Anthropic has begun emailing business customers to warn them that a third-party cybersecurity research company gained unauthorised access to business contact and account information. The notice came to light on 7 November, when security researcher Jamieson O'Reilly posted it on X.

The notice, titled "Notice Regarding Your Organization's Account Information", was sent from Anthropic's Claude email address. It says the information involved "was limited to business contact and account information". Anthropic has not published a public statement about the notification, and the company has not named the research firm involved.

What the notice says was exposed

For organisations with enterprise Claude accounts, the exposure went beyond names and email addresses. The notice lists "account ID, organization ID, plan tier, usage, and spend metrics" among the affected fields. It says the data does not include the content of conversations with Claude, passwords, or payment card and bank account information.

Anthropic says it disabled the third party's access once it became aware of it, worked to fix the vulnerabilities it identified and opened an investigation. "The cybersecurity firm has certified in writing that it has deleted the accessed data and will not use it," the notice says. Anthropic adds that it has found no evidence the data was altered, deleted or misused, and that it has reported the incident "to the relevant Korean authorities". The notice does not say why Korean regulators in particular were notified.

The company also says it "cannot confirm whether any particular person's information was viewed". It sent the notice "out of an abundance of caution should you wish to notify individuals in your organization", leaving it to customer organisations to decide whether to warn their staff. The email does not say how many organisations or people were affected. Questions are directed to the privacy address listed in the email.

The likely link to Cathedral

The description in the notice matches an incident Anthropic confirmed in late October. On 26 October, The Washington Post reported that AI agents run by Cathedral, a startup founded by four former Department of Government Efficiency staffers, reached a "limited set" of Anthropic's sales, human resources and IT systems in under 12 hours. They got in through third-party administrative and sales software, not through Claude itself.

Anthropic said those systems held business contact details and basic user account records for some customers and partners. It said customer conversations, source code and model weights were not accessed. Cathedral's work ran through an Anthropic programme that rewards outside researchers for reporting flaws. Anthropic said the startup did not fully follow that programme's rules because it did not disclose all of its activity.

"Our monitoring flagged some of Cathedral's activity before they reported it to us," Anthropic told the Post, adding that it shut off their access the same day. Cathedral's draft report says its "data accesses were kept to the absolute minimum in accordance with security research best practices". The draft also describes paths to meeting transcripts, salary and offer details, and Slack messages, which Anthropic did not confirm.

Questions the notice leaves open

O'Reilly's post, addressed to Anthropic chief executive Dario Amodei and other staff, drew more than 1,000 likes within a day. In a follow-up he asked who the research firm was and whether Anthropic had reported the access to law enforcement. He also questioned how Anthropic could say it is "not possible to confirm whether the information of any specific individual was actually viewed" while also saying recipients face no added risk.

Anthropic's own notice does not answer either question. The customer email, quoted by O'Reilly, describes the firm as "conducting a security testing exercise on its own initiative". Anthropic has not publicly said whether the notices concern Cathedral. Customers who want to know whether their organisation's records were in the affected systems have only the privacy address listed in the email to ask.