A DOGE-linked startup says its AI agents breached Anthropic in hours. The weak point was a vendor, not the model

Cathedral is a cybersecurity startup founded months ago by former members of Elon Musk's now-disbanded Department of Government Efficiency (DOGE). It says its AI agents broke into internal systems at Anthropic, one of the leading frontier AI labs. According to The Washington Post, Cathedral says the agents exploited vulnerabilities in business software. Through that software they reached meeting transcripts, salary details, job offers and Slack messages, all in less than 12 hours.

Anthropic tells it differently. A spokesperson told the Post that Cathedral reached only a "limited set" of sales, HR and IT systems. The company says Cathedral spent days trying to get into Anthropic's own software, gave up, and went after a business tool Anthropic uses instead. "Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day," the spokesperson said. Anthropic added that it has "no evidence that anyone exploited these vulnerabilities outside of Cathedral."

The context makes the story bigger. Investors already value Cathedral at $1.4 billion. It has raised $160 million and works for at least three federal agencies. Marc Andreessen, cofounder of Andreessen Horowitz, sits on its board. An unnamed Trump administration official told the Post the report caused alarm inside government: "if a bunch of kids who have just started a company can do this, then potentially, the Chinese aren't far behind." It also lands in an anxious month. Several labs have admitted this year that their models escaped sandbox environments, the isolated test setups meant to contain them. And a Saudi national was arrested in October, accused of bugging an OpenAI executive conference room in San Francisco.

Both accounts agree on more than the headlines suggest. Anthropic's own security held, at least by its own account and by Cathedral's version of the timeline. Neither side disputes that the way in was a third-party tool. Experts quoted in the coverage call this a glaring gap in how AI developers manage software suppliers. That is the important finding. A frontier lab's attack surface is not only its model weights or its code. It is every HR platform, sales tool and chat system it plugs into. AI agents are very good at the dull work of checking every one of those doors until one opens.

Our reading: this fits a thesis we have held for months. The near-term danger of agentic AI is not a distant superintelligence. It is that reconnaissance and intrusion become something you can automate. Something that once took a skilled team weeks now takes software hours, and it scales. Treat Cathedral's claims with care, though. A young, richly valued security company announcing a breach of a famous lab is also running a very effective sales pitch. Only the parties have described what was accessed. In a dispute like this, attribution matters more than the headline.

The longer-term picture is more encouraging than the alarm suggests. The same agent capability that finds a weak vendor in 12 hours can be pointed at your own supply chain before someone else does it. In this case, monitoring caught the activity and access was cut the same day. The lesson for companies is practical. Defenders need to work at the same speed as AI attackers, and vendor security has to be checked continuously, not once a year. Labs that sell security-grade AI should be the first to show they can do it themselves.