OpenAI Hires DOGE Alumni Who Hacked Into Anthropic to Strengthen Security

As cybercriminals eagerly embrace AI tools, OpenAI needs all the help it can get securing its own systems from external hacks. That includes teaming up with a shadowy cybersecurity startup founded by a cadre of former DOGE employees. The startup, called Cathedral, is best known for reportedly hacking into Anthropic’s private systems as part of the AI lab’s bug bounty program. Cathedral told the Washington Post that the hack was performed in under twelve hours and that it gained access to sensitive information within Anthropic, including Slack messages, job offers, and meeting transcripts. Anthropic cybersecurity lead Logan Graham responded in a X post that the hack actually took “several days,” and that the company’s “most sensitive systems, like model weights and Claude conversations,” were not affected. Graham also said Cathedral’s approach to the hack was “unusual and out of scope” of the rules Anthropic has in place for it’s bug bounty program, since it relied on multiple third-party vulnerabilities. In a blog post published Monday, OpenAI said it was partnering with Cathedral as part of its broader effort to strengthen the security of its AI tools. Cathedral’s team “will use OpenAI’s models alongside our teams to challenge our defenses, bringing differentiated expertise and approaches to finding weaknesses and helping us protect our platforms,” OpenAI wrote. The company said it was also “more than quadrupling our rewards for critical findings” through its own bug bounty program. (Another company blog post from March of last year said the reward had quintupled from $20,000 to $100,000 This could be the “more than quadrupling” OpenAI is referring to, but the new post did not clarify. We’ve reached out to OpenAI and will update this story as soon as we know more.) OpenAI’s partnership with Cathedral follows a Y2K-like moment of panic for the cybersecurity sector. Late last month, researchers discovered major security vulnerabilities embedded within PHP, the decades-old programming language undergirding roughly 70% of websites. Governments and other organizations around the world took their sites offline to preempt hacks and hastily implement a fix. OpenAI—whose own model was used to discover the PHP flaws—announced it was launching a global effort called “patch the planet” to discover and resolve other security vulnerabilities that might still be hidden in popular software. “Recent incidents across the industry show how quickly threats can emerge and how important it is to build continuous defensive loops to find and fix weaknesses before attackers do,” OpenAI wrote in its Monday blog post. Cathedral was launched earlier this year with a reported valuation of $1.4 billion following a $160 million funding round led by Andreessen Horowitz and Sequoia Capital. The company seems to prefer to keep itself slightly shrouded in secrecy. Citing anonymous sources, Reuters reported in July that Cathedral’s mission was to strengthen the U.S. military’s offensive and defensive cyber capabilities against adversaries such as China. Its website is comically minimalist: it simply shows the company’s name in plain white text across a black screen. And its X profile doesn’t feature any posts or company logo—just a bio that says, vaguely, “Securing critical American infrastructure.” Cathedral’s founders—Gavin Kliger, Luke Farritor, Marko Elez, and Jack Stein—were all young deputies working under Elon Musk’s short-lived Department of Government Efficiency (DOGE), which was charged with cutting back on federal spending and pushed over 250,000 government workers out of their jobs during the early days of Trump’s second term. Kliger, Cathedral’s CEO, was also formerly senior software engineer at Databricks and, from December to April of this year, chief data officer at the U.S. Department of War, according to his LinkedIn page. Farritor was an intern at SpaceX, Elon Musk’s aviation and aerospace company, before being awarded a Thiel Fellowship in 2024. He also was a part of the team that won the $700,000 Vesuvius Challenge, using AI to decipher an ancient papyrus scroll charred in a volcanic eruption. Elez had stints at SpaceX, X, and xAI, and is infamous for resigning from DOGE after a Wall Street Journal report linked him to a pseudonymous X account with multiple racist posts, including one from September that reportedly read: “Normalize Indian hate.” The same day the WSJ published its report, Musk, responding to a social media support from U.S. vice president JD Vance in support of Elez, said he would bring the fired staffer back onboard. “To err is human, to forgive divine,” Musk wrote in a X post. There are many LinkedIn profiles for “Jack Stein,” but none of them could be immediately linked to the Cathedral cofounder.