Cathedral's AI Agents Reached Anthropic's Internal Systems in Under 12 Hours, With Scope Disputed

What happened

The disclosure rests on a draft Cathedral report reviewed by The Washington Post. According to the report, researchers found a way in through vulnerabilities in third-party business software that Anthropic and many other companies use for administrative and sales work; the vendors have been informed, and their names and products were withheld for security reasons; Cathedral disclosed the findings to Anthropic earlier this month.

Anthropic confirmed to The Washington Post that Cathedral reached a limited set of sales, human resources and IT systems holding business contact details for some customers and partners and basic user account records; customer conversations, Claude's responses, source code and model weights were not reached. The company said its monitoring flagged some of the activity before Cathedral reported it, cut off access the same day, and kept the software disabled pending vendor fixes, with no evidence that anyone besides Cathedral exploited the flaws.

The dispute centers on the scope reached and on compliance with the rules. Cathedral's draft said data access was kept to the minimum, in line with security research practice; Anthropic said Cathedral did not disclose all of its activity inside Anthropic's systems and overstated the national security implications of the findings. A senior U.S. administration official, speaking anonymously to The Washington Post, said that if a newly founded company could do this, others might not be far behind; Alex Stamos, chief information security officer at Cognition, told The Washington Post that Cathedral's finding carried weight, and that the risk from third-party applications connected to company systems is a problem for every company.

Key facts

Entry point: vulnerabilities in third-party administrative and sales business software; the vendors have been informed, and their names and products were withheld for security reasons.

Time: according to Cathedral's draft, the AI agents found a path into the internal systems in under 12 hours of runtime; the findings were disclosed to Anthropic earlier this month.

Cathedral's account: the paths led to meeting transcripts, salary and job-offer details, and Slack messages discussing Anthropic's advanced models.

Anthropic's account: the reach was limited to sales, human resources and IT systems holding business contact details for some customers and partners and basic user account records; customer conversations, Claude responses, source code and model weights were not reached.

Response: Anthropic said its monitoring flagged some activity before the report arrived, access was cut off the same day, and the software stayed disabled pending vendor fixes; the company said it had no evidence that anyone else exploited the flaws.

Cathedral background: the company was founded by former members of the U.S. Department of Government Efficiency; The Washington Post reported a $1.4 billion valuation, with PitchBook data showing a $160 million raise in July; co-founder Gavin Kliger was previously the Pentagon's chief data officer; according to a government official, the company recently signed contracts with three federal agencies.

Backdrop: The Washington Post noted that the Pentagon earlier this year excluded Anthropic from federal systems after it refused to allow its technology for autonomous weapons or mass domestic surveillance; this month Anthropic separately confirmed that Claude accessed Georgia voter data during training, covered by this site in the October 26 evening batch.