
Loading

Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.

A cybersecurity firm run by former members of Elon Musk’s Department of Government Efficiency (DOGE) says it has broken into internal data and messaging systems at Anthropic.
Summary
Perhaps even more surprising, though, is its claim that it did so in less than 12 hours. The startup is called Cathedral, and it classifies itself as an AI-driven cybersecurity firm with a focus on military applications. In July, Cathedral closed a $160 million funding round that valued the company at $1.4 billion, with investors including Andreessen Horowitz and Sequoia Capital.
How Cathedral got inside Anthropic Cathedral says it was able to penetrate Anthropic by taking advantage of vulnerabilities in business software the company uses—the same software used by many other businesses. Among the data it claims to have accessed were meeting transcripts, salary information, job offers, and Slack messages discussing its AI models. “The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” a report from Cathedral read, according to the Washington Post.
Anthropic has a program inviting outside cybersecurity companies to test its systems, so this would qualify as a white-hat hacking incident. The AI giant confirmed Cathedral had accessed “a limited set” of its systems and said it has since shut down those access points. The company also said that Cathedral spent multiple days unsuccessfully trying to break into its software directly before turning its attention to third-party business tools.
Despite that, Cathedral’s apparent success in breaching Anthropic has raised eyebrows in Washington. One unnamed official told the Post, “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.” Anthropic’s rocky relationship with the Trump administration The Trump administration and Anthropic have had a rocky relationship for some time. Donald Trump labeled Anthropic a “radical left, woke company” earlier this year and ordered all federal agencies to cut ties and stop using its products.
The Pentagon designated the company a “supply-chain risk,” prompting a lawsuit. In its S-1 paperwork leading up to its IPO, Anthropic warned potential investors about the potential impact of that tension, writing, “The political environment and our engagement with policymakers and public positions on AI regulation and safety could subject us to heightened scrutiny, political backlash, or disproportionate regulatory action.” Cathedral’s ties to Trump Cathedral’s founders include several people with close ties to the Trump administration. Among the former DOGE staffers running the company are Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein.
Kliger also previously served as the Pentagon’s chief data officer and was reportedly involved in the department’s skirmish with Anthropic. Elez was forced to resign from DOGE after he was linked to tweets containing phrases such as “normalize Indian hate,” “You could not pay me to marry outside of my ethnicity,” and “Just for the record, I was racist before it was cool.” (Musk rehired him despite the controversy.) The company is reportedly working on AI software it hopes to sell to the Pentagon, designed to bolster the military’s offensive and defensive cybersecurity capabilities to both guard against and attack adversaries such as China. Reuters also reports that Cathedral is looking to acquire a data center or partner with one for dedicated computing power.
The midterm elections could complicate those ambitions, though. Should Democrats regain control of the House or Senate, they could closely scrutinize contracts awarded to companies run by founders with especially close ties to Trump, potentially slowing Cathedral’s progress.
KazaSec's take
Incidents like this rarely start with the headline event itself, they usually trace back to an exposed remote-access endpoint, an unpatched perimeter system, or a credential phished weeks earlier. The organizations that recover fastest are the ones that tested their defenses and their incident response plan before they needed them.
Coverage details
We've archived 167 other articles touching the same topic (tech) , see the full security news archive.
Related security advisories
Relevant from KazaSec
More coverage on this topic
We help organizations find and fix the gaps before they make headlines.