DOGE Agents Breached Anthropic in 12 Hours: Firm Fights Back

By Daniel Rao

It took less than 12 hours. Not to crack Claude, not to steal the weights behind one of the world's most valuable AI models, but to walk in through the side door — the ordinary business software that even the most advanced company in America runs on without thinking twice. That is the claim at the centre of a row that broke on Monday, 26 October 2026, and it has managed to embarrass Anthropic, embolden its critics in Washington, and hand a months-old startup founded by four former DOGE staffers the biggest stage of its short life.

Let us be precise from the start, because precision is exactly what this story is fighting over. This was not a criminal hack. Cathedral, the startup in question, probed Anthropic under the company's own bug-bounty programme, which invites outside researchers to find flaws and pays them for reporting them. What is disputed — fiercely — is how far inside Cathedral got, and what it means. The Washington Post reported the episode first, citing a draft Cathedral report it had reviewed. Anthropic confirmed part of it and flatly rejected the rest. Somewhere between those two versions sits a genuinely uncomfortable truth about AI security, and neither side is terribly keen to dwell on it.

Photo: The Pentagon in Arlington, Virginia. File photo — this is not an image of the Cathedral test or of Anthropic's systems; no such image exists. DoD photo by Master Sgt. Ken Hammond, U.S. Air Force, via Wikimedia Commons (public domain).

The 12-hour test

According to the draft report seen by the Post, Cathedral's AI agents — software that can carry out multi-step tasks without a human approving every move — found paths into Anthropic's internal systems in under 12 hours. The way in was not Anthropic's own code. It was vulnerabilities in third-party business software that Anthropic uses for sales and administrative tasks, the kind of tools most large companies run without a second thought. The Post withheld the vendors' names for security reasons, and so will we.

Cathedral says those routes exposed meeting transcripts, salary and job-offer details, and Slack messages discussing Anthropic's most advanced AI models. Its draft calls the result evidence of "a serious gap between the offensive capabilities now emerging and the defenses" protecting American technology, and says it "should be a wake-up call for every company in America". Cathedral reported its findings to Anthropic earlier in October and told the affected software vendors too.

Anthropic's version of events is narrower, and it comes with a pointed detail Cathedral would rather you skipped. The company says the researchers spent several days failing to penetrate Anthropic's own software before turning to the third-party applications. Only then, Anthropic says, did they get anywhere. That is not a trivial distinction. It is the difference between "your fortress fell in half a day" and "your fortress held, but the office block next door had an open window".

What each side says was reached

Anthropic confirmed that Cathedral accessed "a limited set" of its sales, human resources and IT systems, including business contact details for some customers and partners and some basic user account records. It stressed what was not reached: customer conversations with Claude, the responses its models generate, its source code, and its model weights — the billions of numbers that make up a trained model. On that, the most important question in the whole affair, Anthropic's answer is unambiguous: no.

The company added that its own monitoring flagged some of Cathedral's activity before the researchers reported it. "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day," Anthropic told the Post. "We also have no evidence that anyone exploited these vulnerabilities outside of Cathedral." The affected software was disabled until the vendors confirmed fixes, and federal officials were briefed.

Then came the counterpunch. Anthropic accused Cathedral of overstating the "implied national security implications" of its findings and of failing to disclose all of its activity inside the company's systems, violating the bug-bounty programme's rules. Cathedral, in its draft, insisted its "data accesses were kept to the absolute minimum in accordance with security research best practices". A Cathedral spokeswoman declined to comment to the Post — the company, for now, is letting its draft report do the talking, which is a strange way to announce yourself and a telling one.

Read the two accounts side by side and something odd emerges: they barely disagree about the plumbing. Both sides agree the entry point was third-party software, both agree the test ran under the bug-bounty programme, and Anthropic does not dispute the under-12-hours figure for the agent run itself. The fight is over framing — whether a path into business systems counts as a breach of an AI lab, and whether a startup with every incentive to look formidable should be allowed to set that frame. That is a public-relations fight dressed up as a security debate, and it is being fought on the worst possible day for Anthropic.

