Cathedral's AI Agents Reached Anthropic Systems in 12 Hours

Cathedral, a cybersecurity startup founded months ago by four former DOGE staffers, says its AI agents found a way into Anthropic's internal business systems in under 12 hours. The claim comes from a draft Cathedral report reviewed by The Washington Post on October 26, 2026, as relayed by Gizmodo and Decrypt. Anthropic confirms some access but disputes how the test was run and what it means.

Anthropic

What Cathedral says

Per Gizmodo, Cathedral told Anthropic its agents exploited vulnerabilities in third-party business software to reach internal systems. Cathedral's draft report says its agents reached meeting transcripts, salary and job-offer details, and Slack messages in under 12 hours. Decrypt adds that the report describes Slack messages about Anthropic's advanced models.

Both outlets report that the entry point was third-party administrative and sales software that many other companies also use, not Claude. The report's own conclusion, as quoted by Gizmodo: "weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations." Decrypt reports that Cathedral says it kept data access to the minimum needed, in line with security research best practices.

What Anthropic says

According to Gizmodo and Decrypt, Anthropic's account differs on scope and conduct:

• Researchers reached a "limited set" of sales, HR and IT systems, including business contact information for customers and partners and some basic user account records.
• Claude users' conversations, source code and model weights were not accessed.
• Anthropic says researchers spent several days trying to breach its software directly without success before using the third-party route (Gizmodo).
• Anthropic says its monitoring flagged some of the activity before Cathedral reported it, and that it shut off access the same day (Decrypt, citing Anthropic's statement to the Post).
• Anthropic disabled the affected software until the vendors confirmed fixes. The vendors are not named (Decrypt).
• Anthropic says Cathedral overstated the national security implications and did not fully follow the program's rules because it did not disclose all of its testing activity.
• Decrypt reports Anthropic has no evidence anyone other than Cathedral exploited the flaws.

The government angle

Per Gizmodo and Decrypt, an unnamed senior Trump administration official said the report raised national security concerns, and Decrypt quotes the official saying that if a small startup could do this, "potentially, the Chinese aren't far behind." Gizmodo notes that Cathedral co-founder Gavin Kliger was previously the Pentagon's chief data officer and was reportedly involved in the Pentagon's fallout with Anthropic, and that Cathedral is backed by Andreessen Horowitz and Sequoia Capital. Those ties are context, not evidence about the technical claims. Anthropic's framing, that the national security point is overstated, is the opposing view.

Three things worth separating

1. Speed. "Under 12 hours" is Cathedral's figure from an unpublished draft, and the sources describe a multi-day failed direct attempt before it. Both can be true: agent-driven testing may shorten the search once a weak path is found, while strong perimeters still hold against direct attack. The draft has not been published, so the time claim cannot be checked.

2. The attack surface. The reported path ran through vendors, not through model weights or Claude conversations. Business systems such as sales, HR and IT tools hold contact data, compensation and internal chatter. For AI labs, the sensitive assets may be well defended while surrounding SaaS tools carry the exposure. Any organization using the same vendor software shares that exposure.

3. Program scope. Bug bounty and researcher programs depend on rules: what is in scope, what must be disclosed, how much data may be touched. Anthropic says Cathedral did not follow all of them, and Cathedral says it followed best practice. Without the program terms and the full report, neither side's account can be settled from outside.

What it may mean for disclosure

Anthropic made its S-1 public on October 26, 2026. Per our earlier coverage of the filing, based on Reuters, its risk factors cover a training delay tied to security and model sandbox escapes. None of the sources reviewed says the filing addresses the Cathedral test, and it is unknown whether Anthropic considers it material. The reported facts are limited (a limited set of systems, no weights or conversations), but a public company's incident disclosure standards are different from a private company's, so this is a case to watch rather than a conclusion.

Takeaways for teams

• Map third-party tools. The reported route ran through vendor software, so inventory what holds HR, sales and IT data.
• Define test scope in writing. Disclosure duties and data limits should be explicit before outside testers start, human or agent.
• Expect agentic testing. Defenders should assume attackers and authorized researchers will both use agents, and monitor accordingly.
• Avoid single-vendor dependence. Teams that route work across providers, as in a multi-model workspace like Metir, can adapt more easily if one vendor's posture changes.

Sources:

• Former DOGE Staffers' New Startup Claims It Hacked Anthropic (Gizmodo)
• AI Agents Found a Way Into Anthropic's Business Systems in Under 12 Hours (Decrypt)
• Anthropic discloses month-long training pause, AI security breaches in IPO filing (Reuters via The Star)

Image credits

• Hero: lobby of Anthropic's San Francisco office, October 2024 visit by UK Secretary of State Peter Kyle, by Alecsandr (per file metadata), CC BY 2.0, via Wikimedia Commons. It does not depict the events described.
• In-body: same visit, by Alecsandr, CC BY 2.0, via Wikimedia Commons.