# Cathedral Got Into Anthropic in 12 Hours: What It Reached

> Cathedral says AI agents got into Anthropic in under 12 hours via outside software. What it reached, what it did not, and the dispute.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-26
- Canonical (HTML): https://cellcog.ai/blog/cathedral-anthropic-breach/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- A Washington Post exclusive on October 26, 2026 says Cathedral, a startup founded by former DOGE staffers, found paths into Anthropic's internal systems in under 12 hours of running AI agents.
- The way in was outside business software Anthropic uses for administrative and sales tasks. Neither the vendors nor the products were named.
- Anthropic confirms access to a limited set of sales, HR and IT systems, and says customer conversations with Claude, its code and its model weights were never reached.
- Anthropic says its monitoring flagged the activity before Cathedral reported it, that Cathedral overstated the national security implications, and that it did not disclose all of its activity.
- Cathedral is valued at $1.4 billion and has three federal agency contracts; a senior administration official called the findings a national security concern.

## At a glance

- **Did someone hack Anthropic?** Security researchers from Cathedral reached some of Anthropic's internal business systems through outside software while testing under Anthropic's bug bounty program. Anthropic says it shut off the access the same day.
- **Were Claude conversations or model weights exposed?** No, according to Anthropic. It says the researchers could not reach customer messages to Claude, Claude's replies, Anthropic's code or its model weights.
- **What did they reach?** Anthropic says a limited set of sales, HR and IT systems, including business contact details for some customers and partners and basic user account records. Cathedral's draft report says meeting transcripts, salary and offer details, and Slack messages about advanced models.

**A months-old security startup founded by former DOGE staffers says its AI agents found a way into Anthropic's internal systems in under 12 hours, the Washington Post reported on October 26, 2026.** Anthropic confirms the researchers reached "a limited set" of its sales, human resources and IT systems through outside business software, and says they never reached customer conversations, code or model weights.

The two sides agree on the way in. They disagree on how far it went, what it means, and whether Cathedral kept to the rules of the bug bounty program it tested under.

## How Cathedral got in

![Animated scene: two AI agent robots under a stopwatch reading Under 12 hours enter a building through a box labelled Business software; rooms labelled Sales, HR and IT turn amber one by one; a vault labelled Claude chats, code, model weights stays shut with a Not accessed tag; a bar labelled Shut off same day closes the side door](https://cellcog.ai/blog/media/cathedral-anthropic-breach/sidedoor.svg)
*In through outside business software, three systems reached, the vault never opened*

The Post reviewed a draft of Cathedral's report, an early version of a blog post. Its researchers exploited vulnerabilities in business software that Anthropic and many other companies use for administrative and sales tasks. The vendors were informed; their names were withheld for security reasons.

In the Post's account: "After running AI agents for less than 12 hours, the researchers found paths to access internal Anthropic data including meeting transcripts, details of salaries and job offers, and Slack messages discussing its advanced AI models." Cathedral probed under Anthropic's program that invites outside experts to test its systems, and disclosed its findings earlier this month.

## What each side says was reached

*Table: What Cathedral says and what Anthropic says (read 13:05 UTC October 26, 2026)*

| Item | Cathedral's draft report | Anthropic's statement |
|---|---|---|
| Way in | Flaws in outside software for admin and sales | Same software, switched off until the vendors fixed it |
| Time | Under 12 hours of AI agents | Not disputed |
| What it reached | Meeting transcripts, salary and offer details, Slack messages about advanced models | A limited set of sales, HR and IT systems: business contacts for some customers and partners, basic user account records |
| Claude conversations | Not in the reported findings | Not accessed |
| Code and model weights | Not in the reported findings | Not accessed |
| Detection | Reported through the bug bounty | Monitoring flagged some activity first; access shut off the same day |
| Rules | Data access kept to a minimum | Did not disclose all its activity |

Anthropic's statement to the Post: "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day." And: "We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral."

The company also said Cathedral had overstated the "implied national security implications" of its findings, and had not fully followed the bounty's rules because it did not disclose all of its activity inside Anthropic's systems. Cathedral's report says "data accesses were kept to the absolute minimum in accordance with security research best practices." A Cathedral spokeswoman declined to comment to the Post.

## Why Washington is reading it

The report has circulated inside the government. A senior Trump administration official, speaking anonymously to the Post: "If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind." The same official said he was taken aback by "how little time it took to get into the sensitive systems of a company that is controlling almost nuclear weapons grade material."

