Cathedral, a months-old AI cybersecurity startup co-founded by four former Department of Government Efficiency (DOGE) staffers, confirmed Monday that its researchers breached sensitive internal systems at Anthropic — the maker of Claude — in under 12 hours, using AI agents to exploit vulnerabilities in third-party business software rather than Anthropic’s own code. The disclosure has opened a public dispute between the two companies over scope, transparency, and the national-security implications of how frontier AI labs secure the administrative software surrounding their most sensitive assets.
The entry point was not Claude, not Anthropic’s model weights, and not its source code. It was the HR platforms, sales CRMs, IT management tools, and collaboration software that Anthropic — like virtually every major technology organization — relies on for ordinary business operations.
Cathedral maintained in its draft report that its researchers kept data access to a minimum and characterized the exercise as a demonstration of wider industry risk. The report stated: “The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America.”
How Cathedral Got In — and What It Found
Cathedral’s AI agents did not crack Anthropic’s primary systems. According to Cathedral’s draft report reviewed by The Washington Post, researchers first spent several days attempting to breach Anthropic’s own software directly — and failed. The breakthrough came when they pivoted to Anthropic’s third-party enterprise software ecosystem.
Once pointed at that attack surface, the agents mapped available paths autonomously. Within under 12 hours of that pivot, they reached sensitive data: internal meeting transcripts, employee salary and job-offer details, and Slack discussions about Anthropic’s most advanced AI models. Business contact information for some Anthropic customers and partners was also within reach. The affected third-party vendors were not publicly named, reportedly while security patches are developed.
Anthropic said its own monitoring systems flagged portions of Cathedral’s activity before the startup filed its formal disclosure. The company disabled the affected software the same day the intrusion was confirmed, briefed federal officials, and restored the software only after the relevant vendors confirmed their patches were in place. Anthropic said it found no evidence that any actor outside Cathedral had exploited the same vulnerabilities.
The company was precise about what Cathedral did not reach: Claude user conversations, Anthropic’s source code, and its AI model weights remained beyond reach throughout the exercise.
Bug Bounty Program and a Disputed Disclosure
The breach was conducted under Anthropic’s vulnerability-disclosure program, which pays outside researchers to surface and report security flaws. Cathedral submitted its findings both to Anthropic and to the affected third-party vendors.
Anthropic disputes how Cathedral handled that disclosure. The company accused Cathedral of violating the program’s terms by failing to fully describe the extent of its activity inside Anthropic’s systems. Bug bounty scope disputes are a recognized tension in the security industry: researchers who operate beyond a program’s defined terms can face legal exposure, and companies have at times responded to out-of-scope disclosures with legal action rather than payment. Anthropic has not filed a legal complaint as of the date of this report.
Anthropic also stated that Cathedral had overstated the national-security implications of its findings. A Cathedral spokeswoman declined to comment on the dispute.
Who Is Cathedral?
Cathedral is an AI-driven cybersecurity startup targeting military and government applications, co-founded by former DOGE staffers Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein. The company has already secured contracts with three federal agencies.
Of the four founders, Kliger carries the most direct institutional history with Anthropic. After leaving DOGE, he served as the Pentagon’s Chief Data Officer, a position he was appointed to in March 2026. During that period, a high-profile dispute emerged between the Department of Defense and Anthropic over restrictions on how Anthropic’s models could be used within federal systems — a dispute Kliger was reportedly involved in as the DoD’s data chief. The Cathedral-Anthropic breach adds a further dimension to that history: the Pentagon official who clashed with Anthropic over AI access later demonstrated, in a private-sector capacity, that Anthropic’s administrative systems can be reached through the right technique.
Co-founder Marko Elez drew public attention in early 2025 when he resigned from DOGE after racist social-media posts surfaced, then was rehired following public support from Elon Musk and Vice President JD Vance. Luke Farritor is separately known for his 2023 work using AI to decipher previously unreadable text from the Herculaneum papyri — carbonized scrolls buried by the eruption of Mount Vesuvius — winning a prize in the international Vesuvius Challenge.
