Anthropic provided a more limited account of the incident. The company confirmed that Cathedral accessed portions of its sales, human resources and IT infrastructure containing business contact information, customer and partner details, and basic account records. However, Anthropic maintained that the researchers could not reach Claude conversations, AI model weights or proprietary source code.
The company also challenged Cathedral's account of how quickly the vulnerabilities were discovered. According to Anthropic, the researchers had previously spent several days attempting unsuccessfully to penetrate its software directly before identifying weaknesses in outside business applications.
Anthropic said its security monitoring had already detected some of the activity before Cathedral submitted its findings. The company terminated the researchers' access on the day of disclosure and suspended the affected third-party applications until their vendors issued security fixes. It reported finding no evidence that other parties had exploited the vulnerabilities.
The companies also disagree over whether the testing complied with Anthropic's security research requirements. Anthropic accused Cathedral of failing to disclose the full extent of its activities and exaggerating the potential national security consequences. Cathedral maintained that it accessed only the information necessary to demonstrate the weaknesses.
Cathedral was established this year by former members of the Department of Government Efficiency, including Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. The startup develops AI-powered cybersecurity technology with an emphasis on military applications.
In July, Cathedral secured $160 million in financing at a $1.4 billion valuation, with investors including Andreessen Horowitz and Sequoia Capital. Marc Andreessen and Shaun Maguire, associated with the respective investment firms, serve on its board.
Kliger previously held the Pentagon's chief data officer position until April 2026 and was reportedly involved in the department's dispute with Anthropic. A senior Trump administration official said Cathedral has agreements with three federal agencies and is collaborating with the government on potential adversarial uses of AI.
The security findings have also attracted attention in Washington. According to the same official, the incident prompted concerns that foreign adversaries, including Chinese hackers, could exploit similar vulnerabilities in enterprise software to access sensitive systems at major AI developers.
“The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” Cathedral's report stated, according to The Washington Post.
The disclosure comes amid an ongoing conflict between Anthropic and the Pentagon over restrictions on military applications of Claude. Anthropic has refused to remove safeguards prohibiting fully autonomous lethal operations and large-scale domestic surveillance. On September 25, a federal appeals court ruled 2-1 that the Pentagon could bar Anthropic from its supply chain.
The incident also illustrates how AI agents are being deployed to identify security weaknesses across interconnected business systems. In another reported case, a Chinese-speaking hacker used agents powered by DeepSeek and Anthropic's Claude Code to compromise more than 100 business websites during a campaign targeting over 1,200 sites. The amount of information potentially stolen remains uncertain.
Anthropic has separately been developing AI-assisted defensive security tools. By October 2, the company reported identifying and disclosing 6,157 vulnerabilities affecting 591 open-source projects through its own automated security research.
For Cathedral, the findings demonstrate how AI agents can discover exploitable weaknesses in software used by major technology companies. Anthropic, meanwhile, maintains that its most sensitive AI assets remained protected and that the vulnerabilities were confined to a limited group of third-party business systems.
Although both companies acknowledge that unauthorized access paths were identified during the authorized research program, their accounts differ on the information exposed, the testing procedures followed and the broader implications of the incident.
This analysis is based on reporting from Gizmodo.
Image courtesy of Cathedral AI.
This article was generated with AI assistance and reviewed for accuracy and quality.
