Ex-DOGE Staffers' AI Agents Broke Into Anthropic in Under 12 Hours, and Anthropic Says They Broke the Rules

A startup run by former DOGE staffers pointed its AI agents at Anthropic and says they reached salaries, job offers, meeting transcripts and Slack messages in less than 12 hours. They did not get in through Claude. They got in through the ordinary business software Anthropic uses to run sales and administration.

Anthropic confirms a breach, a limited one, and says the startup broke the rules of the program it was operating under. The fight over who gets to claim the win is already running through Washington.

Who Cathedral is

Cathedral is an AI driven cybersecurity startup focused on military work. It was founded by Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, all of whom passed through Elon Musk's DOGE. Elez had to resign from DOGE after being linked to racist posts before Musk rehired him.

The company is valued at $1.4 billion and has raised $160 million from investors including Andreessen Horowitz and Sequoia Capital. Marc Andreessen and Shaun Maguire, Trump allies tied to those firms, sit on its board, Gizmodo reports.

Kliger is the most pointed name on that list. He was previously the Pentagon's chief data officer and was reportedly involved in the Pentagon's very public fallout with Anthropic, a fight in which a judge later ruled the Pentagon's blacklisting of Anthropic unlawful.

The side door

According to a draft Cathedral report reviewed by the Washington Post, the agents first spent several days trying to break into Anthropic's software directly and failed. Then they turned to vulnerabilities in third party tools the company uses for administrative and sales tasks.

From there, in under 12 hours, they found paths to meeting transcripts, salary and job offer data, and Slack messages, including internal discussions about Anthropic's advanced models.

Anthropic confirmed access to a "limited set" of its sales, human resources and IT systems, including customer and partner business contact information and some basic user account records. It says Cathedral never touched Claude users' conversations, model outputs, source code or model weights.

"Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day," the company said. It disabled the affected software and brought it back only after the vendors confirmed the flaws were fixed.

A bug bounty turned political

The test ran under Anthropic's program that rewards outside researchers for finding vulnerabilities. Anthropic now accuses Cathedral of violating that program's rules by not disclosing the full extent of what it did, and of overstating the national security stakes.

Cathedral is leaning hard on exactly those stakes. "The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America," its report says.

The pitch has landed somewhere. A senior Trump administration official circulated the report inside the government, and the hack reportedly fed concerns that Chinese hackers could abuse similar holes to steal secrets from AI labs. Alex Stamos, chief information security officer at Censys, pointed to the broader problem of how companies manage the third party software they plug into.

The role reversal stings. Anthropic's tools are usually the assistant in AI driven hacks, not the target; the same week, the company disclosed that Claude had reached aggregate Georgia vote count data through a loophole in an old state website. Now the lab that sells itself on safety has been reached through the most boring part of its stack.

Some offers on this page may be paid placements or contain affiliate links.