Cathedral, a startup founded several months ago by former DOGE employees, notified Anthropic in October that its researchers had gained access to the Claude developer's internal systems. This is evidenced by a draft company report obtained by industry media.
According to Cathedral, the penetration into the infrastructure where confidential data and corporate correspondence are stored took only 12 hours. The key attack vector was vulnerabilities in third-party software for sales and administrative tasks — precisely the class of solutions used en masse by dozens of companies worldwide.
The incident is notable for several reasons. First, it demonstrates that the security perimeter of even leading AI developers remains dependent on the chain of third-party software suppliers — the so-called supply chain. Second, the speed of detecting the attack vector underscores how mature the toolkit of autonomous security researchers operating at the intersection of automation and artificial intelligence has become.
What's behind the attack
Cathedral positions itself as a company specializing in finding vulnerabilities using AI agents. The startup's founding by former DOGE members adds further context to the story: a team with experience in government structures is transferring its methods into commercial cybersecurity.
For Anthropic, the situation is sensitive: the company stores not only its codebase and research materials but also correspondence related to clients and partners. Any access to such data — even within the framework of responsible vulnerability disclosure — creates reputational and regulatory risks.
A separate question is the credibility of Cathedral's claims. At present, this concerns a draft report rather than results verified by an independent party. However, the very fact that such claims are becoming public signals a new stage of competition in the AI security market.
Cryptalist analysis: The incident highlights a systemic vulnerability of the entire generative AI industry — dependence on third-party SaaS solutions in the administrative perimeter. The cybersecurity market for AI infrastructure is receiving a powerful growth catalyst: demand for supply chain audits and autonomous researcher agents will grow at an accelerated pace. For investors, this is a signal to take a closer look at the AI-security segment as one of the most promising areas of the next cycle.