A cybersecurity startup founded by former DOGE staffers says its AI agents broke into Anthropic’s internal systems in less than 12 hours. Anthropic confirms that the startup, Cathedral, reached “a limited set” of its sales, HR and IT systems. It says Claude users’ conversations, its source code and its model weights were not touched.
Anthropic had authorized the test, and the startup got in through business software Anthropic buys from outside vendors, not through Claude itself. That makes the Anthropic hack less a story about a broken AI model than about the ordinary tools every company runs. It also lands in an awkward week, as Anthropic asks public investors to buy its shares.
What Cathedral says its agents reached
The claim comes from a draft Cathedral report reviewed by The Washington Post, which first reported it. According to Gizmodo’s account of the report, Cathedral’s agents found paths into Anthropic’s systems by exploiting flaws in third-party business software. The startup says they reached meeting transcripts, salary details, job offers and Slack messages discussing Anthropic’s advanced AI models.
Anthropic’s description is narrower, but it confirms real exposure. The systems Cathedral reached held business contact details for some customers and partners, plus some basic user account records, Gizmodo reported. Anthropic told the Post that “customer prompts, Claude responses, source code, and model weights were not accessed,” Cyber Security News reported.
No one has named the software vendors involved. The specific flaws also remain private, to limit the risk of copycat attacks, according to Cyber Security News.
How the agents got in
Cathedral’s human researchers first spent several days trying to break into Anthropic’s own software, and failed, Futurism reported, citing Anthropic. The team then turned to a business tool the company was using. Its AI agents found a way in within 12 hours.
That route matters more than the speed. Anthropic’s own software held up for days. The way in was software built by other companies and connected to Anthropic’s internal systems. Cathedral’s report makes the same point: “weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations,” it says, as quoted by TechRadar.
The speed still says something about where AI security research is going. In remarks posted Oct. 21, OpenAI chief Sam Altman said AI now finds flaws faster than the old approach of patching every bug can keep up with.
Anthropic’s response, and the rules fight
Anthropic says it spotted the activity on its own. “Our monitoring flagged some of Cathedral’s activity before they reported it to us,” the company said. “We shut off their access the same day.”
It then disabled the affected business software and turned it back on only after the vendors confirmed fixes, according to Cyber Security News. “We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral,” Anthropic said, as quoted by Futurism.
The two companies disagree on how Cathedral ran the test. Anthropic says Cathedral did not fully follow its bug bounty rules because it did not disclose all of its activity inside Anthropic’s systems. It also says Cathedral overstated the “implied national security implications” of what it found. Cathedral says it kept its access to data to the minimum that responsible research requires.
Anthropic’s public responsible disclosure policy shows why the scope question is touchy. It asks researchers to avoid “accessing, acquiring, or using the content of any communications” unless by accident. It also excludes systems “owned, operated, or controlled by any third party, including any service provider.” Reports don’t say whether Cathedral tested under that policy or under separate terms, so the policy can’t settle the dispute. But reading Slack messages through a vendor’s software sits close to both lines.
Who is behind Cathedral
Cathedral is only months old, but it is well funded and well connected. Its founders are Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all former staffers at Elon Musk’s Department of Government Efficiency, Gizmodo reported.
Kliger was previously the Pentagon’s chief data officer. Reports have tied him to the Pentagon’s dispute with Anthropic, according to Gizmodo. The startup has raised $160 million at a $1.4 billion valuation, from investors including Andreessen Horowitz and Sequoia Capital. Marc Andreessen sits on its board.
Cathedral also works for Washington. It has contracts with three federal agencies, a senior Trump administration official told the Post, according to Cyber Security News. The same official raised the concern that has driven coverage since. “If a bunch of kids who have just started a company can do this, then potentially the Chinese aren’t far behind,” the official said, as quoted by Futurism.
Those ties are why Anthropic’s “national security” pushback matters. A startup focused on offensive and defensive cyber work for the US government, with a founder reportedly involved in the Pentagon’s dispute with Anthropic, has written a report on Anthropic’s weak points. The facts both sides accept still stand. But readers should weigh the framing with that context in mind.
Why the timing matters for Anthropic’s IPO
The report circulated as Anthropic made its IPO filing public on Monday, Oct. 26. That S-1 filing already warns investors about this kind of risk.
The S-1 says attempts to break in “have resulted in” security breaches at Anthropic “or those of our third-party service providers.” It also says the company has “operated in the past, and may in the future operate, for periods of time with known limitations or gaps in our defenses.” And it names foreign spies as a real threat, saying frontier AI companies are “priority targets for non-U.S. intelligence services.”
In other words, Anthropic told the SEC much of what the Cathedral episode illustrates. The open question for investors is scale, not surprise. Our guide to the filing explains what an ANT share would get buyers. The price range is still blank.
What it means if you use Claude
Based on what Anthropic has said, the content of your chats was not exposed. Its statement rules out customer prompts and Claude’s responses. What was reachable for some customers and partners was business contact information and basic account records.
None of the reports we read say how many accounts this covers or whether Anthropic has told the people affected. Business customers who want to know whether their records were in the affected systems should ask their Anthropic account contact.
So far, Cathedral’s findings exist only in a draft report, and coverage doesn’t say whether Anthropic will pay a bounty. The next place to look is Anthropic’s amended S-1, which must add the IPO price range and will show whether the company updates its security disclosures.
Disclosure: BreezyScroll uses Anthropic’s Claude to help draft articles.
