Cathedral, a months-old cybersecurity startup founded by former DOGE staffers, told Anthropic that its AI agents penetrated internal systems at the Claude maker in under 12 hours, according to a draft Cathedral report reviewed by The Washington Post on October 26, 2026. Anthropic confirms a narrower version: researchers reached a limited set of sales, HR and IT systems, but not customer prompts, Claude responses, source code or model weights. The 12-hour number and the severity both come from Cathedral, so this post separates what is claimed from what is confirmed.
This is one more entry in a year of stories about AI agents moving through real corporate systems. If you follow the thread, compare it with the earlier reports on Claude models used in 15 real-world system breaches and the 35-person firm that tested Meta, OpenAI and Anthropic. The difference here: the agents belonged to a security vendor, they were pointed at an AI lab on purpose, and the target's own account is available.
Quick reference: claimed vs verified #
| Question | What is claimed | What is confirmed or reported by others |
|---|---|---|
| How fast? | Under 12 hours, using AI agents (Cathedral draft report, via the Post) | Not independently verified; Anthropic has not endorsed the timing in anything we could read |
| What was reached? | Employee compensation and job-offer details, meeting transcripts, internal Slack discussions about advanced AI models (draft report) | Anthropic acknowledges a limited set of sales, HR and IT systems, including basic customer and partner contact records |
| What was not reached? | Cathedral says data access was limited to what research required | Anthropic says customer prompts, Claude responses, source code and model weights were inaccessible |
| How did they get in? | Weaknesses in third-party administrative software | Anthropic disabled the affected software until its vendors fixed the flaws; application names were withheld |
| Was it authorized? | Yes, under a program for outside researchers to report vulnerabilities | Anthropic says the researchers did not fully follow its testing rules |
| Anyone else exploited it? | Not addressed in the sources we read | Anthropic says it found no evidence of exploitation by anyone else |
| Government reaction | A senior Trump administration official said the report circulated in government and raised national security concerns, per the Post | Anthropic disputes the national-security characterization |
What exactly was reported? #
The Post's account, written by Elizabeth Dwoskin and Gerrit De Vynck, says Cathedral recently told Anthropic that its researchers had penetrated sensitive internal data and messaging systems. The source is a draft Cathedral report, which means the document may change and which we have not seen directly. The Post article is partly paywalled, so the details below come from the Post's opening and from follow-up coverage such as The Deep Dive, which summarizes it. Where those summaries are the only source, we say so.
According to that coverage, the agents found routes in by exploiting weaknesses in third-party administrative software. The software names were not disclosed for security reasons. The draft describes access to compensation and job-offer details, meeting transcripts and Slack channels where advanced models are discussed.
That last detail is the one that travels on social media. Internal chat about sensitive models sounds like crown-jewel material. But chat access is not model-weight access, and Anthropic's statement draws exactly that line.
What Anthropic says #
Anthropic acknowledged that the researchers accessed a limited collection of sales, human resources and IT systems, including basic customer and partner contact records. It said customer prompts, Claude responses, source code and model weights remained inaccessible.
On response, Anthropic said its monitoring detected some activity before the disclosure and that it terminated the researchers' access the same day. It disabled the affected software until the vendors fixed the vulnerabilities and said it found no evidence that anyone else exploited them. It also disputed Cathedral's framing of national-security implications and said the researchers had not fully followed its testing rules. Cathedral's report maintains that data access was restricted to what its research needed.
So there are two accounts that agree on the existence of access and disagree on significance and conduct. That is a normal shape for a coordinated-disclosure dispute, and neither side's characterization is verified by a third party.
Who is Cathedral, and why does the politics matter? #
Cathedral is described as a stealth military cybersecurity startup founded by four former DOGE staffers. Reuters reported in July that it raised $160 million at a $1.4 billion valuation, and The Deep Dive's account names co-founder Gavin Kliger as the Pentagon's chief data officer until April, per the Post. Reuters separately reported, citing people familiar, that Kliger was involved in the Defense Department's legal dispute with Anthropic.
That dispute is already covered on explainx.ai. It concerns Anthropic's refusal to remove restrictions on certain military uses of Claude, including fully autonomous lethal operations and mass domestic surveillance. See our reports on the district judge ruling the Pentagon blacklist illegal and the appeals court decision overturning it. The Deep Dive cites a September 25 ruling, 2-1, that the Pentagon could exclude Anthropic from its supply chain.
