In a revelation that underscores the rapidly evolving threat landscape for artificial intelligence companies, cybersecurity startup Cathedral says its AI-powered agents penetrated Anthropic’s internal business systems in fewer than 12 hours. The finding, first reported by The Washington Post on October 26, highlights a troubling gap between the offensive capabilities of autonomous AI tools and the defenses protecting some of the world’s most valuable technology assets.
What Happened
Cathedral, a months-old firm founded by former members of the U.S. DOGE Service, conducted the test under Anthropic’s bug bounty program—an authorized outside-researcher initiative, not a criminal intrusion. According to a draft report reviewed by The Washington Post, Cathedral’s researchers deployed AI agents that autonomously identified exploitable pathways into Anthropic’s infrastructure in under 12 hours.
The agents did not attack Anthropic’s own software or its flagship Claude AI models directly. Instead, they targeted vulnerabilities in unnamed third-party business applications that Anthropic uses for administrative and sales operations—the same class of SaaS tools that thousands of organizations rely on daily. Anthropic confirmed that Cathedral’s researchers first spent several days attempting to penetrate its core software before pivoting to the weaker third-party surface.
What Was Accessed
The scope of what Cathedral reached is a point of contention between the two companies. Anthropic says the researchers accessed “a limited set” of its sales, HR, and IT systems, including business contact information for some customers and partners and basic user account records.
Cathedral’s draft report paints a broader picture. It describes routes to internal meeting transcripts, employee salary and job-offer details, and Slack discussions about Anthropic’s advanced AI models. Anthropic maintains that customer conversations with Claude, model responses, proprietary source code, and model weights were never compromised.
The distinction matters. While the accessed data does not include Anthropic’s crown jewels—the model weights and training infrastructure—salary records, internal strategy discussions, and customer contact lists are exactly the kind of intelligence a nation-state adversary would prize for espionage, social engineering, or competitive advantage.
Who Is Cathedral
Cathedral was co-founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein, all of whom previously worked with the Department of Government Efficiency. Kliger later served as the Pentagon’s chief data officer. The company raised $160 million at a $1.4 billion valuation, according to Reuters, with backing from Andreessen Horowitz and Sequoia Capital. Board members include Marc Andreessen and Shaun Maguire.
Three federal agencies have recently contracted with Cathedral, a senior administration official told The Washington Post. The firm builds AI-powered offensive security tools for government and corporate clients—and the Anthropic engagement is, in effect, a live advertisement for those capabilities.
Anthropic’s Response
Anthropic said its own monitoring systems flagged some of Cathedral’s activity before the startup filed its report. The company cut off Cathedral’s access the same day, disabled the affected third-party software, and restored it only after the vendors confirmed patches were in place. Anthropic also briefed federal officials.
However, Anthropic pushed back on Cathedral’s framing, saying the startup overstated the national security implications and did not fully comply with the bug bounty program’s disclosure rules—specifically, that Cathedral did not report all of its activity inside Anthropic’s systems. Cathedral’s draft report counters that its data access was “kept to a minimum in line with security research practices.”
Anthropic said it found no evidence that anyone other than Cathedral exploited the vulnerabilities.
The Bigger Picture
Independent expert Alex Stamos, chief information security officer at AI coding startup Cognition, reviewed Cathedral’s findings for The Washington Post. He said the results exposed weaknesses in how Anthropic manages third-party software integrations, adding that “Anthropic could have done a lot better.”
The finding arrives amid a turbulent period for AI company security. Earlier this month, the FBI arrested an OpenAI employee for allegedly planting a recording device in an executive conference room. Former Anthropic employee Jacob Coxon resigned last month and publicly criticized the company’s reliance on conventional business software, calling it “a hubristic gamble.”
A senior administration official told The Post that Cathedral’s report has circulated within the Trump administration and raised national security alarms. The concern is straightforward: if a small, newly formed startup can use AI agents to breach a frontier AI lab’s internal systems in half a day, what could a well-resourced foreign intelligence service accomplish? The administration is reportedly now working with Cathedral to model adversarial AI attack scenarios.
Key Takeaways
Third-party software remains the soft underbelly. Cathedral’s AI agents did not crack Anthropic’s own code—they exploited the ecosystem of business tools around it. This is a pattern security teams see over and over: organizations invest heavily in securing their core product while the SaaS applications handling HR, sales, and internal communications receive far less scrutiny. Every third-party integration is an attack surface.
AI-powered offensive tools are maturing fast. The fact that autonomous agents could map and exploit access routes in under 12 hours—after human researchers spent days failing to breach the core systems—signals a step change in penetration testing and, by extension, in real-world attacks. Defenders must assume that adversaries, including nation-states, are building and deploying similar tools.
Bug bounty programs remain essential, but trust is complicated. The Anthropic-Cathedral dispute over disclosure norms highlights the inherent tension in bug bounty engagements. Organizations need outside researchers to find blind spots, but defining the boundaries of authorized access—and agreeing on how findings are characterized—requires clear, enforceable rules of engagement.
AI labs are high-value targets. Frontier AI companies hold model weights, training data, research roadmaps, and customer data that make them prime targets for espionage. The security bar for these organizations needs to be higher than industry standard, not equal to it.
For security teams everywhere, the Cathedral-Anthropic episode is a reminder to audit third-party integrations aggressively, assume AI-driven attacks are already in play, and treat bug bounty programs as a critical—but carefully governed—layer of defense.
Leave a Reply