Cathedral’s AI agents broke into Anthropic in under 12 hours

Cathedral, a months-old security start-up, used AI agents to get into Anthropic’s sales, HR and IT systems through the vendor software those systems run on, and reached employee salaries, job offers, meeting transcripts and Slack messages. The account comes from a Cathedral draft report that The Washington Post reviewed for an October 26 story. If your company is an Anthropic customer or partner, Anthropic says what it confirms was exposed is business contact details for some customers and partners plus basic user account records. It says Claude conversations, model outputs, source code and model weights stayed out of reach.

The way in

Cathedral did the work under Anthropic’s programme that pays outside researchers to report security flaws. According to the draft report, the researchers first spent several days attacking Anthropic’s own software and failed. They then turned to the third-party tools Anthropic uses for ordinary business: HR platforms, sales CRMs, IT management tools and collaboration software. Against those tools the agents mapped the available paths on their own and reached sensitive data in under 12 hours, after days of getting nowhere against Anthropic’s own code.

Anthropic puts the access at a limited set of its sales, HR and IT systems. “Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day,” the company said in a statement. It disabled the affected software and brought it back only after the vendors confirmed the flaws were fixed. It also briefed federal officials, and says it has found no evidence that anyone other than Cathedral exploited the vulnerabilities. Cathedral sent its findings to the vendors too. They have not been publicly named.

What Anthropic disputes

Anthropic says Cathedral overstated the national security implications. It also says the start-up broke its testing programme’s rules by not disclosing all of its activity inside Anthropic’s systems. The draft report says “data accesses were kept to the absolute minimum in accordance with security research best practices,” and that the weaknesses in ordinary enterprise software “should be a wake-up call for every company in America.” Anthropic has disputed an outside researcher’s framing before: it said one researcher’s findings in Claude’s chat sandbox fall outside its threat model.

The report has gone around inside the government and raised national security concerns, a senior Trump administration official said. The official was not named. “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind,” the official said, per Quartz.

Four former Department of Government Efficiency (DOGE) staffers co-founded Cathedral: Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. The company builds AI-powered security tools for government agencies and corporate clients. Quartz reported that in July it closed a $160 million funding round that valued it at $1.4 billion.

Alex Stamos, chief information security officer at the AI coding start-up Cognition, said the weak point was how companies manage third-party software: “This is a really hard problem, but Anthropic could have done a lot better.”