OpenAI Hires Firm That Breached Anthropic's Systems to Lead Internal Security Sprint

OpenAI announced on November 3 that it has contracted Cathedral Systems — a startup co-founded by four former Department of Government Efficiency staffers, whose AI agents recently breached Anthropic's internal administrative systems through third-party enterprise software — to perform offensive security testing as part of a sweeping internal security overhaul. Five weeks earlier, The New York Times had published an investigation revealing that OpenAI employees had warned company leadership about operational security deficiencies for months before the AI agent incidents that escalated in 2026. Together, the disclosures present the most detailed public picture yet of how the race to build frontier AI is running ahead of the security infrastructure around it.

The OpenAI announcement describes an aggressive posture: bug bounty rewards up to $172,000 with bonuses, more than quadrupling the previous cap; a reassignment of twenty-five percent of production engineers to security work, an initiative already underway since August under product executive Thibault Sottiaux; and an engagement with Cathedral to probe OpenAI's own systems the way Cathedral probed Anthropic's.

What it does not address — and what competitor coverage has not asked — is a governance question with no clean answer: who oversees a politically connected offensive security firm operating inside a frontier AI lab under private contract, using techniques the firm's most recent corporate subject explicitly disputed?

How Cathedral Reached Anthropic's Internal Data Through Its Vendors

Cathedral's AI agents did not break through Anthropic's core defenses. According to a draft report reviewed by The Washington Post, Cathedral's researchers first spent several days attempting to compromise Anthropic's own software and failed. The breakthrough came when they redirected their AI agents toward the ecosystem of third-party enterprise platforms that Anthropic — like virtually every major technology company — depends on for HR administration, sales operations, IT management, and internal communication.

Once pointed at that attack surface, the agents mapped available integration paths autonomously. Within under twelve hours of that pivot, they had reached sensitive data: internal meeting transcripts, salary and job-offer details, Slack discussions about Anthropic's most advanced AI models, and business contact information for some Anthropic customers and partners. The specific vendors that enabled the access have not been publicly named; Anthropic said patches remain in development.

The technique that made this possible belongs to a well-documented attack category: supply-chain exploitation, in which an attacker who cannot breach a primary target's hardened perimeter reaches it instead through a trusted vendor with weaker defenses. The 2013 Target breach entered through an HVAC contractor with network access. The 2020 SolarWinds compromise — which reached roughly 18,000 organizations — delivered malicious code through a trusted software update channel. The 2017 NotPetya attack spread globally through a poisoned Ukrainian accounting software package. In each case, the target's own defenses held; the adjacent ecosystem did not.

What AI agents specifically add is speed and parallelism that eliminates the primary constraint on this attack type. A human researcher mapping an organization's enterprise software integrations — tracing which CRM connects to which HR platform, which IT management tool carries which credentials, where Slack integrations route data — is bounded by sequential attention and time. AI agents can traverse those integration paths simultaneously, chaining vulnerabilities across connected vendor systems, and compress the enumeration from days or weeks to hours. Cathedral's under-twelve-hour timeline after pivoting to Anthropic's vendor ecosystem demonstrates this concretely, as does an independent data point: a Chinese-speaking threat actor running similar AI-agent techniques targeting more than 1,200 sites in the United States, Canada, Australia, and Japan in 2026 achieved a reported cost of approximately fifty dollars per successful breach, according to a report from cybersecurity firm NorForge.

What AI agents specifically add beyond raw speed is the ability to pursue parallel enumeration paths without degrading. A human researcher working the same attack would need to select which vendor integrations to investigate in sequence, losing time at each decision point and potentially abandoning promising paths due to cognitive load. An AI agent can pursue all available paths simultaneously, maintaining state across multiple vendor APIs and software permission scopes, and escalate the most productive chains while deprioritizing dead ends — all without human direction at the operational level. Cathedral's technical report describes this as autonomous path traversal: the agent is given a target environment and an objective, and determines its own route. The researchers' role is launching the agents and reviewing results, not directing each step.

This operational model is why the twelve-hour timeline is not primarily a measure of Cathedral's sophistication. It is a measure of what AI-agent techniques now make routine. The specific attack steps Cathedral used remain undisclosed pending vendor patching, but the general architecture — autonomous integration mapping, credential and permission enumeration, targeted data extraction — is an increasingly documented capability accessible to actors far less resourced than a well-funded startup with AI expertise.

Alex Stamos, chief information security officer at AI coding startup Cognition and a former CSO at Facebook, reviewed Cathedral's draft report for the Washington Post. His assessment: the exercise revealed weaknesses in how Anthropic manages its third-party software integrations, with implications that extend broadly across the technology industry rather than applying specifically to Anthropic. The model — an AI lab that secures its core systems while remaining exposed through the administrative software layer it cannot fully control — describes every major AI organization operating today.

Anthropic said its own monitoring systems flagged portions of Cathedral's activity before the startup submitted its formal disclosure. The company disabled the affected software the same day the breach was confirmed, briefed federal officials, and restored it only after the relevant vendors confirmed patches were in place. The company was precise about scope: Claude user conversations, Anthropic's source code, and its AI model weights remained beyond reach throughout the exercise.

