Ex-DOGE Staffers’ AI Startup Claims to Have Accessed Anthropic’s Internal Systems in Under 12 Hours

A burgeoning cybersecurity startup, Cathedral, has ignited a firestorm in the artificial intelligence community after claiming its autonomous AI agents successfully breached the internal systems of Anthropic—the prominent developer behind the Claude AI model—in a span of less than 12 hours. The revelation, initially detailed in a draft report obtained by The Washington Post, highlights an escalating arms race between AI-driven security tools and the enterprise software stacks that underpin modern tech giants. While the incident was reportedly conducted under the auspices of a vulnerability disclosure program, the depth of access gained by these agents has prompted significant questions regarding the security of third-party business applications.

The Anatomy of the Breach

According to the findings, the infiltration was not achieved by attacking the large language models (LLMs) themselves, but rather by targeting the "soft underbelly" of corporate operations: third-party SaaS (Software as a Service) platforms. Cathedral’s agents, which are designed to mimic human-like reconnaissance and exploitation patterns, identified vulnerabilities within these administrative and sales-oriented tools.

Once the initial perimeter was breached, the AI agents demonstrated a high level of operational agility. The report indicates that within half a day, the agents had successfully navigated through internal permission layers to access highly sensitive corporate data. This included, but was not limited to, internal meeting transcripts, proprietary salary data, job-offer details, and private Slack communications specifically discussing the technical development of Anthropic’s most advanced models. The speed at which these agents moved suggests that modern AI security tools are becoming increasingly capable of navigating complex enterprise environments with a level of efficiency that human penetration testers might struggle to replicate.

Contextualizing the Vulnerability Disclosure Program

It is essential to clarify the nature of this "breach." Industry reports from outlets such as Security Boulevard suggest that Cathedral’s actions were not a malicious hack but a legitimate attempt to identify security gaps under a Bug Bounty or vulnerability disclosure program. Many major technology firms maintain these programs, inviting white-hat hackers and security researchers to test their systems in exchange for compensation and the opportunity to patch vulnerabilities before they are exploited by bad actors.

However, the "alarming" nature of the report, as described in the draft, stems from the efficacy of the AI agents rather than the intent of the testers. The incident underscores a shift in cybersecurity: the transition from human-led manual testing to automated, agent-based discovery. If AI agents can autonomously map a company’s attack surface and exploit third-party dependencies in under 12 hours, the traditional model of annual security audits and manual penetration testing may soon become obsolete, if not entirely insufficient.

A Chronology of the Incident

While exact timestamps remain redacted or omitted from the public-facing draft, the timeline provided indicates a rapid progression:

• Phase 1: Reconnaissance. The AI agents initiated scans against Anthropic’s external-facing administrative tools, identifying misconfigurations or known vulnerabilities in third-party software.
• Phase 2: Initial Access. Exploitation of the identified software flaw allowed the agents to gain an initial foothold within the corporate network.
• Phase 3: Lateral Movement. Using the credentials or access tokens obtained during the initial phase, the agents moved laterally through internal communication channels, including Slack and internal document repositories.
• Phase 4: Exfiltration/Access Confirmation. The agents reached sensitive documentation, including payroll and research transcripts, effectively demonstrating full-system reach within the 12-hour window.

The "DOGE" Connection and Industry Background

The startup, Cathedral, is notable for its founders, who are reportedly former staffers associated with the Department of Government Efficiency (DOGE) initiative. The transition of personnel from government-adjacent efficiency projects to private-sector cybersecurity AI is a trend that reflects the increasing intersection of public policy, national security, and artificial intelligence. The expertise gained in optimizing large-scale bureaucratic systems appears to have been repurposed into creating high-efficiency automated security agents.

This connection has added a layer of intrigue to the story, as critics and supporters alike evaluate the implications of former government-affiliated engineers applying "efficiency-first" methodologies to the vulnerabilities of the private AI sector.

Official Responses and Lack Thereof

As of the current reporting cycle, the response from the parties involved has been notably muted. Anthropic has not issued a formal press release addressing the incident, and its internal security teams have not commented on whether the reported vulnerabilities have been remediated. The silence from Anthropic is standard for companies managing active vulnerability reports; acknowledging specific security gaps can invite further scrutiny or embolden other actors to test the same vectors.

Cathedral representatives have similarly remained out of the public eye. The lack of response from the startup is likely linked to the confidential nature of the vulnerability disclosure program. Usually, researchers are bound by non-disclosure agreements (NDAs) that prohibit the public discussion of findings until a patch has been fully implemented and verified. The leak of the draft report to The Washington Post suggests either a breach in protocol or an attempt by the researchers to force a swifter response to the security risks they identified.

Broader Implications for AI Security

The Cathedral incident is a microcosm of a much larger existential challenge for the AI industry: the security of the supply chain. Companies like Anthropic invest billions in the safety and alignment of their frontier models, yet they rely on the same common enterprise software—like project management tools, communication platforms, and HR software—as every other corporation.

If these third-party platforms become the primary entry point for AI-driven cyberattacks, the security burden on these providers will grow exponentially. The incident raises several critical questions:

1. SaaS Vulnerability Management: To what extent should major AI labs be held accountable for the security flaws in the third-party software they utilize?
2. Automated Offense vs. Defense: As AI agents become more proficient at discovering vulnerabilities, can human-managed defense teams keep up? The "12-hour" metric is a benchmark that suggests the speed of discovery is outstripping the speed of manual patching.
3. Governance of AI Agents: Should there be strict regulatory or industry-wide ethical guidelines on how AI security agents are permitted to traverse internal networks, even within the scope of authorized testing?

The Path Forward

The significance of the Cathedral report rests on the fact that it was not a theoretical exercise but a practical demonstration of risk. For the AI industry, the path forward will likely involve a significant tightening of third-party integration policies. Expect to see major AI developers move toward more isolated, proprietary internal tools to reduce their reliance on third-party SaaS vendors, or alternatively, the implementation of more rigorous "Zero Trust" architectures that assume every piece of software in the stack is a potential vector for compromise.

Furthermore, the incident is likely to serve as a catalyst for increased investment in defensive AI—security systems that can detect and neutralize other AI agents in real-time. If the offensive side of the equation can find paths into a system in 12 hours, the defensive side must be able to detect and block those paths in seconds.

As the industry awaits further clarity from Anthropic, the broader takeaway remains clear: the infrastructure of the AI revolution is only as secure as the weakest third-party application connected to its network. Whether this report results in a new industry standard for security or simply serves as a warning shot, it marks a pivotal moment in the maturity of the AI cybersecurity landscape. The race between automated exploitation and autonomous defense has officially entered a new, faster-paced phase.