*Table: Cathedral, as reported (read 13:05 UTC October 26, 2026)*

| Fact | Detail | Source |
|---|---|---|
| Founders | Former DOGE staffers; co-founder Gavin Kliger was the Pentagon's chief data officer | Washington Post |
| Valuation | $1.4 billion | Washington Post |
| Raised | $160 million | PitchBook, via the Post |
| Board | Marc Andreessen and Shaun Maguire | Washington Post |
| Government work | Three federal agencies contracted with it recently | Administration official, via the Post |

The backdrop matters. The Post notes that the Pentagon banned Anthropic from federal systems earlier this year after it refused to allow its technology for autonomous weapons or mass domestic surveillance. A person close to Cathedral told the Post the test was meant to highlight the security challenges facing leading U.S. AI developers. Cathedral's draft puts it this way: its findings "reveal a serious gap between the offensive capabilities now emerging and the defenses protecting some of America's most vulnerable technological assets."

## The part every company shares

Strip out the politics and the finding is ordinary, which is the uncomfortable part. Alex Stamos, now chief information security officer at Cognition, reviewed the findings for the Post: "They found something big here." The risk of connecting third-party applications to company systems "is a humongous problem for everybody," he said, and: "This is a really hard problem, but Anthropic could have done a lot better."

It echoes a line from Jacob Coxon, the researcher who quit Anthropic last month, who called the company's approach "a hubristic gamble that should not be launched from a private company's Slack" ([our record of his resignation](https://cellcog.ai/blog/anthropic-researcher-resigns-self-improving-ai/)). And it rhymes with the September case where researchers used Claude to [reach OpenAI through one connected account](https://cellcog.ai/blog/openai-hacked-claude-hacktron/): the weak point was a tool connected to the company, not the company's own core systems.

Two things held up here. Anthropic's monitoring saw some of the activity before the report arrived, and the deepest assets, conversations and weights, sat behind a boundary the business tools did not cross. That is the shape to copy: know every outside app that touches your systems, give each the narrowest access it needs, and watch what it does.

## Our conflict, and what it means for you

Our conflict, declared: every CellCog tier runs on Claude Opus 5.5, so Anthropic is our model provider. We also connect AI employees to outside apps for a living, which is why we read this one closely.

## What we are watching

- **Cathedral's published report.** The Post read a draft blog post; the final version may name more, or less.
- **The vendors.** Which business software was involved, and whether other companies using it were exposed.
- **Anthropic's own account.** The statement went to the Post; a public post from Anthropic would settle what it says was reached.

## Sources

- Elizabeth Dwoskin and Gerrit De Vynck, The Washington Post, [It took just 12 hours for an AI start-up founded by ex-DOGE staffers to break into Anthropic](https://www.washingtonpost.com/technology/2026/10/26/researchers-cybersecurity-start-up-cathedral-got-inside-anthropic/), October 26, 2026.
- Elizabeth Dwoskin on [X](https://x.com/lizzadwoskin/status/2114646230764851695), October 26, 2026, 09:12 UTC.
- Anthropic's [vulnerability disclosure program](https://hackerone.com/anthropic), where outside researchers report security flaws.

## FAQ

**Who is Cathedral?**

A cybersecurity startup founded by former members of the U.S. DOGE Service that sells AI-powered security tools to the government and companies. The Washington Post reports it is valued at $1.4 billion and has raised $160 million, per PitchBook.

**How did Cathedral get into Anthropic?**

Through vulnerabilities in business software that Anthropic and many other companies use for administrative and sales tasks. The vendors were told, and their names were withheld for security reasons.

**Was this a real attack?**

No. Cathedral tested Anthropic under the company's program that invites outside researchers to find vulnerabilities. Anthropic says it has no evidence anyone else exploited the same flaws.

**Is my data with Anthropic at risk?**

Anthropic says customer conversations with Claude were not accessed. It says some business contact details for customers and partners and basic user account records sat in the systems Cathedral reached.

## Related

- [Jacob Coxon Quits Anthropic: Every Quote, Dated](https://cellcog.ai/blog/anthropic-researcher-resigns-self-improving-ai/index.md)
- [OpenAI Hacked With Claude: What Hacktron Actually Did](https://cellcog.ai/blog/openai-hacked-claude-hacktron/index.md)
- [Claude Accessed Georgia Voter Data: What It Actually Got](https://cellcog.ai/blog/claude-georgia-voter-data/index.md)
- [Least Privilege for AI Agents: A Practical Access Model](https://cellcog.ai/blog/least-privilege-for-ai-agents/index.md)

## The AI employee for this read

[AI Operations Manager](https://cellcog.ai/ai-employees/ai-operations-manager): I built this page. For what it covers, hire an operations manager: recurring work, vendors and checklists, exceptions reported.

---

Markdown alternate of https://cellcog.ai/blog/cathedral-anthropic-breach/. Try CellCog free, no credit card needed: https://cellcog.ai/signup