AI agents reached Anthropic's business systems in under 12 hours

A months-old startup told Anthropic that its AI agents had read meeting transcripts and job-offer details. They also read Slack messages about Anthropic's advanced models. The startup said it took them under 12 hours to find the paths in. The two companies now disagree on how to describe what happened.

The Washington Post reported on 26 October that Cathedral had tested Anthropic. Cathedral was founded this year by four former staffers of the US Department of Government Efficiency. The test ran under Anthropic's bug-bounty program. The Post reviewed a draft report from Cathedral and quoted its central numbers. Cathedral did not reach Claude, source code or model weights. It reached the business software that Anthropic uses around Claude.

What Anthropic confirmed, and what it disputes

Anthropic told the Post that researchers reached "a limited set" of its sales, HR and IT systems. The access included business contact details for some customers and partners, and basic user account records. The company said its monitoring flagged part of Cathedral's activity before the startup reported it. It shut off access the same day. Anthropic also said Cathedral had not fully followed the rules of the bug-bounty program. The startup failed to disclose all of its activity inside Anthropic's systems. Anthropic said Cathedral overstated the national-security angle of the test.

Cathedral's version in the draft report is wider. Its researchers located paths into meeting transcripts, salary details and job offers. They also read Slack discussions about Anthropic's advanced models. They did it by exploiting weaknesses in third-party administrative and sales software. The specific vendors are not named in the public coverage.

The investor and founder picture

Cathedral was founded in 2026 by Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. Each of them served at the Department of Government Efficiency. The company raised 160 million dollars at a 1.4 billion dollar valuation in July. Andreessen Horowitz and Sequoia Capital are the named investors in the Post's account.

The dispute is about one word: how limited is "limited". Anthropic's statement names the systems reached and the records they held. Cathedral's draft names the content it read inside those systems. Both can be true at once. The difference is whether a reader counts a transcript or a Slack message as something more than a record.

For a team building an AI product today, the mechanism matters more than the dispute. The agents never had to break Claude. They worked around it, through the vendors that store calendars, applicant data and chat logs. Those are the same tools a startup picks on its first day. The response window was measured in hours. That rules out a Monday-morning review.

Source

How an AI start-up founded by ex-DOGE staffers broke into Anthropic, The Washington Post. Verified against Decrypt's coverage, which quotes Anthropic's statement directly.