Ex-DOGE Start-Up Says It Got Inside Anthropic in 12 Hours

Cathedral, a months-old cybersecurity start-up, recently told Claude chatbot maker Anthropic that its researchers had penetrated sensitive internal data and messaging systems at the AI company, The Washington Post reported on 26 October 2026, citing a draft report by Cathedral that the Post reviewed.

The Post’s headline says it took 12 hours for the start-up, founded by former DOGE staffers, to break into Anthropic. Cathedral raised $160 million at a $1.4 billion valuation in July, in a round led by Andreessen Horowitz and Sequoia Capital, Reuters reported, as summarised by The Next Web.

What the Post Reported

The Washington Post story, by Elizabeth Dwoskin and Gerrit De Vynck, is headlined “It took just 12 hours for an AI start-up founded by ex-DOGE staffers to break into Anthropic.” Its opening paragraph says Cathedral told Anthropic that its researchers had penetrated sensitive internal data and messaging systems, according to a draft report by Cathedral reviewed by the Post.

The rest of the article sits behind a subscription wall, and we read only the headline and that opening paragraph. We did not read any response from Anthropic in the article, and we found no statement from Anthropic on its website or its X account as of 26 October.

We separate what Cathedral says from what Anthropic has said. Only the first two rows come from text we read.

Who Cathedral Is

Cathedral is a stealth military cybersecurity start-up founded by four former Department of Government Efficiency staffers: Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein, The Next Web reported on 23 July, citing Reuters. Andreessen Horowitz and Sequoia Capital led its $160 million round at a $1.4 billion valuation and both took board seats.

Kliger served as chief data officer at the Pentagon, where he was involved in the department’s legal fight with Anthropic over how Claude would be used by the military, The Next Web reported. The company plans to secure US government contracts for AI-driven offensive and defensive cyber operations against adversaries including China, and had no disclosed revenue or contracts at the time of the round, the report said.

The IPO Window

The report lands as Anthropic prepares to go public. The Information wrote on 25 October that “Anthropic could make public the paperwork for its initial public offering as early as Monday,” 26 October, as our Update on Anthropic’s pre-IPO data reported.

Axios wrote on 26 October that liability is sure to feature prominently in the risks Anthropic and OpenAI spell out to shareholders as they prepare for public listings, and that Anthropic’s IPO is expected before Thanksgiving, as our Update on Meta’s legal bill reported.

Connecting the Coverage

Other AI-linked cyberattacks have been reported this month, though none of them is a claimed intrusion into Anthropic’s own systems. CrowdStrike said in a report on 7 October that an attacker who targeted South Korean financial organisations used ARTEX, an open-source AI penetration-testing tool developed in China, as our piece on the bank hacker reported.

In Japan, GMO Cybersecurity by Ierae said on 20 October that the same Artex tool was likely used in a wave of cyberattacks on Japanese companies. GMO Internet will pay all users a ¥5,000 goodwill payment, as our piece on the Korean bank hacks and its Updates reported.

The Structural Read

As we read it, the story rests on one document: Cathedral’s draft report, as reviewed by The Washington Post. Anthropic’s account was not in the text we could read, and we found no statement from Anthropic on 26 October.

As we read it, the timing carries the business weight: the Post’s story ran on the day The Information said Anthropic’s IPO paperwork could become public, and Axios wrote that liability will feature in the risks Anthropic spells out to shareholders.

As we read it, the founders’ history adds a second layer: Gavin Kliger was involved in the Pentagon’s legal fight with Anthropic over how Claude would be used by the military, The Next Web reported.

Three Implications

FOR ANTHROPIC’S LISTING The Information said the IPO paperwork could go public as early as 26 October, and Axios wrote that liability will feature prominently in the risks Anthropic and OpenAI spell out to shareholders.

FOR CATHEDRAL It was valued at $1.4 billion with no disclosed revenue or contracts at the time of its round, and plans to pursue US government contracts for AI-driven offensive and defensive cyber operations, The Next Web reported.

FOR SECURITY TEAMS CrowdStrike linked an AI penetration-testing tool to attacks on South Korean financial organisations, and GMO’s Ierae linked the same tool to attacks on Japanese companies, as our earlier pieces reported.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The analysis puts it this way: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”

As we read it, the Cathedral report touches two of those at once: national security, through a start-up built to sell cyber operations to the US government, and access control, through a claim about who reached a lab’s internal systems. The analysis was published in June 2026 and does not discuss Cathedral.

What Is Not Established

We read only the Post’s headline and opening paragraph; the article’s details, including any statement from Anthropic, were not read. Cathedral’s report is described as a draft. The 12-hour figure comes from the Post’s headline. Which systems were reached, what data was seen and how Anthropic responded are not established from text we read. We did not contact Anthropic or Cathedral.

The Bottom Line

Cathedral, a start-up founded by former DOGE staffers and valued at $1.4 billion in July, told Anthropic its researchers had penetrated sensitive internal data and messaging systems, The Washington Post reported on 26 October, citing Cathedral’s draft report. The Post’s headline puts the time at 12 hours.