Safety#Security scan#AI safety
Ex-DOGE founders' Cathedral says its AI agents reached Anthropic's internal business systems in under 12 hours
Ex-DOGE staffers' Cathedral says its AI agents reached Anthropic's internal business systems; Anthropic confirms access but says model weights were untouched.
Cathedral is a months-old American cybersecurity startup that runs AI agents for security testing, founded by four former staffers of DOGE, the Department of Government Efficiency. According to a Washington Post exclusive published October 26, the company found during an authorized test that its agents — after failing to break Anthropic’s own software — pivoted to third-party business applications and, by its draft report’s account, found paths into internal sales, HR and IT systems in under 12 hours, reaching employee salary data, job offers, meeting transcripts and Slack channels discussing Anthropic’s advanced models. Anthropic confirmed the researchers reached a limited set of sales, HR and IT systems, and says customer conversations, source code and model weights were untouched. The disagreement over what the episode proves is already useful: it puts every SaaS integration in your own stack on notice.
Key points
- The entry point was not the model: agents exploited flaws in third-party admin, HR and sales software; Claude itself, customer prompts and model weights were never reached (Anthropic’s statement)
- The 12-hour claim comes from Cathedral’s draft report; Anthropic confirmed the access but never endorsed the clock
- The conduct dispute: Anthropic says its monitoring flagged some activity before Cathedral reported, cut access the same day, and accuses the startup of not fully following disclosure-program rules
Background
The founders give the story its political charge. Cathedral was founded by Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein; per the Post as relayed by Gizmodo and CyberSecurityNews, Kliger was the Pentagon’s chief data officer and was involved in the Pentagon’s legal dispute with Anthropic, while Elez resigned from DOGE over racist tweets and was rehired by Musk. Within months the company raised $160 million in July 2026 at a $1.4 billion valuation from Andreessen Horowitz and Sequoia Capital, and three federal agencies have signed contracts with it.
There is also a preamble worth noting: per TechStartups’ retelling, Cathedral’s agents spent days trying and failing to breach Anthropic’s software directly before shifting to the third-party business apps. The test ran under Anthropic’s external vulnerability research program, the Post reported, making it authorized rather than an attack. The report has reportedly circulated inside the US government; an unnamed senior official told the Post of concern that Chinese hackers could exploit similar weaknesses.
The facts
Both sides agree on what happened; they disagree on scope, framing and timing. The confirmed picture:
| Item | Detail | Source |
|---|---|---|
| Entry point | Flaws in third-party admin, HR, sales and customer-management software | Anthropic statement, via Gizmodo |
| Data reached | Some customer and partner contact records, basic account records; Cathedral also claims salaries, job offers and model discussions | Anthropic statement / Cathedral draft report |
| Not reached | Claude customer conversations and responses, source code, model weights | Anthropic statement |
| 12 hours | Cathedral says paths were found in under 12 hours; Anthropic has not endorsed the figure | Cathedral draft report / explainx cross-check |
| Response | Monitoring flagged activity first, access cut same day, affected software disabled pending vendor fixes, no evidence of third-party exploitation | Anthropic statement |
| Funding | $160M raised July 2026 at a $1.4B valuation | Reuters, via CyberSecurityNews |
One caveat on sourcing: this entry leans on Anthropic’s statement and secondary retellings of the Post’s reporting — the original sits behind a paywall and would not load in full here. Founder names and data types are corroborated by at least two independent retellings. The 12-hour figure has a start-point problem, an unknown level of human steering, and no human-red-team baseline; the explainx cross-check lists all three.
What others say
Anthropic’s language is measured: researchers reached “a limited set of sales, HR and IT systems,” while the company accuses Cathedral of not fully complying with its disclosure program’s requirements, Gizmodo reports; the national-security concerns came from an unnamed administration official, not from Anthropic. Cathedral’s account inverts that: it says it minimized data access, disclosed earlier this month, and alerted the unnamed affected vendors.
Industry voices point at the shared lesson rather than either side’s conduct. Alex Stamos, CISO at Cognition, argued the case exposes weak third-party software integration management — a problem far broader than Anthropic, because nearly every company hands sales, HR and IT to a pile of SaaS products whose access surfaces get far less scrutiny. Hugging Face CEO Clément Delangue also weighed in on X (summary only; not read in full). In community discussion, the episode gets filed next to OpenAI’s training-environment red-team report and the Storm-0940 supply-chain intrusion: agents are now both the attacker’s tool and the defender’s instrument.
Our take
The useful lesson is not “Anthropic got hacked” — it did not, and no customer data was lost. It is where the attack surface moved. If a team of agents run by four ex-government staffers can reach an AI company’s internal systems through its third-party SaaS, then every OAuth grant, every outbound integration and every “internal only” admin panel in your permission model is the same kind of door. We have seen this pattern before: LiteLLM’s compromised release chain, Manus’s single-email Gmail exploit and Railway’s leaked environment variables all pointed at the same rule — the seams between systems fail before the systems do.
Three threads to watch: which vendors were affected, what exactly Anthropic means by “did not fully follow its testing rules,” and whether the final report shifts the framing. One honest reservation — the 12-hour figure rests on Cathedral’s own draft report with an unknown start point, so read it discounted.
What to watch
- The final report: whether it survives the draft’s 12-hour claim decides how much this number is worth
- Anthropic’s disclosure-program rules: if the two sides’ rule dispute develops, it lands there
- Capitol Hill: the report has circulated in government and three federal agencies are Cathedral’s customers, so an oversight review is plausible