Cathedral reaches Anthropic’s internal systems in 12-hour security test, report says

A security test reportedly gave Cathedral researchers access to Anthropic’s sensitive internal data and messages within 12 hours. The Washington Post disclosed the findings on October 26, citing a draft Cathedral report. Anthropic acknowledges access to some business systems, but says customer conversations with Claude, its source code and model weights were not exposed.

Cathedral is a months-old cybersecurity startup founded by former staffers of the US Department of Government Efficiency, or DOGE. It told Anthropic that its researchers had penetrated internal data and messaging systems, according to the draft reviewed by the Post.

The reported route ran through business software

Cathedral used AI agents to look for weaknesses in software Anthropic used for administrative and sales work, according to India Today’s account of the draft report. The researchers then reached internal information, including meeting transcripts and Slack messages. India Today reported that the agents ran for less than 12 hours before the researchers obtained access.

The activity took place under Anthropic’s programme for outside researchers to identify security vulnerabilities. That places the access within a security-testing exercise, rather than an incident attributed to an unidentified attacker. The precise technical chain remains unclear: no detailed explanation of the flaws or the steps used to exploit them is provided.

Workplace records, not the underlying models

Anthropic confirmed that Cathedral accessed a limited set of sales, human resources and IT systems. India Today described the exposed material as including employee information, salary details, job offers and internal messages discussing the company’s advanced AI models. Messages about models are distinct from access to the models themselves.

Anthropic’s account of the data boundary

• Exposed: business contact information for some customers and partners, along with basic user account records.
• Not accessed, the company says: customer conversations with Claude, model-generated responses, source code or model weights—the underlying parameters of its AI systems.

Those limits are Anthropic’s assessment of the exposure. The company also said it found no evidence that anyone other than Cathedral had exploited the vulnerabilities. That is a narrower statement than saying the software flaws could never have been used by another party.

Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day

Anthropic, in a statement quoted by India Today

Access closed, but the testing dispute remains

Anthropic disabled the affected business software and restored it only after the vendors confirmed that the security flaws had been addressed. The company also briefed federal officials. Its response therefore involved both shutting down the researchers’ access and waiting for fixes from the software suppliers before bringing the affected tools back.

The parties disagree about how the test was conducted and how to characterize its consequences. Anthropic said Cathedral had not fully followed the vulnerability programme’s rules because it failed to disclose all of its activity inside the company’s systems. Cathedral said it kept data access to the minimum required for its research.

Anthropic also argued that Cathedral overstated the national-security implications. India Today, citing the Post, reported that a senior Trump administration official said the findings had circulated within the government. Government attention and the company’s narrower description of the exposure are both part of the response; they do not resolve the disagreement over the incident’s significance.