---
title: Anthropic tells customers a third-party cybersecurity firm accessed internal systems without approval on Oct 8, possibly exposing Claude business contact and usage data | ctxsec
url: https://ctxsec.com/items/anthropic-customer-notice-third-party-research-firm-unauthorized-access-oct-8
description: "Korean tech outlet Byline Network reports that Anthropic emailed customers on Nov 7 about a third-party cybersecurity research firm that, on Oct 8, accessed some internal systems while running a security test on its own initiative. Anthropic says it learned of the access on Oct 10, blocked the firm, fixed vulnerabilities, and received a written confirmation the firm deleted the data. Possibly exposed: names and emails, and for enterprise Claude accounts also account/organization IDs, plan tier, usage and spend metrics. Anthropic says prompts, generated replies, passwords and payment details were not in scope, has not confirmed which individual records were viewed, reported the matter to Korean authorities, and warns about phishing that spoofs Anthropic asking for passwords or payment details."
status: "Anthropic customer notice reported by Byline Network (Nov 7) and customer-shared email on X; Anthropic has not posted a public English statement; firm unnamed; likely related to the pending Cathedral authorized-test dispute"
published: 2026-11-07
---

> Korean tech outlet Byline Network reports that Anthropic emailed customers on Nov 7 about a third-party cybersecurity research firm that, on Oct 8, accessed some internal systems while running a security test on its own initiative. Anthropic says it learned of the access on Oct 10, blocked the firm, fixed vulnerabilities, and received a written confirmation the firm deleted the data. Possibly exposed: names and emails, and for enterprise Claude accounts also account/organization IDs, plan tier, usage and spend metrics. Anthropic says prompts, generated replies, passwords and payment details were not in scope, has not confirmed which individual records were viewed, reported the matter to Korean authorities, and warns about phishing that spoofs Anthropic asking for passwords or payment details.

[← Context & Harness Attacks](/context) · [markdown](/items/anthropic-customer-notice-third-party-research-firm-unauthorized-access-oct-8.md)

Anthropic customer notice reported by Byline Network (Nov 7) and customer-shared email on X; Anthropic has not posted a public English statement; firm unnamed; likely related to the pending Cathedral authorized-test dispute

2026-11-07

### Anthropic tells customers a third-party cybersecurity firm accessed internal systems without approval on Oct 8, possibly exposing Claude business contact and usage data

- **Not in scope (per notice):** Claude prompts/replies, passwords, credit cards, bank accounts.
- **Do now:** treat unexpected Anthropic emails or calls about billing, plan changes or "security verification" as phishing until confirmed in-product; do not send passwords, OTP codes or payment details.
- Likely related to the Oct Cathedral AI-agent access story (still pending a primary Cathedral write-up); the notice does not name the firm.

Sources: [Byline Network: Anthropic unauthorized internal access / Claude account info risk (Nov 7, Korean)](https://byline.network/2026/11/7-521/) · [Jamieson O'Reilly customer notice post on X (Nov 7)](https://x.com/theonejvo/status/2119019762906804395)