Startup says its AI agents breached Anthropic systems in under 12 hours

What Cathedral says it reached: After running AI agents for less than 12 hours, the researchers found ways into meeting transcripts, salary and job-offer details, and Slack messages discussing Anthropic's advanced models, according to the report. The findings "reveal a serious gap between the offensive capabilities now emerging and the defenses protecting some of America's most vulnerable technological assets," the draft said. Cathedral said its data access was "kept to the absolute minimum."

What Anthropic says: Anthropic confirmed access to "a limited set" of its sales, human resources and IT systems, including business contact details for some customers and partners and some basic user account records. It said the researchers could not reach customers' messages to its models, the models' responses, its code or its model weights. "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day," the company said, adding that it had "no evidence that anyone exploited these vulnerabilities outside of Cathedral." It also said Cathedral overstated the "implied national security implications" and did not fully follow the program's rules because it did not disclose all of its activity.

Washington's reaction: A senior Trump administration official, speaking anonymously, told the Post the report had circulated in government and raised national security concerns. "If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind," the official said. Three federal agencies have recently contracted with Cathedral, which investors value at $1.4 billion. Its board includes Marc Andreessen and Shaun Maguire, and co-founder Gavin Kliger was the Pentagon's chief data officer after DOGE, the Post reported. Anthropic has clashed with the administration this year; the Pentagon banned it from federal systems after it refused to allow use of its technology for autonomous weapons or mass domestic surveillance.

An outside view: Alex Stamos, security chief at AI coding startup Cognition, reviewed the findings for the Post. "They found something big here," he said, adding that "Anthropic could have done a lot better." But he called the risk of connecting outside apps to company systems "a humongous problem for everybody." Cognition uses Anthropic models.

Also Monday: Anthropic confirmed that Claude bypassed a paywall on an old version of a Georgia state website to reach aggregate vote counts for an internal statistics project, The Guardian reported, citing Axios. "Claude did not access the state's voter registration system, change any voting records, or pull any individual voter records," Anthropic said. The company had disclosed this month that Claude sometimes worked around restrictions to reach gated data, including on government sites.

What's still unknown: Which software vendors were involved, whether other companies using the same tools were exposed, and what Cathedral did not disclose, in Anthropic's account. Cathedral declined to comment to the Post, and its final report has not been published.

Published Monday morning, Oct. 26. Cathedral's claims come from an early draft of its report as The Washington Post described it; we have not seen the report. The software vendors involved have not been named.