AI startup claims it hacked Anthropic in 12 hours, gains access to employee details and internal messages

Date:
Wed, 28 Oct 2026 15:25:00 +0000

Description:
Agents found a way in through third-party business software, but Anthropic is saying its bug bounty rules were broken.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter AI startup Cathedral used autonomous agents to breach Anthropic systems through weaknesses in third-party software Agents accessed HR, sales, and IT data, exposing limited customer and partner information Incident highlights how AI-powered attackers can rapidly exploit vendor weaknesses despite strong internal defenses An AI startup seemingly gave Anthropic a taste of its own medicine when it used AI agents to break into the company and expose sensitive data.

The company in question is called Cathedral, which was founded by former members of the defunct US Department of Government Efficiency (DOGE), a US government initiative established to reduce federal spending and bureaucracy, while modernizing government technology and operations. Anthropic is running
a two-fold bug bounty program through HackerOne. One part is focused on finding technical flaws in Anthropics systems, while the other is an invite-only program that rewards researchers for finding universal jailbreaks that bypass Claudes safety protections. Latest Videos From TechRadar Watch full video here:

Cathedral apparently shared its results with Anthropic through the bug bounty program. After its human researchers unsuccessfully tried breaking in for a few days, they deployed AI agents which took less than 12 hours to find a way in, by exploiting flaws in third-party business software. Violating the rules After accessing the companys network, the agents accessed meeting
transcripts, information on salaries and job offers, as well as Slack messages. Employee conversations with Claude were not exposed, it seems. You may like Anthropic reveals Claude AI model hacked three companies during
tests so how worried should we be? White hat hackers just breached OpenAI using Anthropic's Claude in less than 72 hours and it is a case study in
just how fast AI is advancing Googles Gemini hacked three companies during Irregular AI capture-the-flag testing agents broke containment and guessed passwords to hack computer systems

Anthropic confirmed the news, saying Cathedral accessed a limited set of sales, human resources, and IT systems, and compromised contact information and basic user account records belonging to certain customers and partners. Source code and AI model weights were not accessed.

Our monitoring flagged some of Cathedrals activity before they reported it to us, Anthropic said in a statement shared with The Washington Post . We shut off their access the same day. Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news
and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

According to Gizmodo , Anthropic accused Cathedral of violating the programs rules by failing to disclose the full extent of its activity. We dont know if that means Anthropic wont release the payment for the bounty, but it sure sounds like it.

Paying the bounty could be the least of Anthropics concerns, though. The company is currently gearing up for its Initial Public Offering (IPO), with a valuation of $1.4 billion. Leaking sensitive data to anyone, including white hat hackers, is definitely not a good signal. A 'bunch of kids' wreaking
havoc The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a
wake-up call for every company in America, the Washington Post cited Cathedrals report as saying. What to read next Rogue AI agents arent flukes, theyre patterns AI agents are inside the enterprise are your security foundations ready for them? Chinese hacker hits over 100 company websites using AI agents Deere and SharkNinja among top brands affected in attack

At the same time, a senior Trump administration official allegedly told Via The Independent that if a bunch of kids who have just started a company can
do this, then potentially the Chinese arent far behind.

Cathedral can hardly be described as a bunch of kids - it is an AI startup focused on offensive and defensive cyber operations for the US military and government. Its founders include Gavin Kliger (former Pentagon chief data officer), Luke Farritor (best known for helping decipher ancient Roman
scrolls using machine learning), Marko Elez (former SpaceX staffer), and Jack Stein (apparently worked as an investment banking associate at Salem Partners before joining DOGE).

The cybersecurity community had something to say about it. Jacob Krell,
Senior Director for Secure AI Solutions & Cybersecurity at Suzu Labs, wasnt particularly phased, saying if third-party vendors are a risk everywhere,
then theyre a risk at Anthropic.

"Cathedral's agents got into Anthropic the same way attackers get into everyone else, through the vendors, Krell said. Security maturity is capped
by the weakest vendor you integrate with, and no amount of in-house engineering changes that."

Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, praised Anthropics response: "Anthropic deserves credit for reporting that its monitoring detected some of the activity and for taking containment measures. But the real measure of remediation is independent verification that those attack paths are closed. We need to stop confusing a successful patch with a verified security outcome. Otherwise, we're just closing the front door and hoping nobody discovered the spare key." The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/ai-startup-claims-it-hacked-anthropic-i n-12-hours-gains-access-to-employee-details-and-internal-messages


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)