Despite its brief operating history, Cathedral has attracted serious capital. The company raised $160 million at a $1.4 billion valuation, according to Pitchbook, with backing from Andreessen Horowitz and Sequoia Capital. Trump allies Marc Andreessen and Shaun Maguire sit on Cathedral’s board, according to Gizmodo’s reporting on the company.
How Do AI Agents Make Enterprise Software Attacks Faster?
Cathedral’s technique — AI agents autonomously mapping and exploiting a target’s enterprise-software ecosystem to bypass a hardened primary perimeter — represents a documented acceleration of a long-established attack pattern.
Supply chain attacks exploit the weakest link in a network of trusted vendor relationships. The canonical examples track the same logic: the 2013 Target breach via an HVAC contractor, the 2020 SolarWinds compromise that affected roughly 18,000 organizations through a poisoned software update, and the NotPetya attack that spread globally through a Ukrainian accounting software update — all exploited weakest-vendor entry points because the primary target’s own defenses were strong while the ecosystem around it was not. Each integration with a weaker member created an entry point.
What AI agents add is speed and autonomous parallelism. A human attacker mapping an organization’s enterprise software integrations — tracing which CRM connects to which HR platform, which IT management tool carries which credentials, where Slack integrations pass data — is constrained by time and attention. AI agents running autonomously can traverse those integrations simultaneously, chain vulnerabilities across connected services, and reach sensitive data in hours rather than days.
Alex Stamos, chief information security officer at AI coding startup Cognition and a former chief security officer at Facebook, reviewed Cathedral’s draft report for The Washington Post. Stamos said the investigation revealed weaknesses in how Anthropic manages its third-party software integrations — a critique he characterized as applying broadly across the technology industry, not specific to Anthropic.
Washington Weighs In: National-Security Stakes
Cathedral’s draft report has circulated within the federal government. A senior Trump administration official, speaking on condition of anonymity, told The Washington Post that the findings had raised national security concerns and that the government was working with Cathedral on hostile AI scenarios. The official described the potential for foreign adversaries to access AI lab internals in terms that compared such access to reaching “almost nuclear weapons grade material.”
That framing reflects a position US officials have advanced in other contexts: frontier AI labs have crossed into a strategic category in which their model weights, training pipelines, and proprietary research represent assets with national-security dimensions beyond their commercial value. The concern officials named specifically is China — state-sponsored hackers using identical AI-agent techniques to traverse the same enterprise-software attack surfaces at frontier AI labs, reaching data that no commercial breach-notification framework was designed to protect.
Anthropic disputed that characterization as applied to Cathedral’s specific findings. The company maintained that the systems Cathedral reached were administrative in nature and that the national-security framing did not reflect what was actually accessed.
Supply-Chain Security: Problem No AI Lab Controls Alone
The deepest implication of the Cathedral exercise is structural. Frontier AI labs invest heavily in securing their core systems: model weights, training pipelines, source code, inference infrastructure. Those investments reflect the accurate understanding that these are the strategically significant assets. What the Cathedral breach documents is that an attacker who cannot reach those assets directly can reach them indirectly — through the administrative software layer that connects an AI lab to its HR vendor, its CRM provider, its IT management platform, and its collaboration tools.
That layer is not under the AI lab’s direct security control. The security of a frontier AI lab’s enterprise software depends on the security practices of each vendor, each vendor’s patch cadence, and each vendor’s response time when a vulnerability is discovered. An AI lab can harden everything it builds. It cannot harden the software it buys.
The SolarWinds compromise in 2020 established that trusted software-update channels can deliver malicious code to hardened targets. Cathedral’s exercise in 2026 establishes that AI agents can systematically probe an organization’s vendor relationships and find an exploitable path in under 12 hours — at a cost and complexity that places the technique within reach of actors far less resourced than a nation-state.
Anthropic recently filed for an IPO and operates at the center of US AI policy debates. Material security incidents may require disclosure in forthcoming SEC filings. The vendor patch process triggered by Cathedral’s disclosure remains ongoing as of the date of this report.
AI-Industry Security: Documented Incidents in 2026
The Cathedral disclosure arrives in a year already marked by a pattern of AI-lab security events. A Chinese-speaking threat actor used AI agents powered by DeepSeek and Anthropic’s Claude Code to conduct a campaign targeting more than 1,200 e-commerce websites across the United States, Canada, Australia, and Japan, successfully breaching more than 100 of them — at a reported total cost to the attacker of approximately $5,000, according to Reuters citing a report from cybersecurity firm NorForge. Methods included AI agents running with minimal human-language prompts, costing roughly $50 per successful breach and an average of 23 hours per completed intrusion.
