Cathedral says its AI agents breached Anthropic through business software

The route ran through business software

Cathedral says it first tried for several days to breach Anthropic’s own software, then shifted to a business application used by the company. Anthropic says it disabled the startup’s access the same day it learned of the breach.

The company said it has no evidence that anyone other than Cathedral exploited the vulnerabilities. That limits what can be concluded about wider exposure, but it does not resolve the underlying concern: security controls can be bypassed through the vendors and tools connected to an AI lab’s systems.

Experts cited in the report said AI developers do not adequately control the security of third-party software providers. A Trump administration official, speaking anonymously to The Washington Post, said Cathedral’s report had alarmed the government. The official argued that if a group of young people who had only recently founded a company could do this, Chinese hackers might not be far behind.

A young company with powerful backers

Cathedral was founded only a few months ago. Investors have valued it at $1.4 billion; it has raised $160 million and won contracts from at least three federal agencies.

Its board includes Marc Andreessen, co-founder of venture firm Andreessen Horowitz. That connection points to ties with people around the Trump administration and former DOGE staff from Elon Musk’s network.

Concerns about AI-assisted espionage have also sharpened after a Saudi citizen was arrested earlier this month on suspicion of installing a listening device in an OpenAI executive’s conference room in San Francisco.

The unanswered part

I think the more consequential detail is not Cathedral’s claim about speed, but Anthropic’s account of the path in. The announcement leaves open which business software was involved, what vulnerabilities were exploited and whether other customers could be exposed. Without those details, the incident is a warning about supplier security, not a measure of how broadly the weakness reaches.

Anthropic says its monitoring detected some activity and that access was cut off the same day. But a response that contains one incident does not answer the harder question: how much visibility can AI labs have into the security of software they depend on?