OpenAI hires the startup that broke into Anthropic's systems

OpenAI has teamed up with Cathedral, a young cybersecurity startup that reportedly broke into Anthropic's private systems. In a blog post on Monday, OpenAI said Cathedral's team will try to find weaknesses in its defenses. OpenAI also said it is raising the rewards it pays for serious security findings.

What the deal involves

Cathedral's team will use OpenAI's AI models alongside OpenAI's own staff to challenge its security. OpenAI says the startup brings different skills and approaches to finding weak spots. The company also said it is "more than quadrupling our rewards for critical findings" in its bug bounty program. A bug bounty is a program that pays outside experts to report security flaws instead of exploiting them.

The Anthropic hack, disputed

Cathedral told the Washington Post it got into Anthropic in under twelve hours. It said it reached Slack messages, job offers and meeting transcripts. Anthropic's cybersecurity lead, Logan Graham, said on X that it took several days. He said the company's most sensitive systems, including model weights and Claude conversations, were not affected.

Graham also called Cathedral's method "unusual and out of scope" for Anthropic's bug bounty rules, because it relied on several vulnerabilities in third-party tools.

Who Cathedral is

Cathedral launched this year with a reported $1.4 billion valuation after a $160 million funding round led by Andreessen Horowitz and Sequoia Capital. Its founders are Gavin Kliger, Luke Farritor, Marko Elez and Jack Stein. All worked as young deputies in Elon Musk's short-lived Department of Government Efficiency, known as DOGE.

The company keeps a low profile. Its website shows only its name in white text on a black screen. Its X bio says, "Securing critical American infrastructure." Reuters reported in July, citing anonymous sources, that its mission is to strengthen U.S. military cyber capabilities.

Why it matters now

The deal follows a scare in the security world. Late last month, researchers found major flaws in PHP, an old programming language behind roughly 70% of websites. Some governments and organizations took sites offline while a fix was prepared. OpenAI's own model helped find the flaws, and the company has launched a global effort it calls "patch the planet."

For everyday users, the point is simple. AI companies hold large amounts of data, so how well they guard it affects the privacy of anyone using their tools.

What is not clear

OpenAI did not say what the new reward amounts are. Gizmodo notes that a March blog post from last year said the top reward rose from $20,000 to $100,000. That may be what OpenAI means, but the new post did not explain, and Gizmodo has asked OpenAI for details.