Cathedral ran a security test on Anthropic last week, and its AI agents slipped into Anthropic's own internal systems4. They did it through Anthropic's own bug bounty program, the contest that pays outside hackers to find real holes. Anthropic confirmed the reach.
Its agents got into sales, HR and IT systems, which held business contacts and basic account records5. Model weights, source code and Claude's chats stayed closed.
A louder version is racing around the AI industry instead. Will Depue, formerly of OpenAI, posted that Cathedral reached far more1. Anthropic's own head of red-teaming answered him within hours3. Two named people now disagree in public about one test.
What Depue Says Cathedral Reached
Depue posted just after midnight on Wednesday. "anthropic is massively underplaying the recent security breach. i'm hearing cathedral achieved full administrator access of the slack workspace (see every message, log in as arbitrary users) where literally every single research secret is contained," he wrote1.
That claim runs well past what Anthropic has confirmed. Full Slack administrator rights would reach years of chat history, far outside one sales database. Depue framed the stakes for every AI lab at once.
"to those unfamiliar: Ant & OAI," he added, naming Anthropic and OpenAI together1. His post had drawn 2,283 likes and 75 replies by Oct. 28.
What Anthropic Disputes
Logan Graham runs red-teaming at Anthropic. His team tries to break Anthropic's own systems first, before outsiders do. He corrected the record once before Depue's post, and once after it.
"it didn't take 12 hours. we saw several days of attempts," Graham wrote2. Cathedral's own account puts the full break-in under 12 hours4. Graham puts the real clock closer to a week of failed tries first.
Graham then answered Depue directly. "I'm not sure what rumors you're hearing, but your facts here are wrong. obviously, we take it extremely seriously, and we're dealing with it sensitively, which is why I'm not going point by point," he wrote3. He skipped a full rebuttal, choosing quiet work over a public fight.
will depue@willdepueanthropic is massively underplaying the recent security breach. i'm hearing cathedral achieved full administrator access of the slack workspace (see every message, log in as arbitrary users) where literally every single research secret is contained
to those unfamiliar: Ant & OAI…
Anthropic made one more charge. Cathedral broke the bug bounty program's own rules, it said, by hiding part of what it tried4. Two flaws apparently opened the path in.
Cathedral's report named one5. A tester who finds two flaws and reports one leaves a defender guessing at the rest.
Cathedral and Anthropic Agree on 6 of 9 Systems Named in the Dispute
Systems named in reporting on Cathedral's test of Anthropic, grouped by whether both companies agree what happened, as of Oct. 28, 2026
Each cube is one named system. Blue cubes are systems both sides say Cathedral reached, gray cubes are systems both sides say stayed closed, and magenta cubes are the three systems Cathedral names alone.
Sources: Will Depue on X [1]; Cyber Security News [4]; The Decoder [5]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Agree: sales, HR, IT reached | 3 |
| Agree: code, weights, chats closed | 3 |
| Disputed: Slack, salary, notes | 3 |
| Whole | 9 |
Nine named systems sit at the center of the dispute. Both sides agree on six. Sales, HR and IT records: reached.
Source code, model weights and Claude chats: untouched. The other three, Slack administrator access, salary data and meeting transcripts, are Cathedral's claim alone.
Why Four DOGE Alumni Went Looking
Cathedral has four founders. Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein all worked for the Department of Government Efficiency6. Kliger later became the Pentagon's chief data officer.
He held that post until April8. There he sat inside a real fight between the Pentagon and Anthropic over Claude's military use terms.
A federal appeals court ruled for the Pentagon on Sept. 25, letting it drop Anthropic from its supply chain over those terms8. Cathedral's founders then left government work to build a startup that sells AI-driven offense and defense tools back to that same military6.
Investors backed the pitch at a striking price. Andreessen Horowitz and Sequoia Capital led a $160 million round in July that valued Cathedral at $1.4 billion6. Both firms took board seats. The company's product revenue stays undisclosed.
Cathedral's Backers Value It Almost 9 Times the Cash They Put In
Cathedral's July 2026 funding round, in billions of dollars
The left column is the new money Andreessen Horowitz and Sequoia Capital put in. The right column is what that round says the whole company is worth.
