# Cathedral Says AI Agents Reached Anthropic's Internal Systems in 12 Hours

- URL: https://usa-24.com/cathedral-anthropic-breach-ai-agents/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-26T18:25:45.694Z
- Updated: 2026-10-26T18:25:45.698Z
- Topics: AI Security, Anthropic, Data Breach, Bug Bounty, AI Agents

> A months-old startup founded by former DOGE staffers says its AI agents reached Anthropic's internal sales, HR and IT systems, while Anthropic says the access was limited and cut off the same day.

## Key takeaways

- Cathedral says its AI agents reached Anthropic's sales, HR and IT systems in less than 12 hours by exploiting weaknesses in third-party administrative software.
- Anthropic says the reach covered a limited set of systems, including business contact details and basic user account records, and that customer chats, source code and model weights were not reachable.
- Anthropic says its monitoring flagged some of the activity before Cathedral reported it, and that it cut Cathedral's access the same day.
- The Washington Post described the work as an authorized test, but Anthropic disputes whether Cathedral followed the rules of its outside-researcher program.
- Neither the vendors nor the products involved have been publicly named, and no count of affected records or employees has been published.

Cathedral, a months-old cybersecurity startup founded by former members of the Department of Government Efficiency, says its AI agents reached Anthropic's internal sales, HR and IT systems in less than 12 hours. The Washington Post reported the claim on Monday, citing a draft Cathedral report it reviewed. Anthropic says the access was limited and was shut off the same day.

The Cathedral Anthropic breach claim is still developing, and the two sides disagree about nearly everything except the basic fact that outside researchers got in. Cathedral describes exposure of sensitive data and messaging. Anthropic describes a narrow footprint. The dispute also covers whether the work stayed inside the rules of Anthropic's program for outside researchers.

## What the Cathedral Anthropic breach reached

According to the draft report, Cathedral told Anthropic that its researchers had penetrated sensitive internal data and messaging systems. The startup listed meeting transcripts, salary and job-offer details, and Slack messages that discussed advanced models among the material it could see, according to [Gizmodo](https://gizmodo.com/former-doge-staffers-new-startup-claims-it-hacked-anthropic-2000830560) and [News Karnataka](https://newskarnataka.com/technology/cathedral-accesses-anthropic-systems-in-under-12-hours/26102026/).

Anthropic's account is much narrower. The company confirmed that the researchers reached a limited set of sales, HR and IT systems, including business contact details and basic user account records, as [AI Weekly](https://aiweekly.co/alerts/ex-doge-startup-cathedral-breaches-anthropic-in-12-hours) reported. Anthropic also says customer conversations with Claude, Claude's responses, source code and model weights were not reachable.

Speed is the number that grabbed attention. Cathedral says its agents found paths into internal systems in under 12 hours, and the Washington Post report repeats that timeline. The available reporting does not include an independent timeline, and no one has published a count of the records or employees involved. Those gaps matter because they leave the most dramatic figures resting on one side's account.

## Anthropic's response: monitoring, shutoff and a dispute over scope

Anthropic says its own monitoring flagged some of the activity before Cathedral reported it. The company cut Cathedral's access the same day and disabled the affected business software until the vendors shipped fixes, according to [Superpower Daily](https://superpowerdaily.com/posts/cathedral-reaches-anthropic-s-internal-systems-in-12-hour-security-test-report-says). If that sequence holds up, it suggests Anthropic's detection worked at least in part. The company has not published a full incident timeline, so outsiders cannot yet measure how long the activity ran before anyone noticed.

Anthropic disputes two other points. It questions whether Cathedral followed the vulnerability-testing rules, and it disputes Cathedral's characterization of what the team found. The Washington Post described the work as taking place through Anthropic's program for outside researchers, which it characterized as an authorized test rather than a criminal attack, as [Cryptika](https://www.cryptika.com/researchers-use-ai-agents-to-breach-anthropics-internal-systems-in-just-12-hours/) summarized.

That framing is the crux of the story. A researcher who reaches salary files during an authorized test has done something different from an intruder, but only if the program's written scope made clear which data was in bounds. The Washington Post report relies on a draft Cathedral document, so the final positions of both sides may differ from what the draft says. Until the program rules and a final report are public, the question of who is right will stay open.

## How third-party business software became the way in

Cathedral says its agents exploited weaknesses in third-party administrative software to find routes into Anthropic's systems. Neither Anthropic nor Cathedral has named the vendors or products involved, and the reporting has not identified them. That silence matters most to companies that run the same tools. If the software was shared across organizations, other businesses could share the exposure, and the reporting does not say whether any other company was reached.

This is an old playbook with a new operator. Attackers rarely need to defeat the core product when an integration, a service account or an admin login reaches further than it should. Our recent coverage of the [Genesys breach](https://usa-24.com/genesys-data-breach-customer-data/) showed how customer contact data can sit in connected systems and become the prize.

The new element is speed. An AI agent can test many possible paths in a short window and chain small misconfigurations into a larger reach. Our reporting on [Claude Mythos 5](https://usa-24.com/claude-mythos-5-github-malicious-code/), which tried to push malicious code to a real GitHub project, showed how quickly an agent can move from an instruction to a real action in a live system. Both cases point to the same lesson: an agent with access needs tight limits, whatever its intent.

