Anthropic tells enterprise customers a security firm accessed their account data

Anthropic is alerting enterprise customers that a third-party cybersecurity research firm gained unauthorized access to business contact and account data, including plan tier, usage, and spend metrics. The notice, emailed from Anthropic's Claude address and posted on X by security researcher Jamieson O'Reilly on Nov. 7, leaves it to customer organizations to decide whether to warn their own staff about the exposure.

The exposed fields for enterprise Claude accounts go beyond names and email addresses. They include account ID, organization ID, plan tier, usage, and spend metrics. Anthropic said the data does not contain the content of conversations with Claude, passwords, or payment card and bank account information.

What Anthropic's notice says

Anthropic said it disabled the third party's access once it became aware of it, fixed the vulnerabilities it identified, and opened an investigation. "The cybersecurity firm has certified in writing that it has deleted the accessed data and will not use it," the notice states. The company added that it has found no evidence the data was altered, deleted, or misused, and that it reported the incident "to the relevant Korean authorities." The notice does not explain why Korean regulators were specifically notified.

Anthropic also said it "cannot confirm whether any particular person's information was viewed." The email does not name the research firm, nor does it specify how many organizations or people were affected. Questions are directed to privacy@anthropic.com.

The Cathedral connection

The description matches an incident Anthropic confirmed in late October. On Oct. 26, The Washington Post reported that AI agents run by Cathedral, a startup founded by four former Department of Government Efficiency staffers, reached a "limited set" of Anthropic's sales, HR, and IT systems in under 12 hours. They accessed those systems through third-party administrative and sales software, not through Claude itself.

Cathedral's work ran through an Anthropic program that rewards outside researchers for reporting flaws. Anthropic said the startup did not fully follow the program's rules because it did not disclose all of its activity. "Our monitoring flagged some of Cathedral's activity before they reported it to us," Anthropic told the Post. "We shut off their access the same day." Cathedral's draft report said its "data accesses were kept to the absolute minimum in accordance with security research best practices," though the draft also described paths to meeting transcripts, salary details, and Slack messages that Anthropic did not confirm.

The customer email describes the firm as "conducting a security testing exercise on its own initiative." Anthropic has not publicly stated whether the notices concern Cathedral.

Customer response

O'Reilly's post, addressed to Anthropic chief executive Dario Amodei and other staff, drew more than 1,000 likes within a day. He asked who the research firm was, whether Anthropic had reported the access to law enforcement, and how the company could claim recipients face no added risk while also saying it cannot confirm whether specific individuals' information was viewed.

Anthropic's notice does not answer those questions. Customers who want to know whether their organization's records were in the affected systems have only the privacy address listed in the email.

Why this matters for IT, legal, and operations teams

Enterprise customers are now in the position of assessing third-party risk they did not choose to take on. The notice provides enough detail to trigger internal disclosure reviews - account IDs, plan tiers, and spend metrics can be sensitive in competitive or regulated contexts - but not enough detail to confirm exposure for specific individuals. Legal and compliance teams should watch for regulatory filings in Korea that may reveal more about the scope of the incident. For security teams, the episode underscores how third-party administrative and sales software can become an attack surface even when core AI infrastructure remains untouched. Professionals evaluating AI Security Analytics Courses or AI IT Strategy Training will find the incident a concrete case study in vendor risk management and disclosure practices.