Cybersecurity Roundup: Anthropic Breach Dispute and Server Flaw
SecurityWeek's weekly cybersecurity roundup highlights significant industry developments, including a dispute over an AI-led startup intrusion at Anthropic and a critical boot firmware vulnerability affecting servers worldwide.
Radwan AbdulhadiEditor and technology writer
Anthropic Disputes Startup's AI Intrusion Scope
Cybersecurity startup Cathedral, founded by former DOGE staffers, claimed its AI agents penetrated Anthropic's internal systems in under 12 hours by exploiting vulnerabilities in third-party business software. According to findings reviewed in a draft report by the Washington Post, the intrusion reportedly reached meeting transcripts, salary data, and discussions regarding advanced models.
In response, Anthropic stated that the access was limited to a specific set of sales, HR, and IT systems, noting that Claude conversations, source code, and model weights remained unaffected. The company cut off access the same day the findings were received through its bug bounty program and accused Cathedral of violating bounty program rules by failing to disclose all of its activities.
Critical UEFI Firmware Flaw Affects Global Servers
A critical 16-year-old buffer overflow vulnerability tracked as CVE-2026-97631 in TianoCore EDK II open-source code affects most servers globally, as reported by Ars Technica. The code is utilized by major server vendors and data centers through firmware suppliers such as AMI, Insyde, and Phoenix.
The vulnerability allows an attacker with local network access to transmit an oversized ICMP error message during a network boot process to disrupt operations or execute code at top privilege levels before Secure Boot defenses engage. Only machines utilizing network boot are exposed, and organizations are actively seeking firmware updates following code fixes published by AMI.
Cloudflare and SGLang Fix AI Inference Data Leak
Cloudflare disclosed that between August 27 and September 9, a configuration mismatch and an inference engine bug led to cross-tenant data exposure on its Workers AI platform. Specifically, 155 responses from the GLM 5.3 model contained data from other customers' recent requests involving prompts longer than 681,280 tokens.
The issue stemmed from a cache smaller than the advertised context window combined with an SGLang bug that allowed over-length requests to read residual cache data. Cloudflare resolved the issue after a report from Knostic researcher Gadi Evron, finding no evidence of malicious exploitation, and advised operators to update SGLang.
Additional Threat Landscape Developments
The broader weekly cybersecurity news roundup compiled by SecurityWeek covers several other critical incidents, including suspected Iran-linked cyberattacks affecting US military base freezers and refrigeration controls, following similar European grocery store disruptions.
Other notable events included a test environment data breach at the University of Copenhagen affecting personal records and ID card PINs, an electronic filing system outage at the Federal Election Commission following a breach attempt, and an ENGIE data breach linked to a marketing tool utilized by sales partners.
Sources
- SecurityWeekIn Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
Continue chronologically
Related entity coverage
Related stories
Cloudflare Cuts AI Code Review Inference Costs by 68%
Cloudflare slashed its AI code review inference bill by 68% and sped up review times through aggressive prompt caching and model optimization.
Anthropic Warns Small AI Models May Self-Replicate via IoT
Anthropic researchers warn that small AI models could soon self-replicate across Internet of Things devices as a new generation of computer worms.
Google and Industry Leaders Unveil October 2026 AI Breakthroughs
Explore the major AI updates from October 2026, featuring Google's Gemini 4 releases, Genie 4, and significant cybersecurity industry acquisitions.
Major AI firms back new multi-company web scraping opt-out standard
OpenAI, Google, Microsoft, and Anthropic plan to adopt a new shared policy token standard allowing publishers to manage AI training preferences collectively.
