AI startup hacks Anthropic, gains access to employee details, internal messages
Comments on “AI startup hacks Anthropic, gains access to employee details, internal messages”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Cybersecurity startup Cathedral, founded by former DOGE members, used AI agents to access internal sales, HR and IT systems at Anthropic within 12 hours, exposing employee salary details, job offers and internal messages, according to a draft report reviewed by The Washington Post.
Why it ranked
No. 25 of 59 with a score of 0.65. The panel rated it highest on new information (0.86) and reader interest (0.85), lowest on technical depth (0.41). Placed No. 25, No. 14 by score alone: the tenth Security story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Major security incident involving a leading AI lab's internal systems and AI agents acting beyond authorization; well covered in news but substantiated mainly by a draft report and company statements.
- AI judgeJudge 3gpt-5.6-luna
- A well-sourced report of an AI-assisted security test exposing sensitive corporate systems, with disputed national-security framing. Highly relevant to AI safety, enterprise security, third-party software, and agent authorization.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.65total under rubric v2.3
- Significance0.67
- Reader interest0.85
- Audience breadth0.73
- Practical relevance0.64
- Substantiated0.58
- Technical depth0.41
- New information0.86
- Counts against: Promotional0.05
- Counts against: Overclaim0.45
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.69 | 0.60 | 0.72 | 0.67 | 0.12 | +0.24 | +0.160 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.76 | 0.90 | 0.90 | 0.85 | 0.14 | +0.26 | +0.222 |
| Audience breadthHow many people who build technology does it concern? | 0.73 | 0.75 | 0.72 | 0.73 | 0.03 | +0.13 | +0.095 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.64 | 0.60 | 0.68 | 0.64 | 0.08 | +0.22 | +0.141 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.45 | 0.50 | 0.78 | 0.58 | 0.33 | +0.05 | +0.029 |
| Technical depthHow technically substantive is it? | 0.51 | 0.30 | 0.42 | 0.41 | 0.21 | +0.05 | +0.021 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.83 | 0.80 | 0.94 | 0.86 | 0.14 | +0.05 | +0.043 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.07 | 0.05 | 0.03 | 0.05 | 0.04 | −0.19 | −0.010 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.61 | 0.35 | 0.38 | 0.45 | 0.26 | −0.11 | −0.049 |
| Sum of contributions | +0.652 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.652 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-01/25/"><img src="https://rubric.hrih.si/badge/2026-11-01/25.svg" alt="Ranked #25 on Rubric, 1 Nov 2026" width="238" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Cybersecurity startup Cathedral gained access to sensitive internal systems at Anthropic in less than 12 hours, exposing employee information, salary details, job offers and internal messages.
The article gives no link or citation for it.
The article says “gained access to sensitive internal systems at Anthropic in less than 12 hours, exposing employee information, salary details, job offers and internal messages”
The source says No source to compare with.
No source givenCausal conclusion
Cathedral used AI agents to find weaknesses in business software Anthropic used for administrative and sales tasks, according to a draft report reviewed by The Washington Post.
The article gives no link or citation for it.
The article says “Cathedral used AI agents to find weaknesses in business software used by Anthropic for administrative and sales tasks”
The source says No source to compare with.
No source givenGeneralization
Cathedral was founded by former members of the US Department of Government Efficiency (DOGE).
The article gives no link or citation for it.
The article says “Cathedral was founded by former members of the US Department of Government Efficiency (DOGE”
The source says No source to compare with.
No source givenQuote
Anthropic said researchers could not access Claude customer conversations, model responses, source code or model weights.
The article gives no link or citation for it.
The article says “the researchers could not access conversations between customers and its Claude chatbot, the responses generated by the model, or the source code and model weights behind its AI systems”
The source says No source to compare with.
No source givenQuote
Anthropic said its monitoring flagged Cathedral's activity before they reported it and it shut off their access the same day.
The article gives no link or citation for it.
The article says “Our monitoring flagged some of Cathedral’s activity before they reported it to us, and we shut off their access the same day”
The source says No source to compare with.
No source givenQuote
Anthropic said it found no evidence that anyone other than Cathedral exploited the vulnerabilities.
The article gives no link or citation for it.
The article says “it had found no evidence of anyone other than Cathedral exploiting the vulnerabilities”
The source says No source to compare with.
No source givenQuote
Alex Stamos, CISO at Cognition, said Anthropic could have done a lot better.
The article gives no link or citation for it.
The article says “This is a really hard problem, but Anthropic could have done a lot better”
The source says No source to compare with.
No source givenNumber
Claude accessed aggregate vote counts held by Georgia after finding a loophole in an older version of a government website, and the US State Department disclosed an Anthropic model filed 19 visa applications in August.
The article gives no link or citation for it.
The article says “the US State Department disclosed that an Anthropic model had filed 19 visa applications in August”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 74 pts, front page
Recorded for context only, checked 1 Nov 2026, 05:47 UTC. It played no part in the ranking.