Cathedral Claims 12-Hour Access to Anthropic Systems

The way in was not Claude

Cathedral did not break a model. Its researchers were working under Anthropic's programme for outside security researchers — an authorised test, not an attack — when they exploited flaws in business software Anthropic uses for administrative and sales tasks, software many other companies also run. The access route was a vendor's product, and Cathedral told both Anthropic and the vendors what it had found earlier this month.

The clock needs its context in the same breath. The researchers reportedly spent several days unsuccessfully attempting direct access before Cathedral's agents succeeded in a separate run involving third-party business software. The under-12-hours figure belongs to that successful run alone. The vendors have not been named publicly, the number of records accessed is unclear, and Cathedral's final report has not been published.

That distinction decides what the story is about. The assets a frontier lab guards hardest, its weights, code and users' conversations, sit behind one boundary. Meeting transcripts, salary bands and internal chat sit behind another, built out of connected office tools that were procured, not engineered. A trusted third-party application with broad access is a door, and AI agents are getting faster at trying every door in the building.

Two accounts of what was reached

The two sides agree on the access route and disagree on the scope.

On Cathedral's account, in a draft report the Post reviewed, less than 12 hours of agent work produced paths to meeting transcripts, salary and job-offer details, and Slack messages discussing Anthropic's most advanced models. Those are paths Cathedral says it identified. What those messages contained is not described in any source read for this piece. "Slack messages about models" and model information itself are very different things.

On Anthropic's account, what was accessed was a limited set of sales, HR and IT systems holding some customer and partner business contact information and some basic user account records. The company is explicit about the negative space: no customer prompts, no Claude conversations or model responses, no source code, no model weights. Access to a system is not proof that every category of data inside it was viewed, and Anthropic's confirmation covers the systems, not Cathedral's list of paths.

Anthropic also alleged that Cathedral did not fully comply with the outside-researcher programme because it failed to disclose all its activity. Cathedral's draft described its data access as minimal, but that is not a direct response to the disclosure allegation. Cathedral declined to comment to the Washington Post.

What Anthropic says closed the door

Anthropic says its monitoring identified some of the activity before the researchers reported it, and that it terminated the identified access on the same day. That account suggests detection and response controls played a role, but the public reporting does not establish exactly which controls stopped which actions. Anthropic also says it disabled the affected software until the vendors fixed it, briefed federal officials, and has no evidence anyone outside Cathedral exploited the same flaws.

Set against that is the assessment the Post obtained from Alex Stamos, Cognition's chief information security officer, who reviewed the findings at its request, according to the Post's reporting as summarised by Mad Robot. "They found something big here," he said, calling the risk of connecting third-party applications to company systems "a humongous problem for everybody", and concluding that Anthropic "could have done a lot better" on vendor oversight. Detection, on Anthropic's account, worked. Vendor oversight, on that reading, is where the failure sits.

Why Washington is in this story

Cathedral is not a neutral testing firm, and the context is part of the evidence. Four former DOGE staffers founded it to sell AI-driven cyber capabilities; it raised $160 million at a $1.4 billion valuation in July, led by Andreessen Horowitz and Sequoia Capital, per Reuters, with Marc Andreessen and Shaun Maguire on its board.

Co-founder Gavin Kliger later served as the Pentagon's chief data officer. Separately, the Pentagon and Anthropic fell out earlier this year after Anthropic refused to allow its models to be used for autonomous weapons or mass domestic surveillance; reporting on that dispute describes the Pentagon barring Anthropic from federal systems, a decision Anthropic has contested. Those are separate facts, and neither settles what Cathedral's agents did or did not reach.

According to a senior administration official quoted anonymously by the Washington Post, the findings circulated within government and three federal agencies had recently signed contracts with Cathedral.

None of that makes the finding false; Anthropic confirmed the core of it. It does mean the finding arrived with an argument attached, made by a company that profits when the argument is believed. What would settle the remaining questions is Cathedral's final report and the vendors' names once they are fixed. Until then, the confirmed residue is small and specific, and it is enough: office software connected to a frontier lab's systems was a working way in, agents found it quickly once they looked there, and Anthropic says its own monitoring ended it.

Sources

[1] The Washington Post, "It took just 12 hours for an AI start-up founded by ex-DOGE staffers to break into Anthropic" (Elizabeth Dwoskin and Gerrit De Vynck, October 26, 2026; reviewed Cathedral's draft report and carried Anthropic's statement; cited by name as the primary reporting)Read source
[2] Gizmodo, "Former DOGE Staffers' New Startup Claims It Hacked Anthropic" (Ece Yildirim, October 26, 2026; the several-days-of-failed-direct-attempts detail and the founders list)Read source
[3] Mad Robot (summary of the Post's reporting, October 26, 2026; Stamos quotations, the federal-officials briefing and the board details)Read source
[4] CellCog, "Cathedral Got Into Anthropic in 12 Hours: What It Reached" (October 26, 2026; side-by-side account of the two positions)Read source
[5] Dealroom News, "Ex-DOGE startup Cathedral breached Anthropic in under 12 hours, report says" (October 26, 2026; Cathedral background and the July Reuters reporting of its $160 million raise at a $1.4 billion valuation)Read source

THE ALFW VERDICT

Cathedral's twelve-hour figure describes its reported successful agent run, not the full investigation: Anthropic says the researchers had spent several preceding days unsuccessfully attempting direct access. The two sides also disagree about the scope of the findings and compliance with the research programme. What Anthropic does acknowledge is significant enough: an authorized test reached a limited set of business systems through third-party software. That is not evidence that Claude conversations, source code or model weights were compromised. It is evidence that a frontier AI company remains exposed to the ordinary risks of enterprise software and vendor connections. Anthropic says its monitoring detected some activity and that it terminated the identified access; the exact sequence and extent of the test remain incompletely documented. The lesson is about third-party access and oversight, not a claim that Anthropic's core model defenses fell in twelve hours.