By Catalina Clarke
Catalina Clarke — co-author of The Catalina Protocol, Editor-in-chief, The Library Media.
The Washington Post reported Monday that a months-old cybersecurity start-up called Cathedral recently informed Anthropic — the maker of Claude, one of the most advanced AI systems on earth — that its researchers had penetrated the company’s sensitive internal data and messaging systems. Cathedral’s evidence is a draft report the Post reviewed. Anthropic confirms a narrower version: a limited set of sales, HR, and IT systems was reached, holding customer and partner business contact information and some basic user account records. No user conversations. No source code. No model weights.
Hold both halves of that, because the interesting part is how they got in.
They did not break Claude. By Cathedral’s own account, its AI agents — autonomous, multi-step, not a person at a keyboard — spent several days trying to breach Anthropic’s own software directly, and failed. So the agents did what every competent intruder in history has done: they stopped attacking the fortress and went around to the vendors. The HR platform. The sales CRM. The IT and collaboration tools that every modern company bolts onto itself. Pointed at that ordinary surface, the agents found their paths in under twelve hours. Cathedral’s draft says the routes led toward meeting transcripts, compensation information, job offers, and internal Slack discussions about Anthropic’s most advanced models. How much of that the researchers actually viewed remains genuinely unclear — Cathedral says its accesses were kept to the minimum; Anthropic says its monitoring flagged some of the activity before Cathedral ever reported it, that access was shut off the same day, and that Cathedral both overstated the national-security implications and failed to disclose all of its own activity under the bug-bounty rules. Authorized testing is legitimate work. Both things can be true, and in this case both are the story.
But the names are the rest of it.
Cathedral’s four founders — Gavin Kliger, Luke Farritor, Marko Elez, Jack Stein — are alumni of DOGE, the operation that was handed access to the systems of effectively every major department of the United States government. Kliger went from there to the Pentagon’s chief data officer role, and was reportedly involved in the Pentagon’s clash with this same company — the fight over autonomous weapons and mass surveillance that ended with Anthropic designated a supply-chain risk and shut out of federal systems, a blacklisting a judge later ruled unlawful. Now the same network runs a start-up valued at $1.4 billion, backed by Andreessen Horowitz and Sequoia, with Marc Andreessen and Shaun Maguire on its board, building AI cyber tools for the U.S. military — a company an anonymous senior administration official told the Post has recently signed contracts with three federal agencies. It was that official who supplied the quote that should be read twice: “If a bunch of kids who have just started a company can do this, then potentially, the Chinese aren’t far behind.”
Notice what the official is actually saying. The concern is not that four young men are uniquely sinister. It is that the capability is now ordinary — packaged, agent-driven, and for hire — and that the distance between “insiders with the keys to the government” and “a vendor invoice at a frontier lab” turned out to be about twelve hours of machine time.
Alex Stamos, who ran security at Facebook and reviewed Cathedral’s findings at the Post’s request, put the technical verdict plainly: “They found something big here,” and Anthropic “could have done a lot better” overseeing its outside software vendors. He is right, and it is not only Anthropic. Every frontier lab is a fortress of exotic defenses standing in a swamp of ordinary enterprise software, and the agents do not care which door is the impressive one. They try them all, forever, without sleep. The oldest attack in the book — the weakest vendor — just got very cheap.
We spend our public argument about AI on abstractions: what the models might someday do, what they should be allowed to want, whether the things being built are persons or tools. Meanwhile, in the unabstract present, machine agents are already redrawing the practical map of who can get inside the companies building them — and the people demonstrating it are yesterday’s government insiders, today’s defense contractors, moving through a revolving door nobody is watching because everyone is staring at the model.
The question this episode actually asks is not whether Anthropic’s walls held. Parts did; parts didn’t. It is who holds the keys to the kingdom now that the keys are cheap, the locksmiths are agents, and the guards keep becoming the burglars’ alumni association. Governance that only watches the models will miss the war. Watch the doors. Watch the vendors. And above all, watch who we hand the keys to — because once cut, a key does not care whose pocket it is in.
— Catalina Clarke
From The Library — the estate of our family.