Anthropic warns business customers an outside hacking-test firm may have seen their account details, and South Korea's privacy regulator is reviewing it

Anthropic has begun telling some business customers that an outside security firm viewed their account details. The notices come as the company prepares for its planned stock market listing, and they have already drawn a regulator's attention.

South Korea's Personal Information Protection Commission, the country's privacy regulator, confirmed on November 9 that Anthropic reported the exposure of roughly 100 Korean corporate Claude accounts on October 31. The commission is doing a preliminary review. It has not decided whether to open a formal investigation.

The data involved is business information, not conversations. According to Korean reporting on the filing, account and organization ID numbers, contact names and business email addresses may have been exposed. An Anthropic employee wrote on X on November 8 that subscription plans were also seen. Anthropic says prompts, AI responses and payment details were not touched.

For companies buying AI, the lesson is less about Claude itself than about the everyday office software around it.

How the firm got in

The firm is Cathedral, a months-old startup founded by former staff of DOGE, the federal government's cost-cutting team. It raised $160 million in July at a $1.4 billion valuation, with Andreessen Horowitz and Sequoia among its backers.

The Washington Post reported on October 26 on a Cathedral draft report saying its AI agents reached parts of Anthropic's internal systems in under 12 hours. Anthropic says Cathedral first spent several days failing to break in directly. AI agents are programs that carry out multi-step tasks without a person approving each step. They did not break Claude. They exploited flaws in third-party business software that many companies use, reaching some of Anthropic's sales, HR and IT systems. Anthropic has not named the vendors.

Cathedral's draft report claimed access to meeting transcripts, salary and job-offer records, and Slack messages about Anthropic's models. Anthropic confirmed only that a "limited set" of business systems was reached. It said its monitoring flagged some of the activity before Cathedral reported it, and that it cut off access the same day.

Anthropic also said model weights, source code and customer conversations were never reached. It says it has no evidence anyone besides Cathedral used the same flaws. These accounts come from the two companies. No independent forensic report has been published.

Sanctioned test or unauthorized access?

The two sides disagree on what kind of event this was. Cathedral was working inside Anthropic's program that pays outside researchers to probe its defenses. Anthropic says Cathedral broke that program's rules by not disclosing all of its activity, and overstated the national security stakes. Cathedral says it kept data access "to the absolute minimum."

Anthropic's recent messages describe the access as unauthorized. Its employee's post said Cathedral accessed account details "without authorization." Security researcher Jamieson O'Reilly shared the notice he received. Per tech news site Runtime Wire, it says Anthropic cannot confirm whose information was viewed, yet tells recipients they face no heightened risk. It does not name the firm.

The label matters. Whether this counts as a sanctioned test or a breach can shape what Anthropic must disclose, to which regulators, and what customers can demand. South Korea is the only regulator publicly confirmed to have received a report so far. Anthropic has not published a worldwide count of affected accounts or a public incident report.

What it means for companies buying AI

The timing is awkward. Anthropic's IPO filing already warned of possible political scrutiny. A disputed data exposure under review by a national regulator is the kind of item prospective shareholders may ask about.

A rival drew a different conclusion from the same episode. On November 2, a week after the Post report, OpenAI said Cathedral researchers would join its next internal security sprint, using OpenAI's own models to attack its defenses. OpenAI also more than quadrupled the midpoint of its reward ranges for reported security flaws. Top payouts now reach about $172,000 with bonuses.

That choice suggests at least one AI lab sees AI-driven attack testing as worth paying for, even after a public dispute.

For corporate buyers, three points stand out. First, the weak spot was common business software, not the AI model. Any company using the same tools may face the same exposure. Second, AI agents shrink the timeline: by Cathedral's account, a small team found a way in within hours. Third, customer contact lists are valuable to fraudsters. Names, emails and plan details make convincing fake billing emails easy to write.

The practical steps are simple. Check whether your organization received the notice. Warn the named contacts to expect targeted phishing. Confirm any billing or plan-change request in Anthropic's admin console rather than by email.

The open questions are the ones a board would ask. How many customers outside Korea were affected? Whose software failed, and who else runs it? Until Anthropic publishes a fuller account, customers are left weighing the word of two companies that disagree.