Ex-DOGE hackers got into Anthropic through its office software in under 12 hours

By Anthropic's account, Cathedral's researchers spent several days trying to break into Anthropic's own software and got nowhere. So they stopped attacking the AI company and went after the ordinary business apps it rents from other vendors. Less than 12 hours later, the startup says, its AI agents were reading meeting transcripts, salary figures, job offers and Slack threads about Anthropic's most advanced models.

The Washington Post broke the story on Monday, working from a draft of Cathedral's report. Monday was also the day Anthropic filed to go public.

Who Cathedral is

Cathedral is a few months old and sells AI-driven cyber capability with a military focus. Its four founders, Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all worked for Elon Musk's DOGE.

Their histories are part of the story. Kliger went on to become the Pentagon's chief data officer, and Tech Times reports he was involved in the Defense Department's dispute with Anthropic over limits on how its models could be used. Elez resigned from DOGE in early 2025 after racist social media posts surfaced, then was rehired after Musk and JD Vance backed him. Farritor is best known for winning a prize in the 2023 Vesuvius Challenge for using machine learning to read text inside carbonized Herculaneum scrolls.

Reuters reported in July that Cathedral had raised $160 million at a $1.4 billion valuation, with Andreessen Horowitz and Sequoia backing it. Marc Andreessen and Shaun Maguire sit on its board. Tech Times says it already holds contracts with three federal agencies.

So a well-funded military cyber startup, with a founder who sat on the other side of a government fight with Anthropic, tested Anthropic's defenses, and the results landed in the Post on IPO day. You can read that as a public service or as positioning. The facts support some of both.

What they got, and what Anthropic says they got

The way in was third-party enterprise software that Anthropic, like most companies, uses for sales and administration. The vendors haven't been named, reportedly while patches are prepared.

Cathedral's draft says its agents reached internal meeting transcripts, employee salaries and job offers, and Slack discussions. Anthropic confirmed access to a "limited set" of its sales, HR and IT systems, including business contact details for some customers and partners and some basic user account records. It says the researchers never touched Claude users' conversations, its source code or its model weights.

Anthropic also says it saw them coming. Its monitoring flagged some of Cathedral's activity before the startup reported anything, the company told the Post, and it "shut off their access the same day." It disabled the affected software, briefed federal officials and brought the tools back only after the vendors confirmed fixes. It says it found no sign that anyone outside Cathedral used the same holes.

The test ran under Anthropic's bug bounty program, which pays outsiders to find flaws. Anthropic accuses Cathedral of breaking that program's rules by not disclosing the full extent of what it did, and says the startup overstated the national security angle. A Cathedral spokeswoman declined to comment on the dispute. Its draft report says it kept data access to a minimum and presents the whole exercise as a warning that weaknesses in "ordinary enterprise software" can take down even the most advanced organizations.

The national security framing came loudest from an unnamed senior Trump administration official who reviewed the draft. Speaking to the Post, the official compared what a foreign adversary could reach this way to "almost nuclear weapons grade material." Anthropic's position is that HR and sales tools are administrative systems and the comparison doesn't fit. Alex Stamos, who reviewed the findings for the Post, said the work exposed weaknesses in how Anthropic manages its third-party integrations.

The boring door

Strip out the politics and this is the oldest pattern in corporate security. You spend millions guarding the crown jewels, and the attacker walks in through the payroll system. Anthropic is right that salaries are not model weights. But a frontier lab's salary bands and offer letters are a map of who matters and what it costs to hire them away, which is useful to any rival or intelligence service. Slack threads about unreleased models sit closer to the jewels than "limited set" suggests.

Then there's the speed. Cathedral says the pivot from Anthropic's own code to its vendors' produced results in under 12 hours, with AI agents doing the legwork. That is the scenario Anthropic has spent the past year warning about in its own research: attack work that used to need a skilled team for weeks, done by software overnight. Reuters reported that the IPO filing Anthropic published the same day discloses a training pause of more than a month over security concerns.

Anthropic hasn't filed a legal complaint against Cathedral. And the vendors still haven't been named, which means every other company running the same software is learning about this the same way you are.

Sources: The Washington Post, Gizmodo, Tech Times, Tech Startups.