Korea reviews Anthropic data leak tied to Pentagon-linked startup Cathedral
- Anthropic told South Korea’s privacy regulator on October 31 that about 100 Korean corporate Claude accounts were exposed in a breach traced to Cathedral.
- The PIPC is reviewing the case before deciding whether to open a formal investigation.
- The exposed data was limited to account and contact details.
South Korea’s privacy regulator is reviewing a data breach at Anthropic that exposed about 100 Korean business accounts.
The Personal Information Protection Commission (PIPC) said on Monday that it received Anthropic’s report about the breach, which the company filed on October 31.
What did Anthropic report to the PIPC?
South Korea’s privacy regulator, the Personal Information Protection Commission (PIPC), confirmed today that Anthropic filed a report with it regarding a data breach. The report was filed on October 31 and says about 100 business accounts were exposed. Those accounts all belong to Korean companies.
The review is still early, and the PIPC has not yet opened a formal investigation. However, it noted that reviews of foreign firms can take longer because regulators can ask for documents before an investigation starts. It added that once a formal investigation begins, it plans to confirm how large the damage is.
Anthropic told some of its customers that the exposed data included account and organization ID numbers, along with business contact details like names and email addresses.
A technical researcher at the company, named Lydia Harley, revealed on X that the intruder also saw business subscription plans, but user prompts, AI outputs, and payment data were not reached.
Anthropic’s model weights, source code, and Claude conversations were also not reached. The company has said that it shut down the affected systems the same day it confirmed the problem and worked with the third-party software vendor to fix the flaw that was exploited.
Anthropic also admits that it still has more work to do regarding watching third-party software.
Who is Cathedral, and how did the breach happen?
Cathedral is a young cybersecurity startup founded by four former staffers from the disbanded Department of Government Efficiency (DOGE): Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein. It is valued at $1.4 billion after raising $160 million from Andreessen Horowitz and Sequoia Capital. Marc Andreessen and Shaun Maguire are both on its board.
The company reportedly aims to build up U.S. military cyber power against rivals such as China, and it has contracts with three federal agencies.
Kliger, the CEO, has the closest history with Anthropic. He was chief data officer at the Pentagon and, by several accounts, took part in the department’s clash with Anthropic over how the military could use its AI models.
Cathedral’s explanation of events is that, in under 12 hours, its AI agents found paths to meeting transcripts, salary and job-offer details, and internal Slack messages.
But Logan Graham, Anthropic’s cybersecurity lead, refuted that claim, posting on X that the effort actually took several days. He wrote that Cathedral’s method was “unusual and out of scope” because it combined flaws from several third-party software.
Cathedral’s test of Anthropic’s defenses was supposed to be in line with the company’s bug bounty program, but Anthropic says Cathedral broke the program’s rules by not fully explaining how far the test went, and that it made its findings sound more important to national security than they were.
Adding to that, Anthropic’s own monitoring systems reportedly caught part of the activity before Cathedral filed its report.
So far, Anthropic has not filed a legal complaint, and Cathedral has entered into an agreement with OpenAI to test its own defenses.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
Who is Cathedral and who runs it?
Cathedral is a cybersecurity startup valued at $1.4 billion and founded by former DOGE staffers Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. CEO Kliger previously served as the Pentagon's chief data officer and was involved in the department's dispute with Anthropic over military use of its models.
Is South Korea formally investigating Anthropic?
Not yet. The Personal Information Protection Commission is conducting a preliminary review of the October 31 report and will decide later whether to launch a formal investigation to confirm the scale of the damage.
What data was exposed in the Anthropic breach?
Account and organization identification numbers plus business contact details such as names, email addresses and subscription plans, according to Anthropic notices cited by Korean outlets. User prompts, AI outputs, payment data, source code and model weights were not reached.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
