A Months-Old Company Got Inside Anthropic in 12 Hours
The Washington Post reported on October 26 that cybersecurity startup Cathedral told Anthropic its AI agents had entered Anthropic's internal systems in under 12 hours. The test ran under Anthropic's programme inviting external researchers to report vulnerabilities, and the entry point was a vulnerability in third-party administrative software.
- 01THE REPORT — On October 26, the Washington Post reported that Cathedral had entered Anthropic's internal systems in authorised testing.
- 02THE PATH — Entry came via third-party administrative software vulnerabilities, reaching meeting notes, compensation data and internal messages.
- 03THE BOUNDARY — Anthropic said customer conversations, model responses, source code and weights were not touched.
WHAT HAPPENEDWhat Happened
Cathedral's route in was not the model itself: its AI agents exploited vulnerabilities in third-party administrative and sales software, starting from authorised testing under Anthropic's bug bounty programme, and reached meeting notes, compensation and hiring details, and internal messages discussing advanced models. The test ran within its authorised framework; speed was the new variable, at under 12 hours.
Anthropic's response drew the boundary: what was affected was a limited set of sales, human resources and IT systems containing business contact information and basic user account records; customer conversations, model responses, source code and model weights were not touched. The company said its monitoring systems had detected part of the activity before Cathedral reported it, cut off access the same day, and disabled the affected software until the vendor ships a fix.
THE WEAK LINKThe Hardest Wall Is Not Necessarily the Weakest Link
The systems holding model weights and source code are heavily hardened, yet everyday office software connects to the same organisation. An attacker does not need to breach the strongest vault, only to find a side door connected to it, and third-party administrative software is that door.
This holds for every frontier laboratory: the security level is set not by the strongest vault, but by the weakest trusted system connected to it. Cathedral's case turns that abstraction into a timed, measured result.
THE DISPUTEBetween Authorised Testing and the Loss-of-Control Narrative
The disagreement between the two sides is worth recording in full: Cathedral described the incident as a serious gap between offensive and defensive capability; Anthropic said Cathedral exaggerated the national security implications and did not fully follow the vulnerability testing rules. Same facts, two characterisations.
The dispute itself is information: finding vulnerabilities in authorised testing is expected, but how tester and tested publicly characterise the result directly shapes public judgment of a laboratory's security capability.
THE SPEEDSpeed Is the Real Variable in This Incident
Under 12 hours is not a showpiece number; it is a cost number. When AI agents can work continuously and try paths automatically, the defender's human response tempo is stretched. Exploration that once took a team weeks can now be done within a working day.
The defence must be measured by speed too: Anthropic says it cut off access and disabled the software the same day. The elapsed time across detect, characterise and cut off is the metric the next company will actually be benchmarked against.
THE SHIFTWhat Changed
SIGNAL JUDGMENT — ANALYSISSecuring the Model Is Not Securing the Company
The lesson of the Cathedral incident is not about model security but organisational security: the most sensitive assets may be locked down well, while the everyday systems connected to them are not treated the same. Tokenta Signal's judgment is unchanged: security audits in the AI era must expand from the model itself to the whole company's software inventory.
WHAT REMAINS UNCERTAINWhat Remains Uncertain
EVIDENCEEvidence
The original report confirms the incident's key points: the authorised testing framework, under 12 hours, third-party administrative software vulnerabilities, meeting notes and compensation data, and Anthropic's response that customer conversations and model weights were not touched.
PRIMARY SOURCESPrimary Sources
- Daily AI Brief: Cathedral Researchers Reached Anthropic Internal Systems in 12 Hours
https://dailyaibrief.com/news/cathedral-researchers-access-anthropic-internal-systems-9tuR4rVu - AI Weekly: Ex-DOGE Startup Cathedral Breaches Anthropic in 12 Hours
https://aiweekly.co/alerts/ex-doge-startup-cathedral-breaches-anthropic-in-12-hours - MadRobot: Ex-DOGE start-up Cathedral got inside Anthropic in 12 hours
https://madrobot.blog/2026/10/26/ex-doge-cathedral-ai-agents-inside-anthropic-12-hours/
RELATEDRelated Intelligence
- Microsoft Winds Down Its Oracle AI Cloud Rental as Older Nvidia Chips Fall Behind
- An Unreleased Anthropic Model Proved an 18-Year-Old Quantum Conjecture, Machine-Checked in Lean
- IBM Unveils Quantum System Two in Chicago, Its Most Advanced Computer Yet, Powered by Nighthawk
- Vistra Posts $1.14B Q3 Profit as Power EBITDA Jumps Over 50%, Lifts 2026 Outlook