Former OpenAI Researcher: Anthropic Is Severely Underplaying Security Breach

Event Overview: Security Breach Allegedly "Massively Underplayed"

According to a former OpenAI researcher on Reddit, a recent security breach at Anthropic is being "massively underplayed." The researcher claims that an attacker named "cathedral" has obtained full administrator privileges on Anthropic's internal Slack, meaning they can view all messages—and Slack "literally every single research secret is contained."

This claim currently comes from a single source and has not been confirmed by Anthropic officially or by independent third parties. However, given the identity of the speaker—a former OpenAI researcher—and the depth of the described attack, the matter has drawn widespread attention in the AI safety community.

Scope of the Breach: Slack as the Information Hub

If the claim is true, the core risk of this incident lies in Slack, the collaboration platform. Modern AI research organizations rely heavily on Slack for daily communication, sharing experimental data, discussing model parameters, and coordinating projects. Research secrets often exist as scattered messages, file snippets, and discussion threads across various channels.

An attacker with full Slack administrator privileges would not only be able to read historical messages but could also potentially access file uploads, integrated application data, and private channels. For a company like Anthropic, known for its safety research, this level of access is almost equivalent to a panoramic exposure of research assets.

Slack is a team collaboration platform organized around channels, where messages, files, and integrated applications (such as bots for GitHub, Google Drive, and Jira) all reside within the same workspace. Its permission model includes levels such as workspace owner, admin, member, and guest; administrators can export the full message history, manage app installations, and adjust channel visibility. Because Slack combines communication with file storage and third-party integrations, once an admin account is compromised, an attacker can not only read historical messages but also pivot through installed integrations to code repositories or cloud storage, creating a larger attack surface than a single-system intrusion. This is why security teams often call collaboration platforms "shadow data warehouses."

Official Response and Information Gaps

As of now, Anthropic has not made a detailed public response to the researcher's claim. The original information does not mention the specific content of any official Anthropic statement, nor does it disclose the timeline of the breach, the scope of impact, or remedial measures taken.

This information vacuum is precisely the soil for the "massively underplaying" allegation. Transparency in handling security incidents has always been a sensitive issue for AI companies: early disclosure may trigger panic and competitive risks, while late disclosure may damage trust. The former OpenAI researcher's public call effectively puts Anthropic in a position where it must respond more clearly.

In security incident disclosure, "underplaying" typically refers to a company downplaying the depth, duration, or sensitivity level of affected data in a breach. When the security community judges whether something is "underplayed," it generally looks at several signals: whether the initial intrusion vector was disclosed, whether the attacker's dwell time was explained, whether the scope of data exfiltration was confirmed, and whether notification obligations to regulators and affected parties were fulfilled. Currently, Anthropic's public information does not cover these dimensions, so outsiders can only infer based on a single source—making the "underplaying" allegation itself difficult to confirm or refute.

Industry Security Wake-Up Call: The Risk Surface of Collaboration Tools

Setting aside the incident itself, the allegation reveals a common security blind spot in the AI industry: collaboration tools are often easier entry points than core training infrastructure. Platforms like Slack, Notion, and GitHub carry large amounts of unstructured but highly sensitive information, yet their permission management complexity is no less than that of core systems.

For security research organizations, an attacker does not need to directly breach the model training cluster; simply obtaining an admin account on a collaboration platform may yield richer intelligence than a direct intrusion. Whether or not this incident is ultimately confirmed, it is worth every AI lab re-examining permission audits for internal collaboration tools and the implementation of the principle of least privilege.

The Principle of Least Privilege requires that every account and every integrated application have only the minimum permissions necessary to complete its task, with regular revocation. Applied to collaboration tools, this typically includes: disabling global admin accounts for daily use, enabling multi-factor authentication and hardware keys for administrator actions, setting approval workflows for private channels and file exports, and regularly auditing the OAuth scopes of third-party applications. Phishing attacks and third-party integration vulnerabilities are two common paths to admin privilege compromise—the former uses social engineering to steal credentials, while the latter indirectly gains workspace control through an over-privileged app.

Key Questions Yet to Be Verified

At present, the claim remains in the realm of "rumor," and several key questions need attention: the identity and motives of the attacker "cathedral," how Slack administrator privileges were obtained (phishing, internal leak, or third-party integration vulnerability), and whether Anthropic will confirm or deny the claim in subsequent disclosures. Until more independent sources emerge, readers should remain cautious, but at the same time should not underestimate the impact such allegations can have on trust in AI safety.