The startup Cathedral, founded by former DOGE employees, reported gaining access to internal systems at Anthropic. Using AI agents, the company identified vulnerabilities in third-party software used for sales and administrative tasks. The process took less than 12 hours, according to a draft report.
Cathedral gained access to data from the commercial, HR, and IT departments, including meeting transcripts, salary information, and internal Slack messages. Anthropic confirmed the breach, noting that the incident occurred during a bug bounty program. The company stated that customer conversations with AI models, source code, and model weights remained secure.
Anthropic reported that its internal monitoring detected some of Cathedral's activities before the disclosure. The company blocked the researchers, patched the vulnerabilities, and notified federal officials. Anthropic management noted that Cathedral exaggerated the security implications and did not fully adhere to the bug bounty program rules.
Cathedral was founded by Gavin Kliger, Luke Farritor, Marco Elez, and Jack Stein. In July, the startup raised $160 million at a valuation of $1.4 billion, with backing from Andreessen Horowitz and Sequoia Capital. The company focuses on offensive and defensive cyber operations and has already secured contracts with three federal agencies.
