Cathedral says AI agents got inside Anthropic's systems in under 12 hours

Cathedral, a months-old cybersecurity startup, says its researchers penetrated sensitive internal data and messaging systems at Anthropic, the maker of the Claude chatbot, and that AI agents did it in under 12 hours. The claim comes from a draft report by Cathedral that The Washington Post reviewed and reported today.

That is a striking sentence. It is also, for now, a sentence about a document, not about a verified event.

What the report says

According to the Post, Cathedral recently told Anthropic about the intrusion, and the startup was founded by former DOGE staffers. The account names neither the founders nor the systems touched beyond "sensitive internal data and messaging systems."

That is most of what is on the record. The headline number is the 12 hours, and it is already wobbling: one headline says "under 12 hours," another says "just 12 hours." Those are different claims. "Under 12" could mean 3 or it could mean 11 and a half. "Just 12" is a round number doing the work of a measurement.

A clock only means something when you know where it started. Did it start with zero knowledge of the target, or with access, credentials or a cooperative insider? Did it include setup, tooling and human review of what the agents turned up? The reporting we have does not say.

What is not in the report

The open questions are not small ones:

• Authorization. The account does not say whether this was part of a bug bounty or an agreed red-teaming exercise, or whether it was unsolicited. That is the difference between a security test and a break-in with a press strategy.
• Method. No attack vectors, vulnerabilities or techniques are described. "AI agents" is a category, not a methodology.
• Scope. We do not know which internal data and messaging systems were accessed, or what was actually read, copied or changed.
• Anthropic's response. The account does not include an official reply from Anthropic to Cathedral's findings.
• The people. The founders are described only as former DOGE staffers. No names are given.

Why the agent angle matters

The interesting part of the story is not Cathedral's résumé. It is the stated mechanism. If a months-old company can credibly say that agents compressed an intrusion into less than half a day, the question is how quickly agentic tools can enable attacks on leading labs, which is the framing this story arrives with.

But "credibly" is carrying the whole sentence. Agents could have done the heavy lifting. They could also have been one tool among many, with experienced humans steering, and the write-up emphasizing the agents because that is the part that gets a newspaper to call back. The account does not provide enough detail to distinguish those possibilities.

There is also a plain irony worth a footnote. The target of this claimed AI-agent intrusion is itself an AI company: Anthropic, the maker of Claude. Whether Cathedral's agents ran on Anthropic's own models, someone else's, or a mix is not stated. It would be a useful detail.

What to watch

First, authorization. If this was a sanctioned test and the claimed timeline holds up, the story becomes one about the speed of an agent-assisted security test, and the discussion is about defense. If it was not sanctioned, the story is also about norms: who gets to test a frontier lab's systems, and what a startup owes the lab before it talks to a newspaper.

Second, a timeline you can reproduce. A claim of "under 12 hours" should come with a record of when the clock started and stopped, what access the agents began with, and what they did in between. Whether Cathedral publishes anything beyond the draft the Post reviewed is the thing to check.

Third, Anthropic's statement. A company that has been told its messaging systems were penetrated has a clear next move, and the public version of it will say a lot: confirmation, dispute, or a careful sentence that does neither.

The founders' DOGE background is context readers will want, but it is not evidence. It does not make the claim more or less true. Until the details arrive, the accurate summary is short: a young company says its agents got in quickly, the Post saw its draft, and the account leaves key verification questions unanswered. Show me the eval, not the vibe.