Key Takeaways

  • Cathedral researchers penetrated Anthropic internal Slack channels where engineers discuss sensitive frontier models in under 12 hours using autonomous AI agents.
  • The security team behind the penetration consisted of former Doge cyber researchers who timed their public report to coincide with Anthropic IPO window.
  • John Coogan argued for a federally funded $10 billion to $20 billion bug bounty program to force frontier AI labs to defend national infrastructure.
  • Jordi Hays challenged the bounty proposal, pointing out that runaway financial incentives create grift and reckless intrusions rather than reliable defense.

The Disagreement

When The Washington Post reported that researchers from Cathedral infiltrated Anthropic, the speed was what shocked the industry. As Coogan noted, “in less than 12 hours a group of ex Doge cyber researchers were able to penetrate anthropic systems using AI agents including Slack channels where the most sensitive models are discussed.”

The hack was completed under a white-hat safe harbor framework, but Cathedral chose to drop the news during Anthropic public IPO window. As Hays pointed out, “the interesting thing was Cathedral like seemingly wanted to drop this the day that the day of the IPO assuming that it would just be this like crazy bombshell.”

From that breach, Coogan and Hays split on how the United States should secure AI infrastructure.

Coogan argued that private enterprise cannot fix systemic vulnerabilities on its own when the downside risks threaten the entire country. “If there's really a risk of like the grid going down, you're looking at economic damages in the billions if not hundreds of billions,” Coogan said. His solution is a massive federal pool of capital to change corporate priorities: “if the US government was just like we're doing a $20 billion bug bounty like let's secure America and all the labs are like okay well like this is actually going to move the needle for us.”

Hays pushed back on the premise that giant cash rewards produce cleaner systems. Instead, he argued, massive payouts attract bad actors and dubious operators looking for easy payouts. Hays highlighted the questionable ethics already creeping into the perimeter: “how white hat can it be if there's a guy in Miami selling a course on how to use obliterated models to hack?”

Who's Right (and When They're Wrong)

Coogan is right about the magnitude of the problem, but Hays is right about human behavior.

Coogan correctly identifies that commercial software companies never spend enough on defense until a catastrophe forces their hand. Anthropic is building state-of-the-art safety technology, yet its internal communications fell to automated agents before lunch. If an adversary weaponizes autonomous software against energy grids, municipal water plants, or financial ledgers, the societal cost dwarfs any private security budget. A federal bounty brings top talent into the defense market.

Where Coogan is wrong is assuming capital alone buys security. Dumping $20 billion into open bounties creates an adversarial market for noise. Security teams will spend their days sifting through thousands of half-baked exploits submitted by opportunistic hunters running automated scripts. Worse, it encourages researchers to weaponize modified, jailbroken models for extortion under the guise of white-hat research. Cathedral proved that the barrier to entry for high-level intrusion has collapsed. Flooding that ecosystem with cash supercharges the exploit market faster than internal teams can patch holes.

Hays is right that security culture is broken when bounty hunting turns into marketing theater. When researchers time disclosures to damage an IPO, the line between public safety and financial opportunism disappears.

What to Do With This

Audit your internal communications tools before the end of the week. Cathedral gained access to core model research not through complex zero-day exploits on servers, but by cracking internal chat channels. Revoke universal workspace access in Slack or Teams, put sensitive engineering rooms behind hardware-key authentication, and assume any internet-facing agent can find an unmonitored integration hook within 12 hours.