AI cybersecurity startup Cathedral says it breached Anthropic's data and messaging systems, under a program inviting outside experts to test Anthropic's systems
The start-up firm Cathedral has told makers of the Claude chatbot that its researchers were able to quickly penetrate sensitive systems, a report reviewed by The Post shows.
Washington Post
Context & Ripple Effects
Anthropic had already treated misuse and intrusion as product-security concerns: its internal Clio threat-detection tool was designed to identify threats and coordinated abuse, while an April report described unauthorized users accessing its Mythos model. Its October Critical Infrastructure Defense Program extended that security posture to outside defenders.
Cathedral's claim puts the focus on whether AI agents compress the time and labor required to reach sensitive internal environments. That matters especially for Anthropic, whose own 2025 threat report said Claude had been weaponized in sophisticated cybercrime.
First-order effects
Anthropic must assess the reported path into its internal systems and determine whether access controls around sensitive model discussions and related systems require remediation.
Cathedral gains a high-profile proof point for its AI-agent security offering, contingent on the credibility and reproducibility of its reported findings.
Second-order effects
CrowdStrike and the other participants in Anthropic's Critical Infrastructure Defense Program face sharper demand to test whether their defenses can detect and contain agent-assisted intrusion attempts at similar speed.
AI labs' security teams will face pressure to treat internal collaboration tools, model-access workflows, and identity controls as a connected agentic attack surface rather than separate administrative systems.
Third-order effects
If agent-assisted testing repeatedly reduces the time needed to find and exploit weaknesses, security assurance will shift toward continuous, machine-speed adversarial validation rather than periodic human-led reviews.
AI vendors that position their models as critical-infrastructure tools will be judged not only on the cyber capabilities of their products, but on resilience of the internal systems used to develop and operate them.
The trend: AI is accelerating both offensive testing and defensive assurance, making the speed of detection and containment a central competitive security measure.
“A senior Trump administration official, speaking on the condition of anonymity to describe internal proceedings, said that the Cathedral report on its access inside Anthropic had circulated within the government and raised national security concerns.
EXCLUSIVE: In less than 12 hours, a group of ex-DOGE cyber researchers were able to penetrate Anthropic's systems using AI agents — including Slack channels where the most sensitive models are discussed. This is just weeks after Anthropic whistleblower Joseph Coxon charged the co…
cathedral releasing this the morning of the s1 release is like the muslim/wasp wars in the intelligence community for guys that read situational awareness
Quite serious. critical to national security and how trillions of dollars of value at major labs and the frontier of research mustbe protected Lux family co Cathedral's (+a16z +Sequoia) AI tools penetrated Anthropic, including its internal slack and more in under 12 hours🤯
At least encouraging to see a senior Trump admin official treating lab security as a pressing nat sec issue, tantamount to locking down “nuclear weapons grade material.”
The headline doesn't state this was from an Anthropic Bug Bounty program. It's also unusual that this was released precisely when Anthropic announced today they filed for an IPO to trade as ANT. Id be interested in reading the write-up from these “ex-DOGE cyber researchers
New Pacing the Frontier proposal: each time an outside group successfully penetrates the defenses of a frontier AI company and captures the flag, it should reset a 3-month countdown clock before they're allowed to train new models.
This is wild! Honestly, every company should be paying attention to this. Cyber security has been on the back burner at so many organizations for so long, and in the age of SI, now is the time to take a hard look at how you secure your networks. SI is a great tool for securing yo…
Are we ready? Are we serious? This is an undeclared emergency. You thought you were still inside the secure bastion of the king's castle. You have awoken in Helm's Deep. The orc armies are coming. Cathedral's AI agents were inside Anthropic's most sensitive model Slack channels i…
@lizzadwoskin Should probably point this out: “The start-up probed Anthropic under a company program that invites outside cybersecurity experts to test its systems.”
@lizzadwoskin This is a) fear porn, b) unverifiable, c) more BS to scare people into giving up their freedoms. Fight for your rights. Free speech and the right to bear AI. Stop listening to anyone spewing fear and doom. Self-verify and don't believe anything you can't. •
this tweet from a former OAI researcher seems harder to argue with every day that goes by security is only as strong as the weakest link and these AI companies software stacks have so many links [image] [embedded post]
This story is eliciting some wild, next-level hysteria on X and in the gov (https://www.washingtonpost.com/ ...). Did people not understand what occurred? Or am I missing something? Also, a quote from @alexstamos that originally appeared in the story has been removed. See highlig…
Cathedral's report is circulating through the govt. One senior administration official said it was really concerning what Cathedral was able to do in a short time. There's some important political context here, as Anthropic has had multiple fights with the admin and Cathedral is …
But the reality is, there really isn't an alternative. Should Anthropic vibe code every tool it wants and needs? Would that be safer? I really feel we are entering a period where people will take their most important conversations offline.
Anthropic is famously security-conscious. Model weights and customer prompts were not compromised in this breach. But to me it really underlines the question of where and how AI companies should use external SAAS vendors. It seems like, for now, nothing is really safe to use
“If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind,” the official said. He added that he was taken aback by