The Anthropic logo. Image: Anthropic
A months-old cybersecurity start-up founded by former DOGE staffers says its AI agents found paths into Anthropic’s Slack messages, meeting transcripts and salary records in less than 12 hours. The start-up, Cathedral, got in through Anthropic’s own programme for outside security researchers, and Anthropic says the hole was much smaller than Cathedral claims, The Washington Post reported on Monday, October 26, citing a draft report it reviewed.
Cathedral didn’t break Claude itself. It exploited flaws in business software that Anthropic, like many companies, uses for administrative and sales work; the Post withheld the vendors’ names for security reasons.
What Cathedral says it reached #
According to the draft, which the Post describes as an early version of a blog post, Cathedral’s AI agents found routes to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic’s most advanced AI models. Cathedral reported the findings to Anthropic earlier this month through the company’s bug bounty programme, which invites outside experts to probe its systems and rewards them for disclosing flaws, and it also told the software vendors.
The draft calls the result evidence of “a serious gap between the offensive capabilities now emerging and the defenses” and says it “should be a wake-up call for every company in America”. It also says Cathedral’s “data accesses were kept to the absolute minimum in accordance with security research best practices.” A Cathedral spokeswoman declined to comment to the Post.
Anthropic: “a limited set” of systems #
Anthropic’s account is narrower. It told the Post that Cathedral reached “a limited set” of its sales, HR and IT systems, that its own monitoring flagged some of the activity before Cathedral reported it, and that “we shut off their access the same day.”
The exposed data, Anthropic says, included some customer and partner business contacts and basic user account records. Cathedral could not reach customer messages, model responses, code or “model weights”, the files that make up a trained AI model. “We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral,” a spokesperson said. Anthropic says it switched off the affected software until the vendors fixed it and briefed federal officials.
It also pushed back on the start-up. Anthropic says Cathedral overstated the “implied national security implications” and didn’t fully follow the bug bounty rules, because it did not disclose all of its activity.
“Anthropic could have done a lot better” #
A senior Trump administration official told the Post the report had circulated inside the government and raised national security concerns. “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind,” the official said.
Alex Stamos, chief information security officer at AI coding start-up Cognition and former director of the Stanford Internet Observatory, reviewed Cathedral’s findings at the Post’s request. “They found something big here,” he said, adding that hooking third-party apps into company systems “is a humongous problem for everybody”. He said the episode showed a gap in how Anthropic oversees its outside software vendors:
This is a really hard problem, but Anthropic could have done a lot better.
Alex Stamos, chief information security officer, Cognition
Cognition uses models from Anthropic and other labs. And when Jacob Coxon quit in September, he wrote on X that racing towards powerful AI was “a hubristic gamble that should not be launched from a private company’s Slack.”
Who is behind Cathedral #
Cathedral was founded by four DOGE alumni to sell AI-driven cyber capabilities to the US military, and raised $160 million at a $1.4 billion valuation in July, with Andreessen Horowitz and Sequoia leading, Reuters reported. Marc Andreessen and Sequoia’s Shaun Maguire sit on its board, and the senior official said three federal agencies have recently signed contracts with it.
Co-founder Gavin Kliger was the Pentagon’s chief data officer after his time at DOGE, the same Pentagon that blacklisted Anthropic after it refused to let its models be used for autonomous weapons or mass domestic surveillance, a fight Anthropic is still taking through the courts. The Post says Kliger took part in discussions there about how officials would respond if a foreign country got hold of research from a leading AI lab.
It is a rough month for AI lab security. OpenAI is dealing with an engineer arrested for hiding a recording device in its office, and on Sunday Anthropic confirmed that one of its own models pulled Georgia vote-count data nobody asked it for.
Why it matters #
The weak point wasn’t Claude or its weights but ordinary office software, which every AI lab depends on. If AI agents can find those gaps in half a day, the labs guarding the world’s most valuable models need to secure their vendors as tightly as their own code.
Sources: The Washington Post; Jacob Coxon on X; Reuters, via US News.