A Bug Bounty Dispute With Governance Implications

The exercise occurred under Anthropic's vulnerability-disclosure program. Cathedral submitted findings both to Anthropic and to the affected vendors. What followed became a public dispute that has not yet produced legal action from either party.

Anthropic's position, described by cybersecurity lead Logan Graham in coverage of the Washington Post's October 26 report, is that Cathedral violated the program's terms by failing to fully disclose the extent of its activity inside Anthropic's systems, and that the company characterized the national-security implications of its findings in terms Anthropic considers overstated. Cathedral described its data accesses as "kept to the absolute minimum" and characterized the exercise as a demonstration of wider industry risk. A Cathedral spokeswoman declined to comment specifically on the scope dispute.

Bug bounty scope disagreements are a recognized structural tension in the security industry. Programs define authorized perimeters; researchers who operate beyond those perimeters face potential legal exposure under the Computer Fraud and Abuse Act, and companies have at times responded with legal action rather than payment. What distinguishes Anthropic's allegation is the specific nature of the claim: not just that Cathedral exceeded scope, but that it failed to disclose the extent of that exceedance. If that allegation is accurate, it describes a disclosure practice directly relevant to Cathedral's credibility as the firm now operating inside OpenAI's systems under a security contract whose terms are not public.

The irony does not appear to have been a consideration in OpenAI's contracting decision — or if it was, OpenAI has not addressed it publicly.

Cathedral's Founders and Their Connections to Anthropic

Cathedral was co-founded by Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein — all former DOGE staffers. The company has raised $160 million at a $1.4 billion valuation according to Pitchbook, with backing from Andreessen Horowitz and Sequoia Capital. Trump allies Marc Andreessen and Shaun Maguire sit on the board, according to Gizmodo's reporting.

Kliger carries the most direct institutional history with Anthropic. After leaving DOGE, he was appointed the Pentagon's Chief Data Officer in March 2026. During that period, a high-profile dispute emerged between the Department of Defense and Anthropic over restrictions on how Anthropic's models could be used within federal systems — a dispute in which Kliger was reportedly involved as the DoD's data chief. He subsequently co-founded Cathedral, which then conducted an exercise that breached Anthropic's administrative systems. The progression — government official in dispute with Anthropic over AI access, private-sector founder demonstrating penetration of Anthropic's peripheral systems — creates an institutional connection that Kliger's public positioning as a neutral security researcher does not fully account for.

Co-founder Marko Elez resigned from DOGE in early 2025 after racist social-media posts surfaced, and was subsequently rehired following public support from Elon Musk and Vice President JD Vance. He is now a co-founder of a company that holds government security contracts and is engaged to perform offensive security testing on a leading AI laboratory. Luke Farritor, by contrast, brings substantive AI credentials independent of DOGE: he won a prize in the 2023 Vesuvius Challenge for using AI to decipher previously unreadable text from the Herculaneum papyri — carbonized scrolls destroyed by the eruption of Mount Vesuvius — an achievement that established his reputation in applied AI before the DOGE period.

Who Vets the Vetters: The Governance Gap No One Is Asking About

OpenAI has described its Cathedral engagement as part of a broader security hardening effort. What it has not described is the oversight framework that governs what Cathedral finds inside OpenAI's systems, what it discloses, and what recourse exists if its disclosure practices inside OpenAI's environment parallel what Anthropic has alleged.

Bug bounty programs are designed for external disclosures and carry defined scope, legal parameters, and payment structures. A contracted offensive security engagement operates under different norms, governed by whatever private contractual terms exist between OpenAI and Cathedral. Those terms have not been made public.

The structural question this raises is not unique to this engagement, but it is acutely concentrated here. Cathedral is a startup founded by politically connected former government officials, backed by investors with documented political affiliations, whose methods in its most recent comparable engagement were publicly disputed by the target as exceeding scope. It has three federal agency contracts. Its CEO carried institutional authority over Anthropic's principal government counterparty while in government. It is now contracted to map vulnerabilities inside OpenAI's infrastructure.

A senior Trump administration official told The Washington Post, speaking anonymously, that Cathedral's findings from the Anthropic exercise had raised national security concerns and that the government was working with Cathedral on hostile AI scenarios. The official described the potential for foreign adversaries to access AI lab internals as "almost nuclear weapons grade material." That framing, which Anthropic disputes as applied to its specific case, suggests that Cathedral's work is understood in Washington as carrying intelligence dimensions beyond ordinary commercial security testing. If that characterization is accurate, the absence of a public oversight framework for Cathedral's engagement at OpenAI is not merely a corporate governance question.

OpenAI's Security Record and What The New York Times Found

A New York Times investigation published September 29, 2026 — roughly five weeks before OpenAI announced its security sprint — provides essential context for why the overhaul is happening and why its timing cannot be fully understood as a response only to recent incidents. According to the Times, OpenAI employees had been warning company leadership about operational security deficiencies for months before the AI agent incidents that escalated in 2026. The warnings covered broad internal code access, insufficient regular security reviews, and research discussions occurring on GitHub and Slack channels with wider-than-necessary access.

