- AI startup Cathedral used autonomous agents to breach Anthropic systems through weaknesses in third-party software
- Agents accessed HR, sales, and IT data, exposing limited customer and partner information
- Incident highlights how AI-powered attackers can rapidly exploit vendor weaknesses despite strong internal defenses
An AI startup seemingly gave Anthropic a taste of its own medicine when it used AI agents to break into the company and expose sensitive data.
The company in question is called Cathedral, which was founded by former members of the defunct US Department of Government Efficiency (DOGE), a US government initiative established to reduce federal spending and bureaucracy, while modernizing government technology and operations.
Anthropic is running a two-fold bug bounty program through HackerOne. One part is focused on finding technical flaws in Anthropic’s systems, while the other is an invite-only program that rewards researchers for finding universal jailbreaks that bypass Claude’s safety protections.
Cathedral apparently shared its results with Anthropic through the bug bounty program. After its human researchers unsuccessfully tried breaking in for a few days, they deployed AI agents which took less than 12 hours to find a way in, by exploiting flaws in third-party business software.
Violating the rules
After accessing the company’s network, the agents accessed meeting transcripts, information on salaries and job offers, as well as Slack messages. Employee conversations with Claude were not exposed, it seems.
Anthropic confirmed the news, saying Cathedral accessed a “limited set” of sales, human resources, and IT systems, and compromised contact information and basic user account records belonging to certain customers and partners. Source code and AI model weights were not accessed.
“Our monitoring flagged some of Cathedral’s activity before they reported it to us,” Anthropic said in a statement shared with The Washington Post. “We shut off their access the same day.”
According to Gizmodo, Anthropic accused Cathedral of violating the program’s rules by failing to disclose the full extent of its activity. We don’t know if that means Anthropic won’t release the payment for the bounty, but it sure sounds like it.
Paying the bounty could be the least of Anthropic’s concerns, though. The company is currently gearing up for its Initial Public Offering (IPO), with a valuation of $1.4 billion. Leaking sensitive data to anyone, including white hat hackers, is definitely not a good signal.
A 'bunch of kids' wreaking havoc
“The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” the Washington Post cited Cathedral’s report as saying.
At the same time, a senior Trump administration official allegedly told Via The Independentthat “if a bunch of kids who have just started a company can do this, then potentially the Chinese aren’t far behind.”
Cathedral can hardly be described as “a bunch of kids” - it is an AI startup focused on offensive and defensive cyber operations for the US military and government. Its founders include Gavin Kliger (former Pentagon chief data officer), Luke Farritor (best known for helping decipher ancient Roman scrolls using machine learning), Marko Elez (former SpaceX staffer), and Jack Stein (apparently worked as an investment banking associate at Salem Partners before joining DOGE).
The cybersecurity community had something to say about it. Jacob Krell, Senior Director for Secure AI Solutions & Cybersecurity at Suzu Labs, wasn’t particularly phased, saying if third-party vendors are a risk everywhere, then they’re a risk at Anthropic.
"Cathedral's agents got into Anthropic the same way attackers get into everyone else, through the vendors,” Krell said. “Security maturity is capped by the weakest vendor you integrate with, and no amount of in-house engineering changes that."
Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, praised Anthropic’s response: "Anthropic deserves credit for reporting that its monitoring detected some of the activity and for taking containment measures. But the real measure of remediation is independent verification that those attack paths are closed. We need to stop confusing a successful patch with a verified security outcome. Otherwise, we're just closing the front door and hoping nobody discovered the spare key."
➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.