Cathedral used AI agents to breach Anthropic's internal systems in 12 hours, exposing compensation and Slack messages

Just moments ago, Anthropic was breached!

In just 12 short hours, the defenses of AI giant Anthropic were torn to shreds by AI agents.

Compensation data, hiring details, internal meeting transcripts, and even internal Slack messages containing discussions of the most advanced AI model secrets were all exposed to the intruders' view.

This is not only an "epic embarrassment" moment for Anthropic, but also a "von Neumann moment" for the global AI industry.

The US political world was shaken, White House officials exclaimed in shock, and top security experts began to weigh in.

Blitzkrieg: 12 hours, AI agents breach defenses at light speed

First, to be clear: this was not an illegal hacker attack, but a security test.

The story began when Anthropic opened a security testing program, allowing external cybersecurity experts to conduct "stress tests" on the company's systems.

Offering bounties to find vulnerabilities is very common in the tech world.

But Anthropic never imagined that letting the wolf into the house this time would embarrass it so badly.

The attack was launched by Cathedral, a cybersecurity startup founded only a few months ago. They don't rely on manual grinding; they rely entirely on AI agents for automated penetration.

After running for less than 12 hours, a breach point emerged.

Those third-party enterprise software programs used for administrative management, sales follow-up, and daily office work became the most fatal Achilles' heel.

Following the security vulnerabilities in these ordinary business software programs, the AI agents crossed Anthropic's moat without bloodshed and penetrated directly into the internal system network.

According to a draft Cathedral report reviewed by The Washington Post, the intrusion directly touched Anthropic's sales, HR (Human Resources), and IT systems.

The data list is shocking, including meeting transcripts, compensation and hiring details, and internal Slack messages.

The most critical part is the internal Slack messages. Employees' chat records discussing Anthropic's advanced AI models on Slack were completely open.

In tech companies, Slack is effectively the "digital brain." Countless flashes of code logic, complaints about unreleased models, and analyses of competitors all flow here without reservation.

Gaining Slack access is equivalent to obtaining the company's "diary."

Fortunately, the core assets were preserved.

Anthropic officially rushed to "put out the fire" afterward. They confirmed the authenticity of the intrusion and admitted that Cathedral did access "limited data" in the sales, HR, and IT systems, including business contact information for some customers and partners, as well as basic user account records.

But Anthropic repeatedly emphasized one red line:

Messages customers sent to Claude were not leaked. Core code was not leaked.

Model weights were absolutely not touched.

Although the "nuclear button" is still there, the outer positions fell across the board within 12 hours, which is enough to make Anthropic lose face.

But being pointed at and cursed that its "defenses are like paper," Anthropic certainly could not swallow that.

While acknowledging the intrusion, Anthropic launched a fierce public relations counterattack.

Anthropic claimed that before Cathedral submitted its report, the company's monitoring system detected anomalous activity that same day and decisively cut off access.

Anthropic accused Cathedral of exaggerating the "national security implications suggested" by these findings. The subtext is: you just want to step on us to climb up, exaggerate, peddle your security products, and deliberately create panic.

In the draft report, a Cathedral spokesperson coldly left one sentence: "Researchers followed best practices in security research and kept data access to the absolute minimum."

The implication: not only did we get in, we also showed restraint; if we hadn't limited access, you would have lost everything long ago.

Alex Stamos, Chief Information Security Officer of AI coding startup Cognition and former director of the Stanford Internet Observatory, after reviewing Cathedral's report, delivered a devastating assessment:

They found a very serious problem. This is a very difficult problem to solve, but Anthropic could have done much better.

Fatal weakness: not at the core, but in the "supply chain"

Hackers don't need to confront your strongest security door head-on; they only need to win over the delivery guy who brings you takeout.

The fundamental reason Cathedral's AI agents were able to advance so smoothly is that they exploited vulnerabilities in "third-party enterprise software."

Today's AI giants often invest 99% of their security budgets and energy into protecting model weights and core algorithms. They have built impregnable "vaults."

But the company's HR still has to pay salaries, sales still has to follow up with customers, and employees still have to chat on Slack.

This requires connecting to a large amount of ordinary business software.

Once an ordinary administrative software program is torn open, it becomes a springboard for attackers to move laterally into the internal network.

Cathedral issued a warning:

The fact that weaknesses in ordinary enterprise software can endanger the infrastructure of the most advanced organizations should sound an alarm for every enterprise.

Emerging attack capabilities are growing stronger, while defense systems have not kept up.

Anthropic is famously serious about security.

This incident does highlight a question: in which areas and in what ways should AI companies use third-party SaaS services? At least for now, it seems there is no service that can truly put people at ease.

As early as last month, Anthropic employee Jacob Coxon issued a whistleblower warning by publicly resigning.

His words proved prophetic: "This is a gamble born of arrogance, and it should not have been launched from a private company's Slack."

And it is not just Anthropic. Earlier this month, the FBI arrested an OpenAI employee who had actually placed recording equipment in the company's executive meeting room.

Previously, OpenAI also experienced a similar incident—three researchers used Claude to chain-exploit two vulnerabilities and took over the ChatGPT and Codex accounts of multiple OpenAI employees.

The White House is shaken: a "countdown" for national security

If Cathedral had breached Anthropic, that would be called a commercial test. If a foreign intelligence agency had breached Anthropic, that would be called a national disaster.

This test report is currently being urgently circulated among senior U.S. government officials.

An anonymous senior Trump administration official expressed extreme shock and concern in an interview.

He could not believe that a company holding "materials that almost reach the level of nuclear weapons" had its sensitive systems penetrated so quickly and so deeply.

One remark from this official sent a chill down the back of all of Washington:

"If a group of young people who have just founded a company can do this, then others may not be far from doing the same."

This is precisely why the Trump administration is eager to cooperate with Cathedral and simulate AI adversarial scenarios.

A $1.4 billion "former DOGE" special forces unit

What exactly is the background of Cathedral, the company that has cornered Anthropic?

It is a "digital special forces unit" armed to the teeth, and it carries a strong official background.

We do not sell fear; we provide clear judgment.

We simulate the thinking and actions of real attackers, allowing defense teams to train in an environment close to real combat, and enabling management to understand honestly their own ability to withstand attacks and restore operations.

Founder Gavin Kliger has an extremely formidable résumé. After serving in the U.S. "Department of Government Efficiency" (DOGE), he went on to serve directly as chief data officer of the Pentagon (the U.S. Department of Defense).

These people are tough operators who have truly seen top-level data confrontation within the machinery of state violence.

Just months after its founding, the company has already raised $160 million from investors, and its valuation has soared directly to $1.4 billion.

Marc Andreessen, the godfather of Silicon Valley venture capital, and Shaun Maguire personally sit on the company's board.

According to a senior Trump administration official, three U.S. federal agencies have recently signed cybersecurity service contracts with Cathedral.

During his time at the Pentagon, Gavin Kliger repeatedly participated in a "scenario simulation" at the top levels of the U.S. government: what would happen if some foreign country obtained the research materials of a frontier AI lab in Silicon Valley?

Now, he has resigned and gone into business, founding Cathedral, and in just 12 hours he personally proved to all of America that this doomsday scenario, which previously existed only in war games, is only half a day away from reality.

References:

This article comes from the WeChat public account "Xinzhiyuan" (ID: AI_era), author: ASI Revelation, published by 36Kr with authorization.