On October 26, 2026, the Washington Post reported that Cathedral's AI agents got into Anthropic's internal business systems in under 12 hours. The Post based its story on a draft Cathedral report. Cathedral is a security startup founded months earlier by four former DOGE staffers. The Post article itself was paywalled (HTTP 403) when we tried to open it, so this analysis relies on outlets that quote the Post and Anthropic's statement to it. Those outlets agree with each other on the core facts. The test ran under Anthropic's program that pays outside researchers to find flaws. The agents got in through unnamed third-party administrative and sales software, not through Claude or Anthropic's own code.
This matters to builders for two reasons. First, the target was an AI lab whose most valuable assets, model weights and research discussions, are exactly what state actors want. Second, the way in was ordinary SaaS that almost every company runs. A senior Trump administration official told the Post the report has circulated in government and raised national-security concerns. Anthropic says those concerns are overstated.
What we checked
- What systems and data were accessed, for how long, and what did Anthropic independently confirm about the reported assessment? partly confirmed. Anthropic confirmed that Cathedral reached 'a limited set' of sales, HR and IT systems through unnamed third-party software. It says these held business contact details and basic account records, and that customer prompts, Claude responses, source code and model weights were not touched. Meeting transcripts, salary and offer data, and Slack threads about new models come only from Cathedral's draft report, not from Anthropic. Anthropic says it cut off access the same day, but no public source gives an exact length of access. [1][2][3]
- Is 'hacked in 12 hours' an accurate framing of what happened? partly confirmed. It was an authorized test under Anthropic's paid outside-researcher program, not a criminal break-in. The 'under 12 hours' figure counts only from Cathedral's switch to vendor software. Before that, it spent several days failing to breach Anthropic's own software directly. [3][2]
What we found
- Anthropic's on-record statement confirms that Cathedral got in, but it describes the scope narrowly. Cathedral reached 'a limited set' of sales, HR and IT systems holding business contact details for some customers and partners plus basic user account records. Customer prompts, Claude responses, source code and model weights were not accessed. Anthropic said: 'Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day.' [1][2]
- The most sensitive items come only from Cathedral's draft report, as described by the Post: meeting transcripts, salary and job-offer details, and Slack discussions about Anthropic's most advanced models. Anthropic has not confirmed them. Tech Times puts some of these categories next to Anthropic's account, which appears to blur the two sources. Cathedral's draft says 'data accesses were kept to the absolute minimum in accordance with security research best practices.' A Cathedral spokeswoman declined to comment. [1][3]
- The method: Cathedral spent several days trying to breach Anthropic's own software directly and failed. It then switched to third-party enterprise software, where its agents mapped routes and carried out multi-step exploitation without a human approving each step. 'Under 12 hours' is measured from that switch. The vendors, products and flaws have not been named, reportedly because patches were still being prepared. [3][2]
- Anthropic says it disabled the affected business software, briefed federal officials, and turned it back on only after the vendors confirmed fixes. It says it has no evidence anyone besides Cathedral exploited the flaws. It also says Cathedral broke the program's terms by not disclosing all of its activity inside Anthropic's systems, and that Cathedral overstated the national-security implications. According to Tech Times, Anthropic had not filed a legal complaint as of the report. [3][1]
- Cathedral's founders are Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all former DOGE staffers; Kliger was previously the Pentagon's chief data officer. In July, Cathedral raised $160 million at a $1.4 billion valuation in a round led by Andreessen Horowitz and Sequoia, aimed at AI-driven offensive and defensive cyber operations. A senior administration official told the Post that three federal agencies have contracted with Cathedral, so the company's report carries weight in Washington. [4][2]
- Neither company has published a primary document about the incident: no Cathedral report, proof of concept or vendor advisory, and no Anthropic post. Anthropic's public Coordinated Vulnerability Disclosure page covers flaws Claude finds in other people's software. It says reports to Anthropic from external researchers fall under a separate Responsible Disclosure Policy, so the program terms at the centre of the dispute are not described on that page. [5]
What it means
The confirmed core is this: an authorized red team using autonomous agents got from vendor SaaS into an AI lab's HR, sales and IT data within a single working day, after days of failing against the lab's own hardened code. That is believable, and it applies to almost any organisation. Hardening your own product and model infrastructure does little if the HR suite, CRM, IT management and collaboration tools carry broad OAuth grants and hold sensitive conversations. Builders should list every third-party integration and its token scopes. Cut permissions on admin and sales tools to the minimum. Treat transcription and chat archives as high-value data stores. Add detection for unusual API and session behaviour on SaaS accounts. Anthropic's own monitoring spotting the activity is the one defensive control in this story that worked.
Treat the dramatic details as unverified. Salary records, meeting transcripts and Slack threads about frontier models are Cathedral's claims from an unpublished draft. Anthropic has confirmed a narrower set of business-contact and account data. Cathedral is a commercial company with government contracts and a reason to show off its agents, and Anthropic says Cathedral both broke program rules and overstated the stakes. Until the vendors publish advisories or one side releases its report, do not repeat 'Anthropic hacked in 12 hours' as settled fact. The safe conclusion is this: agents can quickly chain together flaws in ordinary SaaS, and that SaaS is part of your attack surface.
Still open
- Which third-party vendors and products were exploited, what were the flaws, and have advisories or CVEs been published?
- Exactly how long did Cathedral's access last, and how long passed between Anthropic's monitoring flagging it and access being cut off?
- Did Cathedral actually view meeting transcripts, salary data and Slack threads about models, or did it only show that it could reach them?
- Which activity does Anthropic say Cathedral failed to disclose, and what do the Responsible Disclosure Policy terms require?