AI agents run by Cathedral, a months-old cybersecurity startup founded by former members of the U.S. DOGE Service, found paths into Anthropic’s internal systems in under 12 hours, according to a draft report reviewed by The Washington Post. The agents exploited flaws in third-party business software Anthropic uses for administrative and sales work, and Cathedral says they reached meeting transcripts, salary and job-offer details, and Slack messages discussing its most advanced models. Anthropic confirmed a narrower intrusion, saying researchers reached only a limited set of sales, human resources and IT systems, and did not touch customer conversations, source code or model weights. The company says it shut off access the same day.
What Cathedral Says Its Agents Reached
According to the Post, Cathedral’s researchers probed Anthropic under the company’s programme that invites outside experts to test its systems and report flaws. The draft report reviewed by the Post is an early version of a blog post. Cathedral disclosed its findings to Anthropic earlier in October through that programme, and told the vendors of the business software it exploited. The Post withheld the vendors’ names for security reasons.
Cathedral’s draft says its AI agents identified paths into internal systems in less than 12 hours by exploiting weaknesses in third-party administrative software. The data it claims to have reached includes meeting transcripts, details of salaries and job offers, and Slack messages discussing Anthropic’s advanced models. The draft calls the result evidence of “a serious gap between the offensive capabilities now emerging and the defenses” protecting American technology assets. It adds that weaknesses in ordinary enterprise software compromising advanced organisations “should be a wake-up call for every company in America.” Cathedral says its data accesses were kept to the absolute minimum under research best practices. A Cathedral spokeswoman declined to comment to the Post.
Anthropic’s Narrower Account
Anthropic said in a statement that Cathedral’s researchers accessed a limited set of its sales, human resources and IT systems. That access covered business contact details for some customers and partners, along with some basic user account records. The company said the researchers could not access messages sent by customers to its models, the responses sent back, or the code or model weights behind its systems.
Anthropic said its monitoring flagged some of Cathedral’s activity before the researchers reported it, and it shut off their access the same day. The company disabled the business software involved and switched it back on only after the vendors confirmed the vulnerabilities had been addressed. It briefed federal officials, and said it has no evidence anyone exploited the vulnerabilities outside of Cathedral. Anthropic said the researchers had spent several days failing to break into its own software directly before turning to the vendors’ applications. The company said Cathedral overstated the implied national security implications of its findings, and had not fully followed the programme’s rules because it did not disclose all of its activity inside Anthropic’s systems.
The Washington Reaction
According to the Post, the Cathedral report circulated inside the government and raised national security concerns. A senior Trump administration official, speaking anonymously, told the Post: “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.”
Alex Stamos, chief information security officer at AI coding startup Cognition, reviewed Cathedral’s findings at the Post’s request. Stamos said: “They found something big here.” He added that the risk of connecting third-party applications to company systems “is a humongous problem for everybody,” and that the findings showed a gap in how Anthropic manages its use of outside software providers. “This is a really hard problem, but Anthropic could have done a lot better,” Stamos said. The Post also reported that three federal agencies have recently contracted with Cathedral for cybersecurity work.
Why It Matters
The episode turns a familiar security warning into a concrete test case. Anthropic builds some of the world’s most advanced models, and the dispute is not about whether its model weights or customer conversations leaked, since Anthropic says neither was touched. It is about the business software wrapped around the lab, and whether AI agents can now find paths through that software faster than defenders can close them. Cathedral’s test arrived in the same week as Anthropic’s public stock-market filing, which puts its security claims before public investors. It also follows a separate breach disclosure involving AI provider keys. If agents can map an organisation’s internal systems in half a day, every company that connects outside software to its network faces the same question Anthropic now faces: how much of its exposure sits outside its own code.
Background
Cathedral was founded by former DOGE staffers including Gavin Kliger, a former Pentagon chief data officer. Anthropic clashed with the Trump administration earlier in 2026 after the Pentagon banned the company from federal systems, following its refusal to allow use of its technology for autonomous weapons or mass domestic surveillance. Cathedral has raised 160 million dollars from investors, according to PitchBook data cited by the Post, and has been valued at 1.4 billion dollars. The incident also lands weeks after the FBI’s exploration of espionage charges against a former OpenAI engineer, part of a wider run of security incidents at leading American AI labs.
Source: Gizmodo: Cathedral Anthropic report; The Washington Post: Anthropic break-in report
0 Comments