Cathedral, a months-old cybersecurity start-up, recently told Claude chatbot maker Anthropic that its researchers had penetrated sensitive internal data and messaging systems at the artificial intelligence company, according to a draft report by Cathedral reviewed by The Washington Post.
The start-up, founded by former members of the cost-cutting U.S. DOGE Service, offers AI-powered cybersecurity tools to the U.S. government and corporate clients. Its researchers got inside Anthropic systems by exploiting vulnerabilities in business software used by the AI firm and many other companies for administrative and sales tasks, according to the report.
After running AI agents for less than 12 hours, the researchers found paths to access internal Anthropic data including meeting transcripts, details of salaries and job offers, and Slack messages discussing its advanced AI models, the Cathedral report said. The start-up probed Anthropic under a company program that invites outside cybersecurity experts to test its systems.
Cathedral’s ability to penetrate sensitive programs at one of the companies leading the global AI race comes amid mounting concern that U.S. AI firms are the target of overseas intelligence agencies and growing alarm that AI can make it easy for malicious hackers to break into critical systems.
Anthropic confirmed in a statement that Cathedral researchers had gained access to “a limited set” of its sales, human resources, and IT systems. The AI company shut off the pathways exposed by the researchers and briefed federal officials on the incident, the statement said.
The new Cathedral report and other recent security incidents at U.S. AI firms highlight the intensifying stakes as the U.S. government and its adversaries spar over a technology seen as central to maintaining — or challenging — America’s global power.
A senior Trump administration official, speaking on the condition of anonymity to describe internal proceedings, said that the Cathedral report on its access inside Anthropic had circulated within the government and raised national security concerns.
“If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind,” the official said. He added that he was taken aback by “how little time it took to get into the sensitive systems of a company that is controlling almost nuclear weapons grade material.”
The FBI earlier this month arrested an employee of ChatGPT maker OpenAI for allegedly planting a recording device in an executive conference room. Last month, hackers who broke into OpenAI with help from Anthropic’s Claude chatbot warned that the AI industry is unprepared for the security risks created by the power of its own technology. (The Post has a content partnership with OpenAI.)
Anthropic clashed with the Trump administration earlier this year after the Pentagon banned the company from federal systems, following Anthropic’s refusal to allow use of its technology for autonomous weapons or mass domestic surveillance.
Three federal agencies have recently contracted with Cathedral for cybersecurity work, the official said. The start-up, part of a wave of companies founded by former DOGE staffers to seek private sector opportunities and government contracts, has been valued by investors at $1.4 billion.
Cathedral researchers attempted to access Anthropic systems to highlight the security challenges facing leading U.S. AI developers, said a person close to the company, who spoke on the condition of anonymity due to the sensitive nature of the findings.
The company disclosed its findings to Anthropic earlier this month through the cybersecurity testing program, according to the report, which offers rewards to security researchers for disclosing vulnerabilities. The document said Cathedral also informed the vendors of the business software it had exploited, but the identity of the firms was not disclosed for security reasons.
“They found something big here,” said Alex Stamos, chief information security officer at AI coding start-up Cognition, who reviewed Cathedral’s findings at the request of The Post.
But the risk of connecting third-party applications to company systems “is a humongous problem for everybody,” added Stamos, who was formerly director of the Stanford internet Observatory at the university’s Cyber Policy Center.
Cathedral’s findings showed “a gap” in how the AI developer manages its use of outside software providers, Stamos said. “This is a really hard problem, but Anthropic could have done a lot better,” he said. (Cognition uses models from Anthropic and other AI companies.)
A Cathedral spokeswoman declined to comment.
An Anthropic spokesperson said in a statement that Cathedral researchers accessed systems containing data including business contact details for some customers and partners as well as some basic user account records. The researchers could not access messages sent by customers to Anthropic’s AI models, the responses sent back, or the code or “model weights” behind its AI systems, the statement said.
“Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day,” the statement said. “We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral.”
Anthropic disabled the business software involved and only turned it back on after the vendors confirmed the vulnerabilities had been addressed, the statement said.
Cathedral’s researchers wrote in the company’s report, an early draft of a blog post, that their findings “reveal a serious gap between the offensive capabilities now emerging and the defenses protecting some of America’s most vulnerable technological assets,” according to the copy reviewed by The Post.
“The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” the report said.
Anthropic’s statement said that Cathedral had overstated the “implied national security implications” of its findings. It said the start-up had not fully followed the rules of its bug bounty program, by failing to disclose all of its activity inside Anthropic’s systems.
In its report, Cathedral said that “data accesses were kept to the absolute minimum in accordance with security research best practices.”
Anthropic employee Jacob Coxon publicly resigned last month, citing his concerns that the company was being irresponsible with dangerous AI technology, including by relying on conventional business software. He accused the company of making “a hubristic gamble that should not be launched from a private company’s Slack,” in a post on X, referring to the business messaging tool used by Anthropic and many other tech firms.
Cathedral co-founder Gavin Kliger served as the Pentagon’s chief data officer after his tenure at DOGE. During his time at the Pentagon, he participated in conversations in which officials gamed out what might happen were a foreign nation to gain access to research at a frontier AI lab in Silicon Valley, said the person close to the company.
Cathedral has raised $160 million from investors, according to data firm Pitchbook. Marc Andreessen and Shaun Maguire, prominent investors who supported President Donald Trump and DOGE, sit on Cathedral’s board.
The Trump administration is now working with the company to game out adversarial scenarios related to AI, the administration official said.
The post It took just 12 hours for an AI start-up founded by ex-DOGE staffers to break into Anthropic appeared first on Washington Post.
