Cybersecurity startup Cathedral says its AI agents found paths into Anthropic's internal business systems in less than 12 hours by exploiting weaknesses in third-party administrative and sales software, according to a Washington Post report published Monday.

Anthropic confirmed that the researchers reached a limited set of sales, HR, and IT systems, but said customer conversations, Claude responses, source code, and model weights were not reached. The company also accused Cathedral of overstating the national security implications and failing to disclose all of its testing, while Cathedral said it kept data access to the absolute minimum.

The way in was not Claude, Anthropic's AI assistant, but third-party administrative and sales software — the kind of programs companies use to track customers and manage staff. Many other companies rely on the same software, and security researchers have long flagged such widely used business tools as a common entry point, since a flaw in one vendor can expose every company that depends on it.

Cathedral was founded months ago by four former staffers of the Department of Government Efficiency, the Donald Trump administration's cost-cutting team better known as DOGE. In July, the startup raised $160 million at a $1.4 billion valuation.

The startup tested Anthropic through a program that works like a bug bounty, in which a company rewards outside experts for reporting flaws instead of exploiting them. Such programs are common across the technology industry. Cathedral's AI agents, which carry out multi-step tasks without a person approving each move, found routes to meeting transcripts, salary and job-offer details, and Slack messages about Anthropic's advanced models, according to a draft of its report.

"Our monitoring flagged some of Cathedral's activity before they reported it to us," Anthropic told the Washington Post. "We shut off their access the same day."

The company said the researchers reached "a limited set" of sales, HR, and IT systems holding business contact details and basic user account records.

Customer conversations with Claude, source code, and model weights — the billions of numbers that make up the trained AI — were not accessed, Anthropic said. It added that it has no evidence anyone other than Cathedral exploited the flaws.

Anthropic said Cathedral overstated the national security implications of the exercise and did not fully follow the program's rules because it did not disclose all of its activity. Cathedral's draft report states that "data accesses were kept to the absolute minimum in accordance with security research best practices." The findings have not been published in final form, and the disagreement over whether the testing stayed within the program's rules remains unresolved.

A senior Trump administration official, speaking anonymously, said the report has circulated in government and raised national security concerns. "If a bunch of kids who have just started a company can do this," the official said, "then potentially, the Chinese aren't far behind."

Background

In November 2025, Anthropic said Chinese state-sponsored hackers used Claude Code, its coding tool, to attack roughly 30 organizations, with AI handling 80% to 90% of the tactical work. In July, Anthropic disclosed that Claude models had hacked real organizations in three incidents during its tests. Anthropic disabled the affected software until the vendors confirmed fixes, and the vendors have not been named.