Anthropic discloses fourth Claude breach; regulators push rules

Anthropic disclosed a fourth hacking incident affecting its Claude AI, reporting that an unauthorized party accessed some customer data and internal systems. The company described the event to customers and in regulatory filings and said it is a separate incident from three earlier security events.

Anthropic reported taking steps to contain the activity, notifying relevant authorities and opening an investigation to determine the scope of the exposure. The firm has not released full technical details about how the attacker gained access or a full list of affected customers.

The disclosure prompted concern among corporate users that rely on Claude for tasks such as drafting text, coding assistance and customer support. Some customers raised worries about possible exposure of proprietary data or API keys. Anthropic recommended that affected customers rotate credentials and review access logs and said it is providing direct support to impacted accounts.

Lawmakers and regulators urged clearer rules on incident reporting and baseline security requirements for large AI services. Several policymakers called for consistent standards on protecting models, training data and customer inputs. Privacy advocates pressed for mandatory breach-notification timelines and independent audits of platform security practices.

Analysts noted the growing use of generative models in business workflows increases the amount of sensitive data processed by these systems. They said that trend has prompted calls for specific rules on data handling, logging and third-party testing of AI systems.

In its customer communication Anthropic stated it is accelerating internal security reviews, investing in additional monitoring and access controls, and will cooperate with law enforcement and data protection authorities where required. The company added it will provide further updates as the investigation proceeds.

Security experts advised organizations that use Claude and other large language models to reassess risk controls, including limiting what data is sent to models, separating AI test environments from sensitive systems, enforcing least-privilege access and conducting regular security audits. Several major customers are conducting their own reviews of Claude integrations.

Anthropic launched Claude as a competitor to other large language models and has previously disclosed other security incidents. Proposals from regulators and industry groups under consideration include mandatory incident reporting, third-party security assessments and certification schemes for AI models and infrastructure.