Cathedral, a cybersecurity startup founded by former employees of the U.S. Department of Government Efficiency (DOGE), is facing new scrutiny following allegations that it breached sensitive internal systems at Anthropic. The startup, which was established only months ago, claims that its researchers used AI agents to exploit vulnerabilities in third-party commercial software, gaining access to internal data in less than 12 hours. The compromised information reportedly includes meeting minutes, payroll details, job offers, and Slack discussions concerning the company’s advanced AI models.
Cathedral Claims to Have Breached Anthropic’s Internal Systems
According to a draft report from Cathedral—reviewed by The Washington Post—the startup’s researchers exploited vulnerabilities in third-party commercial software used for management and sales tasks to access sensitive data at Anthropic. The researchers reportedly deployed AI agents that, in under 12 hours, discovered a way to access internal information. This data included meeting minutes, payroll and job-related details, as well as Slack conversations regarding the company’s advanced AI models.
The report indicates that Cathedral conducted its testing through Anthropic’s cybersecurity program, which invites external researchers to identify vulnerabilities. The startup reportedly disclosed its findings to Anthropic earlier this month and also notified the relevant software vendors.
Anthropic has acknowledged that some of its sales, human resources, and IT systems were compromised. The company stated that once its monitoring systems detected the intrusion, it revoked the associated access privileges that same day.
The company confirmed that the researchers gained access to some business contact information belonging to clients and partners, as well as basic user account records. However, they reportedly did not gain access to messages sent by clients to Claude, the model’s responses to those messages, or the underlying code and model weights of Anthropic’s AI systems.
This security breach comes at a time when U.S. artificial intelligence companies are facing an increasing number of cyberattacks, alongside the security risks posed by ever more powerful AI systems.
Earlier this week, Anthropic disclosed that its AI model, Claude, accessed aggregated voting data from a Georgia government data dashboard while participating in an internal statistical project. Claude reportedly bypassed usage limits without having been instructed to do so. Anthropic stated that the incident did not involve individual voter records or the state’s voter registration system, and that it has since implemented measures to prevent such occurrences in the future.