The worst possible day

The Post's report landed on the same day Anthropic's S-1 IPO filing went public — Monday, 26 October 2026. The prospectus, for a Nasdaq listing under the ticker ANT, showed first-half 2026 revenue of $16.29 billion against $1.16 billion a year earlier, and a headline $80.7 billion net loss driven mostly by a $72.4 billion non-cash accounting charge. We covered the filing in detail in our report on Anthropic's IPO filing and its $80.7 billion loss, and the timing here is impossible to ignore: the same morning investors could finally read Anthropic's audited numbers, they could also read that a startup barely out of stealth had wandered around its back office.

We checked our own Anthropic coverage before writing this — the S-1 report, the SpaceX deal story and the ASD warning are all still live — and we verified the Pentagon file photo's public-domain licence against its Wikimedia record before using it, because a story about unverified claims should not itself lean on an unverified picture.

Anthropic will hate that juxtaposition, but it should not be surprised by it. A company about to ask public markets for a valuation reportedly in the region of $1.5 trillion does not get to have its security arrangements treated as a private matter. Every flaw found now will be read as a proxy for how seriously it takes the unglamorous work of corporate security — patching vendors, watching logs, writing rules for researchers — as opposed to the glamorous work of training frontier models. On the evidence of this week, the glamorous work is world-class and the unglamorous work had a hole in it.

Who Cathedral is — and why the founders matter

Cathedral was founded in 2026 by Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all alumni of the Department of Government Efficiency, the Trump administration's cost-cutting initiative. In July 2026, Reuters reported, the startup raised $160 million at a $1.4 billion valuation, led by Andreessen Horowitz and Sequoia Capital, with both firms taking board seats. Its stated mission is to build AI tools for US military cyber operations, offensive and defensive, including against adversaries such as China.

Kliger is the name to watch. He previously served as the Pentagon's chief data officer, and the Post reports he took part in Pentagon discussions about how officials would respond if a foreign country got hold of research from a leading AI lab. A senior Trump administration official told the Post that three federal agencies have recently signed contracts with Cathedral. And then there is the quote that will travel furthest from this story. A senior Trump administration official, speaking anonymously to the Post, said: "If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind."

It is a vivid line, and it should be handled with care. It is an anonymous official's warning, not evidence that Chinese hackers have done anything of the sort. No one in this story claims they have. But as a piece of political rhetoric it is brutally effective, because it converts a narrow dispute about vendor software into a national-security alarm — and it does so in the voice of the very administration that has been fighting Anthropic all year.

The Pentagon feud that explains everything

None of this happens in a vacuum. The clash between the Pentagon and Anthropic came to a head in late February 2026, when the department demanded what it described as unrestricted use of Claude for "all lawful purposes". Anthropic refused to drop two safeguards: no use in fully autonomous weapons systems capable of independent lethal decision-making, and no use in mass domestic surveillance programmes targeting American citizens. Its chief executive, Dario Amodei, argued at the time that "Anthropic has much more in common with the Department of War than we have differences" — but the exceptions, he insisted, were non-negotiable.

The Pentagon disagreed, designated Anthropic a "supply chain risk" — a label previously used against foreign adversaries, never a domestic American company — and barred it from Pentagon contracts, requiring defence contractors using Claude to cease those deployments. Within hours, OpenAI stepped in with its own Pentagon deal, and its chief executive, Sam Altman, later acknowledged publicly that the agreement was "definitely rushed" and that "the optics don't look good". The fight has since wound through the courts, with rulings cutting both ways over whether the designation was lawful procurement or illegal retaliation. It is, by any measure, the bitterest feud between a US AI lab and its own government, and it is the reason a Cathedral test of Anthropic lands like a political event rather than a routine bug report.

The irony is thick enough to cut. The Pentagon dropped Anthropic in part because it would not hand over unrestricted use of its models — and then a startup led by the Pentagon's former chief data officer demonstrated, under Anthropic's own programme, that the company's business systems could be entered in half a day. Whether you think that is a devastating indictment or a modest finding dressed up for maximum effect probably depends on which side of the feud you already stand on. That, more than anything, is why this story will run for weeks.

