Startup Founded by DOGE Alumni Says Its AI Agents Got Inside Anthropic in Under 12 Hours
Cathedral, a months-old security startup run by former DOGE staffers, says its AI agents reached Anthropic salary data and Slack messages in under 12 hours. Anthropic says only a limited set of systems was touched and accuses the startup of breaking its testing rules.
The lab that sells itself as the most safety-obsessed name in AI just got a security audit it did not enjoy. Cathedral, a months-old cybersecurity startup founded by former DOGE staffers, says its AI agents found paths into sensitive internal systems at Anthropic in less than 12 hours. That claim comes from a draft Cathedral report seen by The Washington Post, and Anthropic is disputing how much it really means.
Anthropic's version is narrower. The company confirmed the researchers reached what it called "a limited set" of its sales, human resources and IT systems, exposing business contact information for some customers and partners plus some basic user account records. It said they did not access Claude users' conversations, source code or model weights. And it went on the offensive, accusing Cathedral of breaking the rules of the testing program it was working under by failing to fully disclose its activity inside Anthropic's systems.
"Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day." Anthropic, in a statement
So there are two stories here, and they do not fully line up.
In Cathedral's telling, as reported by the Post, its agents went after business software that Anthropic, like many other companies, uses for administrative and sales work. By exploiting vulnerabilities in those third-party tools, the startup says, the agents found routes to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic's models. The Post withheld the names of the vendors. Anthropic adds a detail that cuts the other way: according to the company, the same researchers had previously spent several days trying and failing to breach its own software directly.
That is the real lesson. If Cathedral's account holds up, the weak point was not Claude or the lab's core code. It was the ordinary SaaS plumbing every company bolts onto its business.
"The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America." Cathedral's draft report, as quoted by The Washington Post
Alex Stamos, chief information security officer at AI coding startup Cognition, told the Post the episode exposes how companies manage third-party software. "This is a really hard problem, but Anthropic could have done a lot better," he said.
Who is doing the testing
The messenger is part of the story. Cathedral was founded by former DOGE staffers Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, according to Gizmodo's summary of the Post report, and builds AI-powered security tools for the US government and corporate clients. It is valued at $1.4 billion and has raised $160 million from investors including Andreessen Horowitz and Sequoia Capital, Gizmodo reported. Gizmodo also noted that Kliger previously served as the Pentagon's chief data officer and was reportedly involved in the Pentagon's public fallout with Anthropic. None of that proves anything about this test, but it explains why Anthropic might bristle at this team's report landing in Washington.
And it has landed. A senior Trump administration official told the Post the report had circulated within the government and raised national security concerns, including fears that Chinese hackers could abuse similar flaws. Anthropic said it briefed federal officials, but argued that Cathedral had overstated the national security implications. The company said it disabled the affected software until vendors confirmed fixes, and that it found no evidence of anyone other than Cathedral exploiting the vulnerabilities. Cathedral, for its part, said it kept data access to the minimum its research required.
Agentic hacking is not hypothetical, as Microsoft's account of AI agents running a China-aligned breach showed this month. What is new is an AI lab sitting on the receiving end, with a well-funded startup and the lab itself fighting in public over what was reached and who played by the rules. Until Cathedral publishes a final report or Anthropic shares more detail, the safest reading is the narrow one both sides agree on: the agents got in through someone else's software, and Anthropic says the crown jewels were never touched.
