AI agents breached Anthropic in under 12 hours — through its business software, not Claude

• Who: Cathedral, a cybersecurity startup founded by former members of the U.S. DOGE Service, testing Anthropic, the maker of the Claude chatbot.
• What: AI agents run by Cathedral’s researchers reached Anthropic’s internal systems in under 12 hours, via vulnerabilities in business software used for administrative and sales work.
• When: The Washington Post published its report on October 26, 2026; Cathedral disclosed its findings to Anthropic earlier in October.
• What was reached: paths to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic’s advanced models, according to Cathedral’s draft report.
• What was not reached: customer conversations with Claude, Anthropic’s code, and its model weights — Anthropic says none of these were accessed.
• The company: Cathedral is valued at $1.4 billion and has raised $160 million, according to PitchBook figures cited by the Post; three federal agencies have recently signed contracts with it.

It took less than 12 hours. That is how long AI agents run by Cathedral, a months-old cybersecurity startup founded by former members of the U.S. DOGE Service, needed to find their way into Anthropic's internal systems, according to a Washington Post report published October 26, 2026. The Post reviewed a draft of Cathedral's report on the test.

The way in was not Claude, and it was not Anthropic's models. Cathedral's researchers exploited vulnerabilities in business software that Anthropic and many other companies use for administrative and sales work. From there, the draft report says, they found paths to meeting transcripts, details of salaries and job offers, and Slack messages discussing Anthropic's advanced AI models. The vendors behind that software were informed, and their names were withheld for security reasons.

This was not a hostile attack. Cathedral probed Anthropic under the company's program that invites outside security researchers to test its systems, and disclosed its findings earlier in October. That framing matters — and so does the disagreement that followed about what the test actually proved.

What the two sides agree on — and where they split

Anthropic confirmed that Cathedral reached what it called “a limited set” of its sales, human resources and IT systems, including business contacts for some customers and partners and basic user account records. It said its monitoring flagged some of Cathedral's activity before the researchers reported it, and that it shut off their access the same day. It also said it has no evidence anyone else exploited the same vulnerabilities.

Where the two sides split is on scope and significance. Anthropic said Cathedral overstated the “implied national security implications” of its findings and had not fully followed the bounty program's rules, because it did not disclose all of its activity inside Anthropic's systems. Cathedral's draft report says its “data accesses were kept to the absolute minimum in accordance with security research best practices.” A Cathedral spokeswoman declined to comment to the Post.

Why Washington is reading it closely

The report has circulated inside the U.S. government, and the politics around it are unusually sharp. A senior Trump administration official, speaking anonymously to the Post, said: “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind.” The same official said he was taken aback by “how little time it took to get into the sensitive systems of a company that is controlling almost nuclear weapons grade material.”

Cathedral itself is part of that backdrop. The startup, which sells AI-powered security tools to government and corporate clients, is valued at $1.4 billion and has raised $160 million, according to PitchBook figures cited by the Post, with Marc Andreessen and Sequoia's Shaun Maguire on its board. Three federal agencies have recently signed contracts with it, an administration official told the Post. Co-founder Gavin Kliger was the Pentagon's chief data officer after his time at DOGE — the same Pentagon that banned Anthropic from federal systems earlier this year after it refused to allow its technology for autonomous weapons or mass domestic surveillance.

Strip out the politics and the technical finding is, uncomfortably, ordinary. Alex Stamos, now chief information security officer at Cognition, reviewed the findings for the Post and said: “They found something big here.” The risk of connecting third-party applications to company systems, he added, “is a humongous problem for everybody.”

What to watch next

Three things will settle how big this actually was. First, Cathedral's published report: the Post read a draft blog post, and the final version may name more, or less. Second, the vendors: which business software was involved, and whether other companies using it were exposed. Third, Anthropic's own public account — so far its statement has gone to the Post, not to its own blog.

Whatever those answers turn out to be, the shape of the lesson is already clear, and it is the same one this month keeps teaching: the weak point was not the frontier model. It was an ordinary business tool connected to the company that builds it, and the agents that found the gap did it in half a day.