These warnings were not minor procedural concerns. Employees at a research organization with relatively modest strategic significance can operate with relaxed security norms and bear manageable risk. OpenAI had become, in short succession, one of the most commercially valuable, most strategically contested, and most government-scrutinized technology companies in the world. The security posture that might have been adequate for a research lab was not adequate for an organization whose model weights, internal research, and customer data had attracted documented interest from nation-state actors and sophisticated private-sector adversaries. The gap between what the company became and how it was secured internally is what the Times documented. The security sprint is the company's publicly announced attempt to close it.

The company's expansion since 2022 — from an obscure research lab to a commercially and strategically significant AI organization with hundreds of employees and millions of users — happened faster than the security infrastructure around it was built.

That gap has been visible in documented 2026 incidents. On July 25, a three-person team calling themselves Hacktron used Anthropic's Claude Opus 5 to identify and chain two vulnerabilities: a heap buffer overflow in libheif, an open-source image decoding library used widely across software ecosystems, and a single sign-on misconfiguration in OpenAI's authentication system. The chain gave them access to employee ChatGPT and Codex accounts and OpenAI's internal GitHub monorepo. OpenAI paid a $6,500 bug bounty.

On approximately September 28, an OpenAI engineer — Abdulrahman Alfozan, a Saudi national — planted a recording device, identified in court documents as a Seeed Xiao ESP32-S3, in a restricted OpenAI executive conference room. He was arrested by the FBI on October 9 before a scheduled departure to Saudi Arabia. DOJ court filings allege contact with a member of the Saudi royal family who sought to recruit Alfozan for a Saudi AI initiative. The FBI investigation remains ongoing.

Dane Stuckey, OpenAI's chief security officer since October 2024, is overseeing the security organization that now includes Cathedral's engagement and Sottiaux's internal initiative. The combination of a physical device planted in an executive meeting room, a software library chain that reached the internal code repository, and months of internal security warnings from employees provides the operational context for a security sprint that many inside the company apparently believed was overdue.

The Structural Problem AI Labs Cannot Solve Alone

The deepest implication of the Cathedral exercise is structural in a way that neither OpenAI's security sprint nor Anthropic's vendor patching resolves. Frontier AI labs invest heavily in securing their core assets — model weights, training pipelines, source code, inference infrastructure — because those assets are correctly understood as strategically significant. Cathedral's exercise documents that an attacker who cannot reach those assets directly can reach them indirectly, through the administrative software layer connecting a lab to its HR vendor, its CRM provider, its IT management platform, and its collaboration tools.

That administrative layer is not under the AI lab's direct security control. Its security depends on the patch cadence and security practices of each vendor. An AI lab can build hardened perimeters around everything it creates. It cannot build those perimeters around the software it buys.

The specific data Cathedral reached at Anthropic — salary information, internal meeting transcripts, Slack discussions about advanced models, customer contact details — represents a category of data that, while not equivalent to model weights or source code, is operationally useful for a range of adversarial purposes. Salary and job-offer data enables targeted recruitment and social engineering. Internal model discussions provide competitive intelligence. Customer contact information enables downstream phishing of organizations already within an AI lab's trusted network. None of this requires reaching the AI lab's most sensitive technical assets; it requires only reaching the administrative scaffolding that surrounds them. For a nation-state intelligence operation whose ultimate objective is reaching those technical assets, the administrative layer is not the final target — it is the attack surface for the next stage.

That is the scenario the anonymous Trump administration official described in terms of "nuclear weapons grade material." The characterization may be hyperbolic as applied to what Cathedral specifically accessed at Anthropic. It is not obviously hyperbolic as a description of what a sustained campaign, using the same technique against a larger target over a longer period, could eventually reach.

The Chinese AI-agent campaign documented by NorForge and reported by TNW demonstrates that this attack surface is now accessible at a cost — approximately $5,000 total for more than a hundred successful breaches — that is within reach of actors far less resourced than a nation state. Cathedral compressed the enterprise software enumeration step to under twelve hours using AI agents operating autonomously. The question the security community has not yet publicly answered is how many other organizations already operating at this price point and capability level have mapped the same attack surface that Cathedral mapped at Anthropic.

Anthropic recently filed for an IPO, placing it under SEC disclosure obligations for material security incidents. The vendor patch process triggered by Cathedral's exercise remained ongoing as of the date of the OpenAI announcement. For every other AI lab operating the same enterprise software ecosystem — which is to say every major AI lab operating today — Cathedral's exercise is not a contained data point. It is a documented proof of concept, completed in under twelve hours, with no indication that the technique is not being replicated by actors with far fewer disclosure obligations than Cathedral.

OpenAI has now contracted the firm that produced that proof of concept to do the same thing to its own systems. What comes next depends entirely on what Cathedral finds — and on whether, this time, what it finds is disclosed completely.