Startup Cathedral found access to Anthropic's data in less than 12 hours, raising security concerns at AI companies.

Cathedral, a startup founded by former employees of the US Department of Government Effectiveness (DOGE) in mid-2026, said this week that it had penetrated Anthropic's internal network in a bug bounty program.

According to Cathedral, after less than 12 hours of operating the AI ​​agent, the team of researchers found a link to access Anthropic's internal data, including meeting records, salary information, job offer letters, and Slack messages discussing advanced AI models.

Anthropic later confirmed that Cathedral had access to "a limited number" of sales, human resources and information technology systems, but not to user conversations in the Claude model. The model's source code is also not compromised.

The company has now blocked the links discovered by the research team, and notified federal officials about the incident. Cathedral spent days trying to hack directly into its software before turning to a third-party tool, a company spokesperson said. This person added that Cathedral's actions "significantly go beyond" the scope of the bug bounty program.

Washington Post quoted a senior official in the administration of US President Donald Trump that information that Cathedral successfully penetrated the Anthropic system had spread within the government, raising concerns about national security.

This person shared that he was extremely surprised because it took very little time for the startup to access the sensitive system of a company that controlled key technology "almost at the level of nuclear weapons". He is worried that if a group of young people starting a company can do this, then an elite team from another country may soon achieve similar results.

Anthropic's system was infiltrated amid many security-related incidents occurring in the US. Earlier this month, the FBI arrested an employee of OpenAI, Anthropic's rival in the artificial intelligence race, for allegedly placing a recording device in the board of directors' meeting room. Last month, hackers attacked OpenAI with the help of chatbot Claude, warning that the AI ​​industry was not ready to deal with the security risks created by its own technological power.

Heath Mullins, director of technology evangelism at cybersecurity company ExtraHop, said the Cathedral breach shows that even one of the leading AI companies can be attacked.

"AI vendors are becoming big targets because so many organizations now build workflows around their platforms. When a handful of platforms play a central role in the operations of many businesses, a single breach can become a supply chain problem for everyone involved," he told The Independent.

Thu Thao summary