'A bunch of kids who just started a company': ex-DOGE startup's AI agents got inside Anthropic in under 12 hours

"If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind," a senior Trump administration official told The Washington Post on Oct 26. He was talking about a report from Cathedral, a security startup founded by former DOGE staffers, whose AI agents found their way into Anthropic's internal systems in less than 12 hours.

According to a draft report reviewed by the Post, Cathedral's researchers exploited vulnerabilities in third-party business software Anthropic uses for sales and administration, finding paths to meeting transcripts, salary and offer details, and Slack messages discussing advanced models. The testing ran under Anthropic's bug bounty program.

Anthropic confirmed the researchers accessed "a limited set" of sales, HR and IT systems but not customer conversations with its models, code or model weights. "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day," it said, adding that it disabled the vendors' software until fixes were confirmed. It also said Cathedral overstated the national security implications and didn't fully follow program rules.

"They found something big here," said Cognition CISO Alex Stamos, while calling third-party app risk "a humongous problem for everybody." Palantir CTO Shyam Sankar called it "an undeclared emergency" on X. Cathedral has raised $160 million at a $1.4 billion valuation.