Source: TheNextWeb [6]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Funding raised | $0.16B |
| Valuation set | $1.40B |
The Outside Read
Alex Stamos answers to a third company, apart from this fight, and he runs security at the AI coding startup Cognition. He once ran it at Facebook7. His read lands between Depue's alarm and Anthropic's calm.
"They found something big here," Stamos said of Cathedral's test7. He named a bigger danger than one company's mistake. Connecting outside software to core systems "is a humongous problem for everybody," he said.
Stamos backs Cathedral's broad point. He stops short of Depue's specific one. Software a company buys from someone else still opens doors into the software it builds itself. That holds true whether Cathedral's agents read one Slack message or a thousand.
Anthropic's own government customers run drills for exactly this path today. Military cyber units play the same capture-the-flag games Cathedral's founders once watched from inside the Pentagon. They chase flaws in connected systems before an enemy finds them first.
What to Do
A security lead at any company should ask its AI vendor for a third-party software list. Ask for it alongside the model's safety card. Cathedral found its way in through connected business tools, apart from Claude itself. That pattern repeats at nearly every company that buys software instead of building it.
Write down your bug bounty program's disclosure rules. Hold every tester to them. Anthropic's complaint against Cathedral was a process complaint: one flaw reported, a second one skipped. Clear, enforced terms catch that gap before a headline does.
By the Numbers
- $1.4 billion: Cathedral's valuation after a funding round that closed in July 20266.
- $160 million: the cash Andreessen Horowitz and Sequoia Capital put into that round6.
- 12 hours: Cathedral's count of the time its agents needed to reach internal Anthropic systems4.
- Several days: Logan Graham's count of the same stretch, most of it spent failing before a third-party flaw opened a path2.
- 2,283 likes: the tally on Depue's post calling Anthropic's account "massively underplaying" the test, as of Oct. 281.
- Four founders: Cathedral's co-founding team, every one a veteran of the Department of Government Efficiency6.
What to Watch
Watch for Anthropic to publish a fuller account of what its monitoring flagged, and when. That detail would settle Graham's timeline against Cathedral's. A second signal is whether Cathedral documents the vulnerability Anthropic says it skipped. Another lab inviting the same kind of test would show whether Stamos's warning reaches past Anthropic alone.
Sources
- Will Depue (@willdepue), "anthropic is massively underplaying the recent security breach," X, Oct. 28, 2026, https://x.com/willdepue/status/2115236836092313988
- Logan Graham (@logangraham), "it didn't take 12 hours. we saw several days of attempts," X, Oct. 27, 2026, https://x.com/logangraham/status/2114849047953670635
- Logan Graham (@logangraham), "I'm not sure what rumors you're hearing, but your facts here are wrong," X, Oct. 28, 2026, https://x.com/logangraham/status/2115268617717830109
- Guru Baran, "Researchers Use AI Agents to Breach Anthropic's Internal Systems in Just 12 Hours," Cyber Security News, Oct. 26, 2026, https://cybersecuritynews.com/anthropic-internal-system-breach/
- Matthias Bastian, "AI agents hacked Anthropic, maker of arguably the most capable AI models for cyberdefense," The Decoder, Oct. 28, 2026, https://the-decoder.com/ai-agents-hacked-anthropic-maker-of-arguably-the-most-capable-ai-models-for-cyberdefense
- Ana Maria Constantin, "Four former DOGE staffers raised $160 million at a $1.4 billion valuation for an AI military cyber startup," TheNextWeb, July 23, 2026, https://thenextweb.com/news/cathedral-doge-alumni-military-cyber-startup-1-4-billion
- The Outpost, "AI-Driven Cybersecurity Startup Cathedral Breached Anthropic in Under 12 Hours," Oct. 26, 2026, https://theoutpost.ai/news-story/ai-driven-cybersecurity-startup-cathedral-breached-anthropic-in-under-12-hours-32653/
- ER Velasco, "Ex-DOGE Startup Accessed Anthropic After Pentagon Clash," The Deep Dive, Oct. 26, 2026, https://thedeepdive.ca/ex-doge-startup-accessed-anthropic-after-pentagon-clash/