At OpenAI, a former engineer — a Saudi national named Abdulrahman Alfozan — was arrested on October 9, 2026, accused of secretly planting a recording device in a restricted company conference room. According to court filings, prosecutors alleged Alfozan had Saudi royal family contact with a member who sought to recruit him for a Saudi AI initiative. The FBI investigation is ongoing.
Anthropic suffered additional security lapses earlier in 2026: details of an unreleased model and internal CEO retreat were discovered in an unsecured data store, and the source code for Anthropic’s Claude Code tool — approximately 512,000 lines of code — was accidentally exposed.
The pattern across these incidents is consistent: AI organizations are generating assets of rapidly growing strategic and commercial value while the security infrastructure surrounding those assets — both core and peripheral — faces sustained and increasingly capable pressure.
What Comes Next
For Anthropic, the immediate path involves completing the vendor patching process, maintaining briefings with federal officials, and navigating the public dispute with Cathedral — which has not yet produced legal action from either party. Anthropic’s characterization of the breach as affecting only peripheral administrative systems is technically accurate as described. What Cathedral’s exercise nonetheless demonstrates is that a frontier AI lab’s perimeter is only as strong as its weakest vendor integration.
Cathedral, for its part, has filed its findings, notified the affected vendors, and positioned the exercise as a proof of concept rather than a hostile operation. The company’s founding team, its military-focused contracts, and its investors all point toward a company that intends to make the case — to government clients as much as corporate ones — that AI agents have permanently altered the threat model for organizations whose core assets are too well-defended to breach directly.
For every organization that shares the same enterprise software ecosystem as Anthropic — which is every major technology company operating today — Cathedral’s 12-hour exercise is a documented proof of concept, not a contained event.
Frequently Asked Questions
How did Cathedral breach Anthropic?
Cathedral’s AI agents did not breach Anthropic’s own systems directly — they found their way in through third-party enterprise software. After spending several days trying and failing to penetrate Anthropic’s primary systems, Cathedral pivoted to the HR platforms, CRM tools, and IT management software Anthropic uses for business operations. AI agents autonomously mapped the available attack surfaces across those vendor integrations and reached sensitive internal data — meeting transcripts, salary records, and Slack discussions about advanced AI models — in under 12 hours.
What data was exposed in the Anthropic security breach?
Anthropic described Cathedral’s access as reaching a “limited set” of its sales, HR, and IT systems — containing business contact information for some customers and partners, employee salary and job-offer details, internal meeting transcripts, and Slack discussions about advanced AI models. Anthropic was explicit that Claude user conversations, its source code, and its AI model weights were not accessed. The company disabled the affected software the same day it confirmed the intrusion and briefed federal officials.
Are all AI labs equally exposed through their enterprise software?
The supply-chain technique Cathedral used does not target anything unique about Anthropic’s security posture. Any organization whose core systems are hardened but whose enterprise software vendors are not uniformly current on patches is exposed to the same attack logic. AI labs, government agencies, financial institutions, and technology companies all depend on the same categories of HR, CRM, and IT management software — and each vendor integration represents a potential attacker pivot point for anyone who cannot breach the primary target directly. AI agents accelerate the discovery of those pivot points, reducing the skill and resource requirements dramatically.
What do the national-security implications of this breach mean for AI labs?
A senior Trump administration official told The Washington Post that Cathedral’s findings had circulated within the government and compared potential adversary access to frontier AI lab internals to reaching material that was “almost nuclear weapons grade” in strategic value. The specific concern is that state-sponsored hackers — Chinese actors in particular, who have used comparable AI-agent techniques in documented 2026 campaigns — could exploit identical enterprise-software vulnerabilities at frontier AI labs to reach model weights, proprietary research, or sensitive strategic communications. Anthropic disputed the characterization as applied to what Cathedral specifically accessed, but the broader concern about the technique — and the attack surface it targets — reflects a documented and unresolved structural exposure across the industry.