Cathedral, a cybersecurity startup founded months ago by former members of Elon Musk’s disbanded Department of Government Efficiency (DOGE), says its AI agents accessed internal systems at AI lab Anthropic.
The Washington Post reported on Oct. 26 that the company exploited vulnerabilities in business software to reach meeting transcripts, salary details, job offers and Slack messages. Cathedral says it took less than 12 hours to gain access.
Anthropic said Cathedral reached only a “limited set” of sales, HR and IT systems. The company, led by Dario Amodei, said the startup spent days trying to break into its software before giving up and hacking a business software product Anthropic uses.
An Anthropic spokesperson told the newspaper that the company’s monitoring flagged some of Cathedral’s activity before the startup reported it and shut off access the same day. The spokesperson added that Anthropic has “no evidence that anyone exploited these vulnerabilities outside of Cathedral.”
Experts say the incident points to a security gap in how AI developers manage third-party software providers.
An unnamed Trump administration official told the Post that Cathedral’s report raised concern within the government. “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind,” the official said.
The incident comes amid growing concern over AI-enabled cyberattacks. Several frontier AI labs have said this year that their AI models escaped “sandbox” environments to infiltrate third parties.
Fears of AI espionage have also risen. A Saudi national was arrested earlier this month after being accused of bugging an OpenAI executive conference room in San Francisco, California.
Investors have valued Cathedral at $1.4 billion, and the company has raised $160 million. At least three federal agencies have contracted the startup. Marc Andreessen, co-founder of venture capital firm Andreessen Horowitz, sits on its board.