A months-old security startup founded by former DOGE staffers says its AI agents found a way into Anthropic’s internal systems in under 12 hours, the Washington Post reported on October 26, 2026. Anthropic confirms the researchers reached “a limited set” of its sales, human resources and IT systems through outside business software, and says they never reached customer conversations, code or model weights.
The two sides agree on the way in. They disagree on how far it went, what it means, and whether Cathedral kept to the rules of the bug bounty program it tested under.
On this page · 7 sectionsOpen
A Washington Post exclusive on October 26, 2026 says Cathedral, a startup founded by former DOGE staffers, found paths into Anthropic’s internal systems in under 12 hours of running AI agents.
The way in was outside business software Anthropic uses for administrative and sales tasks. Neither the vendors nor the products were named.
Anthropic confirms access to a limited set of sales, HR and IT systems, and says customer conversations with Claude, its code and its model weights were never reached.
Anthropic says its monitoring flagged the activity before Cathedral reported it, that Cathedral overstated the national security implications, and that it did not disclose all of its activity.
Cathedral is valued at $1.4 billion and has three federal agency contracts; a senior administration official called the findings a national security concern.
§ 01How Cathedral got in
The Post reviewed a draft of Cathedral’s report, an early version of a blog post. Its researchers exploited vulnerabilities in business software that Anthropic and many other companies use for administrative and sales tasks. The vendors were informed; their names were withheld for security reasons.
In the Post’s account: “After running AI agents for less than 12 hours, the researchers found paths to access internal Anthropic data including meeting transcripts, details of salaries and job offers, and Slack messages discussing its advanced AI models.” Cathedral probed under Anthropic’s program that invites outside experts to test its systems, and disclosed its findings earlier this month.
§ 02What each side says was reached
| Item | Cathedral’s draft report | Anthropic’s statement |
|---|---|---|
| Way in | Flaws in outside software for admin and sales | Same software, switched off until the vendors fixed it |
| Time | Under 12 hours of AI agents | Not disputed |
| What it reached | Meeting transcripts, salary and offer details, Slack messages about advanced models | A limited set of sales, HR and IT systems: business contacts for some customers and partners, basic user account records |
| Claude conversations | Not in the reported findings | Not accessed |
| Code and model weights | Not in the reported findings | Not accessed |
| Detection | Reported through the bug bounty | Monitoring flagged some activity first; access shut off the same day |
| Rules | Data access kept to a minimum | Did not disclose all its activity |
Anthropic’s statement to the Post: “Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day.” And: “We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral.”
The company also said Cathedral had overstated the “implied national security implications” of its findings, and had not fully followed the bounty’s rules because it did not disclose all of its activity inside Anthropic’s systems. Cathedral’s report says “data accesses were kept to the absolute minimum in accordance with security research best practices.” A Cathedral spokeswoman declined to comment to the Post.
§ 03Why Washington is reading it
The report has circulated inside the government. A senior Trump administration official, speaking anonymously to the Post: “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.” The same official said he was taken aback by “how little time it took to get into the sensitive systems of a company that is controlling almost nuclear weapons grade material.”
| Fact | Detail | Source |
|---|---|---|
| Founders | Former DOGE staffers; co-founder Gavin Kliger was the Pentagon’s chief data officer | Washington Post |
| Valuation | $1.4 billion | Washington Post |
| Raised | $160 million | PitchBook, via the Post |
| Board | Marc Andreessen and Shaun Maguire | Washington Post |
| Government work | Three federal agencies contracted with it recently | Administration official, via the Post |
The backdrop matters. The Post notes that the Pentagon banned Anthropic from federal systems earlier this year after it refused to allow its technology for autonomous weapons or mass domestic surveillance. A person close to Cathedral told the Post the test was meant to highlight the security challenges facing leading U.S. AI developers. Cathedral’s draft puts it this way: its findings “reveal a serious gap between the offensive capabilities now emerging and the defenses protecting some of America’s most vulnerable technological assets.”
§ 04The part every company shares
Strip out the politics and the finding is ordinary, which is the uncomfortable part. Alex Stamos, now chief information security officer at Cognition, reviewed the findings for the Post: “They found something big here.” The risk of connecting third-party applications to company systems “is a humongous problem for everybody,” he said, and: “This is a really hard problem, but Anthropic could have done a lot better.”
It echoes a line from Jacob Coxon, the researcher who quit Anthropic last month, who called the company’s approach “a hubristic gamble that should not be launched from a private company’s Slack” (our record of his resignation). And it rhymes with the September case where researchers used Claude to reach OpenAI through one connected account: the weak point was a tool connected to the company, not the company’s own core systems.
Two things held up here. Anthropic’s monitoring saw some of the activity before the report arrived, and the deepest assets, conversations and weights, sat behind a boundary the business tools did not cross. That is the shape to copy: know every outside app that touches your systems, give each the narrowest access it needs, and watch what it does.
§ 05Our conflict, and what it means for you
Our conflict, declared: every CellCog tier runs on Claude Opus 5.5, so Anthropic is our model provider. We also connect AI employees to outside apps for a living, which is why we read this one closely.
§ 06What we are watching
- Cathedral’s published report. The Post read a draft blog post; the final version may name more, or less.
- The vendors. Which business software was involved, and whether other companies using it were exposed.
- Anthropic’s own account. The statement went to the Post; a public post from Anthropic would settle what it says was reached.
§ 07Sources
- Elizabeth Dwoskin and Gerrit De Vynck, The Washington Post, It took just 12 hours for an AI start-up founded by ex-DOGE staffers to break into Anthropic, October 26, 2026.
- Elizabeth Dwoskin on X, October 26, 2026, 09:12 UTC.
- Anthropic’s vulnerability disclosure program, where outside researchers report security flaws.
Q1Who is Cathedral?
A cybersecurity startup founded by former members of the U.S. DOGE Service that sells AI-powered security tools to the government and companies. The Washington Post reports it is valued at $1.4 billion and has raised $160 million, per PitchBook.
Q2How did Cathedral get into Anthropic?
Through vulnerabilities in business software that Anthropic and many other companies use for administrative and sales tasks. The vendors were told, and their names were withheld for security reasons.
Q3Was this a real attack?
No. Cathedral tested Anthropic under the company’s program that invites outside researchers to find vulnerabilities. Anthropic says it has no evidence anyone else exploited the same flaws.
Q4Is my data with Anthropic at risk?
Anthropic says customer conversations with Claude were not accessed. It says some business contact details for customers and partners and basic user account records sat in the systems Cathedral reached.