I watched the draft report land on my screen and felt the floor tilt under a familiar tech rhythm: a notification that shouldn’t have existed. You read that line and the first question arrives — how fast did this happen, and what did it expose? The agents moved like locksmiths with master keys, Cathedral says, finding paths in under 12 hours.
I’ve followed government tech spinoffs and private security claims long enough to know you don’t ignore a story that smells of access and ego. Here’s what I dug up, what you should know right now, and which alarms in Washington are already ringing.
An Anthropic admin saw unusual access in the logs. How Cathedral says AI agents breached internal systems
Cathedral, a startup formed by alumni of the Department of Government Efficiency (DOGE), released a draft report — reviewed by the Washington Post — claiming its AI agents exploited vulnerabilities in third-party business tools to reach Anthropic’s internal systems.
The headline: the agents allegedly found paths to meeting transcripts, salary and offer records, and Slack messages in less than 12 hours. Anthropic confirmed a “limited set” of sales, HR and IT systems were accessed — customer and partner contact lists and some basic user account records — and said Claude conversations, model weights and source code were not touched. Anthropic also noted researchers had tried and failed for days to breach Anthropic software directly before Cathedral’s approach.
Did Cathedral actually hack Anthropic?
Short answer: the company claims yes; Anthropic says the access was limited and that rules of its vulnerability program were violated. Cathedral says its AI agents found lateral paths through third-party enterprise software — a method that exchanges the brute force of direct system attacks for the subtlety of supply-chain hopscotch. Anthropic says the testers didn’t fully disclose the scope of their activity to its bug-bounty program.
The startup’s investor pitches and board bios read like a capital parade. Who’s behind Cathedral and what do they bring to the table?
Founders include Gavin Kliger (former Pentagon chief data officer), Luke Farritor, Marko Elez and Jack Stein — DOGE alumni whose ties to defense and procurement gave them instant credibility. Cathedral has been valued at $1.4 billion (about €1.3 billion) and raised $160 million (about €150 million) from backers such as Andreessen Horowitz and Sequoia Capital; Marc Andreessen and Shaun Maguire are associated with the board.
There’s political gravity here: Kliger was linked to a highly visible Pentagon rift with Anthropic. Elez resigned from DOGE after inflammatory, racist tweets surfaced; he was later rehired by Elon Musk. Those personnel notes explain why a security claim from Cathedral lands with both industry interest and political heat.
What did the researchers access?
Anthropic’s public response narrows the list: sales, HR and IT records, some partner and customer contact information, and basic user account entries. Cathedral’s report paints a broader picture of rapid discovery through third-party tools. Neither party says Claude conversations, model weights or Anthropic source code were taken — but the uncertainty about lateral pathways through business software is the real story.
An official in Washington read the report and felt unsettled. Why national security officials are watching this closely
Sources say a senior Trump administration official raised alarms: ordinary enterprise software weaknesses can be weaponized by state-backed actors. That’s the tangible fear — not just theft of contact lists, but the possibility of lateral moves that expose trade secrets or model development paths.
Recent campaigns underscore the risk. Reported incidents include a Chinese-speaking attacker using AI agents built with DeepSeek and Anthropic’s Claude Code to breach over 100 business sites, and separate ethical-testing at OpenAI that exposed employee ChatGPT accounts. The FBI’s probe into alleged espionage at OpenAI — involving a former engineer and possible foreign contacts — shows how quickly personnel and access mix into national-security problems. Platforms named across these events: Claude, Claude Code, DeepSeek, and ChatGPT.
Could this lead to AI lab espionage?
Yes. The mechanics are simple: find a third-party weakness, hop sideways, and suddenly you’re inside systems you could never reach directly. If state actors replicate these methods, they could accelerate model replication or steal competitive research. The worry isn’t just theft; it’s strategic parity — or worse, a lab’s intellectual work fed into an adversary’s stack.
People in engineering teams noticed odd patterns. What this means for enterprise software and internal security practices
If you run a security team, this should change your playbook: monitor third-party integrations, map trust boundaries, and assume that attacker tooling will include AI agents that can automate reconnaissance and exploit chaining faster than a human team.
Cathedral framed its work as a proof that standard enterprise apps can be exploited to reach sensitive infrastructure. Anthropic framed the same incident as a controlled test gone beyond agreed limits. You’re left in the middle, wondering whether the message is about AI-driven testing, software hygiene, or the ethics of proof-of-concept disclosure.
I’ve described what I found, cited the players — Anthropic, Cathedral, Andreessen Horowitz, Sequoia, Claude, Claude Code, DeepSeek, OpenAI — and sketched why officials are anxious. The image is small now but growing: a pebble that could trigger an avalanche. Who will be held accountable if the next breach hands trade secrets to a rival state?