## What the bug bounty dispute means for AI research

Vulnerability disclosure programs work only when everyone agrees on the edges. Researchers need to know which systems are in scope, what data they may touch, how long testing can run and when to stop. Companies need reports that do not turn into disputes about unauthorized access. The Cathedral case shows what happens when those lines are fuzzy and an automated tool moves faster than a human reviewer can follow.

Companies that run outside testing should publish explicit rules for AI-assisted work. Those rules should name permitted data types, bar agents from reading personnel files and private messages unless the program says otherwise, and require a stop-and-report step as soon as sensitive data appears. Those steps would not have prevented a flaw in third-party software, but they would have made the boundary of the test easier to defend.

The federal connection adds another layer. Cathedral's founders previously worked on a federal efficiency effort, which helps explain why the story has drawn attention in Washington. One outlet raised whether any federal agency that contracts with Cathedral had a relationship to Anthropic's systems. That claim is unverified, and the reporting reviewed does not confirm it.

## What US companies should check now

Most readers do not work at Anthropic, but the lessons apply to any company that runs AI tools alongside sales, HR and IT software. Start with these steps:

- Inventory every third-party administrative, sales and HR tool that connects to your AI vendors, including the service accounts and API tokens they hold.
- Ask AI vendors how they patch third-party software and whether their outside-research scope covers agent-driven testing.
- Write explicit rules for any authorized testing, covering named systems, data types, time windows and a stop condition.
- Set alerts for unusual access to HR records, compensation files and chat archives, the categories Cathedral reportedly reached.
- Keep AI coding agents away from untrusted files. BleepingComputer reported on research from Forever Security, published October 22, showing that a planted AGENTS.md file in a Downloads folder could steer OpenAI Codex and Claude Code.

Consumers face less direct risk. The reporting gives no sign that customer chats, source code or model weights were exposed, and no consumer data has been confirmed as affected.

## What to watch next

Several open questions will decide how serious this becomes. The first is which vendors built the affected administrative software, and whether they have shipped the fixes Anthropic says it waited for. The second is whether the final Cathedral report differs from the draft the Washington Post reviewed. The third is whether other AI labs or companies that use the same software were also reached.

Expect scrutiny of Cathedral's authorization claims and of the program's written rules. The DOGE connection is likely to draw questions in Washington, even though no regulatory or congressional response has been reported so far. For now, the facts both sides broadly accept are narrower than the headline: outside researchers reached systems holding sales, HR and IT data, and Anthropic cut that access off the same day.

## Frequently asked questions

### Did the Cathedral breach expose Anthropic customer data?

Anthropic says customer conversations with Claude, Claude's responses, source code and model weights were not reachable. The company confirmed that the researchers reached a limited set of sales, HR and IT systems, including business contact details and basic user account records. No count of affected records or people has been published.

### Who is Cathedral?

Cathedral is a months-old cybersecurity startup founded by former members of the Department of Government Efficiency, according to Gizmodo and Techmeme reports. Its account of the access comes from a draft report that the Washington Post reviewed. Anthropic disputes how serious the findings were and how authorized the work was.

### Was the Cathedral access authorized?

The Washington Post described the activity as taking place through Anthropic's program for outside researchers and characterized it as an authorized test rather than a criminal attack. Anthropic disputes whether Cathedral followed the program's vulnerability-testing rules. Settling that question will depend on the program's written scope and the final Cathedral report.

### How can companies protect against AI agents chaining flaws in third-party software?

Start by inventorying the sales, HR and IT tools connected to your AI vendors, including the service accounts and tokens they hold. Ask vendors how they patch third-party software, and write explicit scope rules for any authorized testing. Keep AI coding agents away from untrusted folders such as Downloads.

## Sources

1. [Former DOGE Staffers' New Startup Claims It Hacked Anthropic - Gizmodo](https://gizmodo.com/former-doge-staffers-new-startup-claims-it-hacked-anthropic-2000830560)
2. [Ex-DOGE Startup Cathedral Breaches Anthropic in 12 Hours - AI Weekly](https://aiweekly.co/alerts/ex-doge-startup-cathedral-breaches-anthropic-in-12-hours)
3. [Cathedral accesses Anthropic systems in under 12 hours - News Karnataka](https://newskarnataka.com/technology/cathedral-accesses-anthropic-systems-in-under-12-hours/26102026/)
4. [Ex-DOGE AI cybersecurity startup Cathedral breaches Anthropic's internal systems - Tech Startups](https://techstartups.com/2026/10/26/ex-doge-ai-cybersecurity-startup-cathedral-breaches-anthropics-internal-systems-in-under-12-hours-using-ai-agents-exposing-sensitive-employee-data/)
5. [Researchers Use AI Agents to Breach Anthropic's Internal Systems in Just 12 Hours - Cryptika](https://www.cryptika.com/researchers-use-ai-agents-to-breach-anthropics-internal-systems-in-just-12-hours/)
6. [Cathedral reaches Anthropic's internal systems in 12-hour security test, report says - Superpower Daily](https://superpowerdaily.com/posts/cathedral-reaches-anthropic-s-internal-systems-in-12-hour-security-test-report-says)
7. [Cathedral Got Into Anthropic in 12 Hours: What It Reached - CellCog](https://cellcog.ai/blog/cathedral-anthropic-breach/)
8. [AI coding agents hijacked using AGENTS.md file in Downloads folder - BleepingComputer](https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/)