A senior administration official told the Post that three federal agencies had contracted with Cathedral and that the government was working with it on potential adversarial AI scenarios. None of this shows the test was unfair. It does explain why readers will ask whether a vendor with ties to a party in litigation against the target is a neutral tester. The reporting we read does not establish improper motive, and we do not claim one.
Why the "12 hours" number needs context #
"Under 12 hours" is a headline-friendly figure, and it is easy to over-read. Three caveats apply.
- Start of the clock. We do not know when the 12 hours began. Reconnaissance, target selection and any prior knowledge of the vendor stack all change what the number means.
- Human involvement. The reporting says AI agents did the work. How much a human steered them is not in the sources we could read. Compare the autonomy claims in theHugging Face and OpenAI attack timeline , where the record was far more detailed.
- Baseline. Without a comparison to a human red team on the same targets, 12 hours cannot be called fast or slow. Skilled human testers can also chain weak SaaS admin consoles in a day.
What the figure does support is a general point defenders already hear: agents can enumerate, test and pivot at machine speed, so the window between a weakness existing and being found is shrinking. Anthropic itself has been pushing the defensive side of that, for example through its free vulnerability scans for open-source maintainers. The Deep Dive also reports that Anthropic disclosed 6,157 vulnerabilities across 591 open-source projects by October 2 through its own AI-assisted research.
The entry point is the lesson: third-party admin software #
A shield with a hairline crack, illustrating how a single weak third-party admin tool can break an Anthropic breach defense
The most useful sentence in the story is the least dramatic. Agents reportedly got in through administrative software from third parties, not through Anthropic's model infrastructure. That matches how most real-world corporate compromises go: a SaaS admin console, an over-permissioned integration, a token with broad scope.
For a company holding sensitive model discussions in a chat workspace, the risk model is simple. Whatever your chat, HR and sales tools can read, the weakest connected admin tool can read too. A fast, tireless tester only needs one of them to be misconfigured.
What to do if you run a company with sensitive AI work #
This is a checklist adapted from the facts above, not advice drawn from Cathedral's report, which we have not seen.
- Inventory third-party admin tools. List every SaaS product with admin access to chat, HR, CRM or identity data, and who at the vendor can reach it.
- Cut scope. Remove integrations that can read all channels or all records. Prefer per-workspace, time-limited tokens.
- Make vendor apps switch-off-able. Anthropic disabled the affected software until fixes landed. Know in advance who can do that in your company and how fast.
- Detect agent-speed behavior. Rate and pattern anomalies (many enumerations, rapid permission probing) are the signal that distinguishes agent-driven testing from normal use.
- Write testing rules down. Anthropic says the researchers did not fully follow its rules. A vulnerability program needs scope, allowed techniques and data-handling limits in writing, and a way to stop a test mid-flight.
- Watch your own agents. If you deploy coding or ops agents, they are an attack surface too.AgentBeam , built by the explainx.ai team, stops AI agents before they take dangerous actions, which is relevant when agents hold credentials to the same admin tools.
For agent incidents that touch real third parties, we also keep a running list in /felony-bench, and the legal angle is explained in our Felony Bench CFAA piece.
What is still unknown #
- The names of the vulnerable third-party applications and the vendors' responses.
- The full draft report, its timeline and how much of the work was autonomous.
- Whether a final report will differ from the draft the Post reviewed.
- Which testing rules Anthropic says were not followed, and what Cathedral says in reply.
- Whether the "national security concerns" voiced by the anonymous official refer to this specific breach or to the general risk of AI-speed intrusion.
We will add an update section if Anthropic, Cathedral or the vendors publish more. If you can read the original Post article, it is the primary reporting; we did not see its full text.
What this means for builders and buyers #
If you use Claude, nothing in the confirmed facts says your prompts, completions or Anthropic-hosted data were exposed: Anthropic says those were out of reach, and it found no exploitation by others. That is the company's statement, and you should treat it as such until a third party says otherwise.
If you build on any AI vendor, the practical takeaway is to ask vendors the same questions you would ask any enterprise supplier: how do you run a vulnerability disclosure program, what happens when a researcher exceeds scope, how fast can you disable a compromised integration, and how do you segment sensitive internal discussions from general business tools?
The broader pattern is that AI labs are now both builders of agents that can find vulnerabilities and targets of agents that find them. How they handle disclosure, fast and in public, will shape trust more than any single breach.
Related reading #
Details reflect reporting available on October 26, 2026 and may change as Anthropic and Cathedral publish more.