms can take longer because regulators can ask for documents before an investigation starts. It added that once a formal investigation begins, it plans to confirm how large the damage is.

Anthropic told some of its customers that the exposed data included account and organization ID numbers, along with business contact details like names and email addresses. 

A technical researcher at the company, named Lydia Harley, revealed on X that the intruder also saw business subscription plans, but user prompts, AI outputs, and payment data were not reached. 

Anthropic’s model weights, source code, and Claude conversations were also not reached. The company has said that it shut down the affected systems the same day it confirmed the problem and worked with the third-party software vendor to fix the flaw that was exploited. 

Anthropic also admits that it still has more work to do regarding watching third-party software.

Who is Cathedral, and how did the breach happen?

Cathedral is a young cybersecurity startup founded by four former staffers from the disbanded Department of Government Efficiency (DOGE): Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein. It is valued at $1.4 billion after raising $160 million from Andreessen Horowitz and Sequoia Capital. Marc Andreessen and Shaun Maguire are both on its board. 

The company reportedly aims to build up U.S. military cyber power against rivals such as China, and it has contracts with three federal agencies.

Kliger, the CEO, has the closest history with Anthropic. He was chief data officer at the Pentagon and, by several accounts, took part in the department’s clash with Anthropic over how the military could use its AI models. 

Cathedral’s explanation of events is that, in under 12 hours, its AI agents found paths to meeting transcripts, salary and job-offer details, and internal Slack messages. 

But Logan Graham, Anthropic’s cybersecurity lead, refuted that claim, posting on X that the effort actually took several days. He wrote that Cathedral’s method was “unusual and out of scope” because it combined flaws from several third-party software. 

Cathedral’s test of Anthropic’s defenses was supposed to be in line with the company’s bug bounty program, but Anthropic says Cathedral broke the program’s rules by not fully explaining how far the test went, and that it made its findings sound more important to national security than they were. 

Adding to that, Anthropic’s own monitoring systems reportedly caught part of the activity before Cathedral filed its report.

So far, Anthropic has not filed a legal complaint, and Cathedral has entered into an agreement with OpenAI to test its own defenses.

If you're reading this, you’re already ahead. Stay there with our newsletter.