Ex-DOGE startup Cathedral says it got inside Anthropic’s systems; OpenAI now works with the same firm

Cathedral’s claim

On Oct. 26, Washington Post reporter Elizabeth Dwoskin said Cathedral, a security firm founded by former DOGE staff, had gotten into Anthropic’s systems. As reported by Gizmodo, the draft report the paper reviewed says the firm’s AI agents found paths into Anthropic’s internal systems by exploiting flaws in third-party business software. Cathedral says this took less than 12 hours and reached meeting transcripts, salary and job offer data, and Slack messages. The Post’s article could not be opened for this piece, so the details come from Gizmodo.

Anthropic’s correction

Anthropic confirmed that the researchers reached a limited set of its sales, human resources and IT systems, along with customer and partner business contact information and some basic user account records. The company says they did not reach Claude users’ conversations, source code or model weights. It also says the team broke the program’s rules by not disclosing the full extent of its activity.

Logan Graham, who leads Anthropic’s Frontier Red Team, posted a correction on X that evening. He says the work did not take 12 hours: there were several days of attempts, after which two third-party vulnerabilities were exploited. Cathedral reported one, and Anthropic identified the other itself and cut off access. Graham wrote that the approach fell outside the company’s safe harbor policy, but that he was grateful the issues were found. He added that adversaries will use whatever models they can, will probe targets with agents around the clock, and that models roughly 0.5 to 1 generations behind the frontier can do this.

Logan Graham@logangraham

I think this story is important because it tells us about the future of cybersecurity (and of course what we can do better at Anthropic). But some of the Washington Post story / reaction on X is wrong. A few corrections:
- it didn’t take 12 hours. we saw several days of attempts. After these attempts, they exploited two 3rd party vulnerabilities, one they reported and the other we identified independently (and cut off access)
- nothing came close to our most sensitive systems, like model weights or Claude conversations
- this wasn't an ordinary bug bounty finding – this involved exploiting 3rd parties and accessing data. While this is unusual and out of scope of our safe harbor policy, we’re grateful these issues were found

From my researcher POV, the event is important because I'm concerned this is what the future will look like. Adversaries will use whatever models/tools they can. They’ll target everything with agents 24/7. They’ll hit your dependencies. I think models ~0.5-1 generations behind the current frontier can do this. And these are the dumbest models your adversaries will ever use!

So, what to do? You probably want to red team yourself all the time. Current models are *very* creative. I also think we should redesign software / systems so that you’re fundamentally less exposed. (We put out some research recently on formally verifying software and reducing attack surfaces; my mental model is basically “secure code is cheap to write now, so why not rewrite everything”)

Elizabeth Dwoskin @lizzadwoskin

EXCLUSIVE: In less than 12 hours, a group of ex-DOGE cyber researchers were able to penetrate Anthropic’s systems using AI agents — including Slack channels where the most sensitive models are discussed.
This is just weeks after
Anthropic whistleblower Joseph Coxon charged the

OpenAI’s partnership

On Nov. 2, OpenAI said it would work with Cathedral on its next internal security sprint. According to the company’s post, Cathedral’s researchers will use OpenAI’s models alongside OpenAI’s own teams to challenge its defenses. Cathedral co-founder and CEO Gavin Kliger said OpenAI was “setting an important example” by partnering with outside security firms. Gizmodo’s headline says the firm’s team was hired, though OpenAI’s post describes a partnership. In its last sprint, OpenAI put 25% of its product engineers on finding and fixing weaknesses, using Codex to investigate findings and prepare patches.

Bug bounties and Cathedral

In a second post the same day, OpenAI said it was more than quadrupling, on average, the midpoint of its reward ranges for medium, high and critical findings. A critical flaw in a core product such as ChatGPT, Codex or the API Platform now pays up to $30,000, with exceptional findings capped at $100,000, or $172,000 with bonuses. A five-tier loyalty bonus and a quality multiplier were added, and awards from the previous 30 days will be topped up. Cathedral was founded by Kliger, Luke Farritor, Marko Elez and Jack Stein; per Gizmodo it was valued at $1.4 billion in a $160 million round led by a16z and Sequoia.