Ex-DOGE Startup Breached Anthropic's Business Systems in Under 12 Hours

A $1.4B cybersecurity firm founded by four former DOGE staffers got inside one of America's most sensitive AI companies before lunchtime, by attacking the vendor software, not the AI itself.

Key takeaways

• Cathedral, backed by Andreessen Horowitz and Sequoia Capital at a $1.4B valuation, used AI agents to find paths into Anthropic's sales, HR, and IT systems in under 12 hours, exploiting vulnerabilities in unnamed third-party business software.
• Anthropic confirmed access to a limited set of internal systems; per Cathedral's draft report as reviewed by The Washington Post, that reportedly included meeting transcripts, salary data, job offers, and Slack messages about advanced AI models. Anthropic says Claude conversations, source code, and model weights were not reached.
• A White House official who reviewed Cathedral's draft report warned the findings raise national security concerns, noting that foreign adversaries may not be far behind a months-old startup that pulled this off in half a day.

Cathedral, a cybersecurity startup founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein, four alumni of the DOGE initiative, found paths into Anthropic's internal systems in less than 12 hours using AI agents, first reported by The Washington Post on October 26, 2026. The firm, which raised $160 million at a $1.4 billion valuation led by Andreessen Horowitz and Sequoia Capital (both of whom took board seats), conducted the test under Anthropic's bug bounty program. Kliger previously served as chief data officer at the Pentagon (Breaking Defense); the firm's work has since surfaced at the highest levels of the U.S. government.

The entry vector was not Anthropic's own software. Cathedral reportedly exploited vulnerabilities in unnamed third-party business tools (admin and sales platforms) to move laterally into Anthropic's environment. Anthropic confirmed that a limited set of sales, HR, and IT systems was accessed, and that it shut off Cathedral's access, kept affected software offline until vendors confirmed fixes, and reported the incident to federal officials. It also accused Cathedral of violating its bug bounty program rules by not fully disclosing the scope of its activity.

What Was Inside, and What Wasn't

Per Cathedral's draft report as reviewed by The Washington Post, the accessed data reportedly included meeting transcripts, salary details, job offers, and Slack messages discussing advanced AI models, along with some customer and partner business contact information and basic user account records. Anthropic's own characterization is "a limited set" of business systems.

What was not touched: Claude user conversations, Anthropic's source code, and AI model weights. Those distinctions matter, but they shouldn't be mistaken for reassurance. The operational layer, the human infrastructure of a frontier AI lab, was inside reach in under half a day.

A White House official who received Cathedral's draft report did not mince words, as quoted by The Washington Post:

"How little time it took to get into the sensitive systems of a company that is controlling almost nuclear weapons grade material. If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind."

The Supply-Chain Problem No Amount of Model Security Fixes

Here is the part that deserves more attention than the breach itself: Anthropic was not undone by a flaw in Claude, in its model weights, or in anything it built. It was undone by the weakest vendor in its software supply chain. Third-party admin and sales tooling, the commodity software every company runs, was the door.

Bitcoiners know this failure mode intimately. It's why the network runs on self-custody principles and distributed verification rather than trusted intermediaries. The "not your keys" doctrine exists precisely because any centralized system is only as strong as its least-secured dependency. The exact same logic applies to frontier AI infrastructure: a lab can pour billions into model-level security while its Slack logs and salary records walk out through a vendor's unpatched admin panel.

Anthropic carries additional weight here. It is not just any software company. Its systems, as the White House official framed it, sit adjacent to capabilities with near-nuclear strategic significance. The compute commitments surrounding these labs are enormous; the operational security posture protecting the humans who run them appears to lag substantially behind.

Cathedral's lineage adds another layer. These are former DOGE staffers, people who spent months inside the federal government with elevated system access, now operating an AI military firm backed by a16z and Sequoia. Their first public proof-of-concept is breaching the internal communications of a frontier AI lab.

That breach serves as a calling card for federal contracts, and the White House's decision to circulate the draft report internally suggests it is being read that way.

The falsifiable thesis: Anthropic's breach via third-party admin software proves that frontier AI labs are only as secure as their weakest vendor. That thesis weakens only if a major lab can demonstrate that all sensitive operational data is fully air-gapped from third-party tooling at the vendor level, with no lateral-movement path from admin software to model infrastructure or sensitive personnel data. No such demonstration has been made public.

For energy investors and Bitcoin miners being courted to host AI compute, the Cathedral episode is directly relevant. If the AI capex infrastructure these labs are building can be soft-compromised through commodity admin software in under 12 hours, the insurance and liability calculus for co-located AI workloads changes. The counterparty risk is not hypothetical.

What to Watch

Anthropic has reported the incident to federal officials, and Cathedral's draft report is already circulating within the White House. The next disclosures to track are whether the unnamed third-party vendors have publicly confirmed their fixes, whether Anthropic's bug bounty dispute with Cathedral produces any formal action, and whether Cathedral's government contract pipeline accelerates in the wake of this demonstration. The harder structural question, whether frontier AI labs can be compelled to air-gap their operational infrastructure from commodity vendor software, has no clear regulatory answer yet.

Sources

• The Washington Post exclusive, October 26, 2026 (first reported by The Washington Post)
• Cathedral funding and founding, NewsNation/Reuters
• Cathedral company background, The Next Web, July 23, 2026