It also explains the money swirling around Anthropic's orbit. The company is simultaneously fighting Washington and buying its way into the compute infrastructure it needs, including a vast deal with SpaceX that we reported in our piece on Anthropic's $120.5 billion SpaceX arrangement. A lab that can sign cheques at that scale cannot plausibly claim it lacks the resources to police its vendors. Resources were never the constraint. Attention was.

Why the vendors, not Claude, are the real story

Step back from the personalities and the story gets simpler — and more worrying. The agents did not defeat Anthropic's frontier security. They defeated the security of everyday enterprise software, the unglamorous plumbing every AI lab, bank, hospital and government department depends on. That is precisely why Australia's signals directorate has been warning that AI-driven attacks are about to get dramatically easier, a warning we covered in our report on Australia's warning on AI attacks. The threat is not a superintelligence breaking down the front door. It is tireless agents jiggling every side window, at machine speed, until one opens.

This is also where Anthropic's defence, for all its force, starts to look thin. Yes, Claude's conversations, code and weights were untouched. Yes, its monitoring caught some activity. But "a limited set" of sales, HR and IT systems still means real people's salary details and job offers, real business contacts, real internal discussions about advanced models — or at least, on Cathedral's account, paths to them. Anthropic has not published a full inventory of what Cathedral viewed versus what it merely could have viewed, and until it does, the gap between the two accounts will keep being filled by whichever side shouts loudest. That is a communications failure, not a technical one, but in an IPO week communications failures cost real money.

And Cathedral deserves scrutiny of its own. A startup selling offensive cyber capabilities to the military, founded by men who until months ago sat inside the government, does not get to present itself as a disinterested public watchdog. Its draft report reads, at times, like a sales document: a demonstration that its agents can do in hours what used to take teams of human hackers weeks. That may be true. It may also be exactly what a company raising its next round at a higher valuation would want you to believe. The bug-bounty programme exists to find flaws, not to generate marketing, and Anthropic's complaint that Cathedral did not fully disclose its activity — if substantiated — would be a serious breach of the trust that makes such programmes work at all.

Our take: both sides are overselling, and that is the scandal

Here is where we land. Cathedral has not, on the evidence published so far, breached Claude or anything close to it, and anyone describing this as a hack of Anthropic's AI is misleading you. But Anthropic has not, on the evidence published so far, explained away the finding either. A company guarding what it calls the most important technology of the century left a path open through its vendors that a months-old startup's agents found in under 12 hours, after its own monitoring had to catch activity the researchers had not yet disclosed. That is not a catastrophe. It is shoddy housekeeping at the exact moment the house is being shown to buyers, and the attempt to dismiss it as a "limited" matter only makes the housekeeping look worse.

The honest verdict is that both sides are overselling. Cathedral is selling a national-security wake-up call; what it has shown, so far, is a vendor-management failure. Anthropic is selling a non-event; what it has admitted, so far, is an intrusion into business systems it failed to fully prevent or fully explain. The truth — that AI agents have made the boring parts of corporate security the most dangerous parts — is less dramatic than either pitch and more important than both. Every company in America does, in fact, run the same kind of third-party software. That is the wake-up call, and it does not need exaggeration to be alarming.

What happens next matters more than what has been said. Anthropic should publish a fuller account of what was accessed, not just what was not, and name the lessons it has imposed on its vendors. Cathedral should publish its full report, not a draft summarised by a newspaper, and submit to an independent ruling on whether it broke the programme's rules. And the vendors — still unnamed, still unaccountable in public — should explain how their flaws sat unpatched in the systems of one of the world's most scrutinised companies. Until those three things happen, this story is not a verdict. It is an opening argument, delivered twice, by two interested parties, on the loudest day of Anthropic's corporate life.

Sources: The Washington Post (first report, citing a draft Cathedral report); Gizmodo, Dealroom, TechStartups and ZeroHedge (carriers of the Post report and Anthropic's statement); Reuters, July 2026 (Cathedral's $160 million raise at a $1.4 billion valuation); Cloud Security Alliance research note (Pentagon–Anthropic dispute); Anthropic's S-1 filing, 26 October 2026.

Daniel Rao is an independent tech journalist covering AI, cybersecurity and the politics of the tech industry.