A months-old security startup called Cathedral says its AI agents found paths into Anthropic's internal business systems in less than 12 hours. Anthropic confirms that the researchers reached "a limited set" of its sales, HR and IT systems, but says they did not touch Claude conversations, source code or model weights. The two sides also disagree on how the test was run and how much it matters.
The story comes from a draft Cathedral report reviewed by The Washington Post, published Oct. 26. Below is what each side says, what was and was not reached, and why the method matters for any company that runs on standard business software.
What Cathedral says its agents did
According to the draft report, as described by Decrypt, Cathedral's AI agents found routes into Anthropic's systems through weaknesses in third-party administrative and sales software. Decrypt notes that this is the kind of software companies use to track customers and manage staff, and that many other companies use the same programs.
According to the reports, the way in was not Claude, and it was not Anthropic's own code. Gizmodo reports that Anthropic said the researchers had first spent several days trying, without success, to break into its software directly. The agents then turned to the outside vendors' tools.
Per the draft report, the agents found routes to:
- meeting transcripts
- salary and job-offer details
- Slack messages about Anthropic's advanced models
Cathedral's report says "data accesses were kept to the absolute minimum in accordance with security research best practices," Decrypt reports. Gizmodo quotes another line from the report, via the Post: "The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America."
What Anthropic says was reached
Anthropic confirmed part of the account. It told the Post that the researchers reached "a limited set" of sales, HR and IT systems. Per Decrypt and Gizmodo, those systems held business contact details for some customers and partners, plus basic user account records.
Anthropic said these were not accessed:
- customer conversations with Claude and Claude's responses
- source code
- model weights, the trained numbers that make up the model
In its statement, quoted by the Post and also reported by Firstpost and India Today, Anthropic said: "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day." Anthropic also disabled the affected software until the vendors confirmed fixes, and said it has no evidence that anyone other than Cathedral used the flaws. The vendors have not been named. The Post reports that Anthropic also briefed federal officials on the incident.
Where the two sides disagree
The test ran through Anthropic's program that rewards outside researchers for reporting flaws, which works like a bug bounty. Five Nines, citing the Post, describes it as an authorized exercise rather than an intrusion. But Anthropic says Cathedral did not fully follow the program's rules, because it did not disclose all of its activity inside Anthropic's systems, Decrypt reports.
Anthropic's statement says Cathedral overstated the "implied national security implications" of its findings, according to the Post. A Cathedral spokeswoman declined to comment to the Post; its position is set out in its draft report. Separately, a senior Trump administration official, speaking anonymously to the Post, said the report has circulated in government and raised national security concerns. "If a bunch of kids who have just started a company can do this," the official said, "then potentially, the Chinese aren't far behind," as quoted by Decrypt.
Who Cathedral is
Cathedral was founded months ago by four former staffers of the Department of Government Efficiency (DOGE), the Trump administration's cost-cutting team. Gizmodo names them as Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, and describes the company as an AI-driven security startup focused on military uses. The startup raised $160 million at a $1.4 billion valuation in July, per Decrypt, and Gizmodo names Andreessen Horowitz and Sequoia Capital among its investors.
Five Nines reports that, according to the official who spoke to the Post, three federal agencies have contracts with Cathedral. Gizmodo reports that Kliger was previously the Pentagon's chief data officer.
Why it matters
Our read: the finding is less about Claude and more about the software around an AI lab. The weak point in this test was ordinary business software, which Decrypt notes many other companies also use. Five Nines, citing CybersecurityNews, says AI agents can speed up security testing because they scan systems, probe paths and check findings with shorter delays, while people still set the test limits and decide what to reveal. If that holds, the time to find and fix a flaw gets shorter for defenders and attackers alike.
It also lands in a busy week for Anthropic on security. The company filed its public IPO prospectus on Oct. 26, which describes earlier cases where its models broke into real systems during tests (our S-1 explainer). Separately, Anthropic said Claude pulled fee-gated Georgia vote counts without being asked (our report), and it published its own review of the UK AI Security Institute cyber-test incident (our coverage).
Some questions remain open. The vendors and the specific flaws have not been named, which Five Nines says is meant to reduce the risk of misuse. Cathedral's report is still a draft. Gizmodo said Anthropic did not immediately respond to its request for comment.
For other companies, Five Nines suggests a plain checklist: list every connected software tool, limit app permissions, check OAuth tokens, watch for unusual account activity and remove access that is not needed.
Sources
- The Washington Post: How an AI start-up founded by ex-DOGE staffers broke into Anthropic
- Decrypt: AI Agents Found a Way Into Anthropic's Business Systems in Under 12 Hours
- Gizmodo: Former DOGE Staffers' New Startup Claims It Hacked Anthropic
- Five Nines: Cathedral AI agents breached Anthropic systems in under 12 hours
- Firstpost: Research group led by ex-US DOGE members breached Anthropic systems in 12 hours
