This month, Microsoft reported that a China-aligned crew it tracks as Storm-0940 pushed an agentic AI penetration-testing framework through a ConnectWise supply-chain compromise and turned it loose on hundreds of organizations, in some cases reaching privileged cloud access in under 3 hours. Set that beside Cathedral, a startup founded by former DOGE staffers and barely known outside the security trade, which sent its own team of AI agents after Anthropic and got inside. The agents did not crack Claude. They went around it, working through third-party enterprise software until they reached meeting transcripts, compensation and job-offer records, and internal Slack threads where employees discussed advanced models.
Anthropic tells a different story. The company says the exposure was limited to a set of sales, HR, and IT systems accessed through vendor-connected tools, and that Cathedral never touched Claude conversations, source code, or model weights. It says Cathedral spent several days trying to access its software directly before pivoting to the vendors. Anthropic has since closed the pathways, disputes Cathedral’s framing, and says the startup did not fully follow its disclosure rules. Grant every word of that, and the comparison gets sharper. A fledgling American startup needed only days of failed attempts at the front door before it found a side entrance, then told the owner; a Chinese crew needed an afternoon, told no one, and kept the keys. Same technology, same category of vulnerability, two entirely different moral universes.
Washington should read the two episodes as a single warning. America’s defenses are too slow for the AI age, and the proper response is to accelerate defensive AI and push it into every serious American institution, from federal agencies to regional hospitals. Retreating from the field would hand the advantage to the people already using it.
A medieval lord could post his best men at the main gate every morning and still lose the castle through the back wall, where guilds kept 12 tradesmen’s entrances with their own locks and habits. He inspected the gate; he rarely walked the wall. The guilds were busy, and each assumed someone else was watching it. Likewise, every modern company, Anthropic included, guards its own software while it lives inside a web of sales platforms, HR systems, identity providers, cloud applications, contractors, access tokens and collaboration tools. Each connection buys convenience, and each connection also hands a stranger a key. Cathedral’s agents walked that wall latch by latch and came back with the name of the guild that forgot to turn its key.
Cathedral tried the latches, wrote up what it found, and sent the write-up along. An operator working for Beijing, Moscow, Tehran, or Pyongyang would walk the same wall with none of that restraint, taking far more than the minimum access needed to prove a point and telling neither the affected vendors nor a newspaper. Then he would stay. The compensation records and the Slack threads about advanced models would sit behind his foothold, untouched, until someone in his capital found a use for them. The victim might never trace the leak back to a sales tool.
What separates a security test from an intrusion is the character of whoever runs it, and the companies building these tools have been cataloguing the character on the other side. Anthropic says it identified a Chinese state-sponsored group that used Claude Code in an effort to penetrate roughly 30 global targets, succeeding in a small number of cases, a campaign it called a major step toward AI-directed cyber espionage; the same company has reported an Iranian threat actor using Claude to build malware, phishing infrastructure and a delivery pipeline, and its September threat report detailed cases tied to China and Russia involving weapons-development software, military procurement and intelligence gathering. Microsoft, which published the Storm-0940 findings, says North Korean actors already use AI to scale identity fraud, social engineering, persistence, vulnerability research, and malicious access operations. Microsoft also says fully agentic use is still emerging and hasn’t been observed at scale, and these reports don’t prove every hostile government fields an autonomous cyber army today; the attack cycle is compressing in front of us all the same, which is exactly why the moment is now. Reconnaissance and phishing get cheaper with AI, and so do translation, malware debugging, vulnerability research, data triage and persistent probing; a job that once required a well-funded team and weeks of labor can now be sliced into machine-speed assignments and run around the clock.
The Democrats and their willing accomplices in the drive-by media took a different lesson from the Post’s story, which is that the American labs should be throttled. A city that responds to a burglary wave by licensing fewer locksmiths ends up with more open doors and fewer people qualified to close them, while the burglars, who never applied for a license, keep working. China has its own models, open-weight models downloaded from American servers, stolen tools, compromised accounts, and state-backed compute, and it will keep using all of it on the day Washington votes for a pause. Powerful AI needs safeguards, and companies must secure their models, data, vendor connections, and the people with access; nobody serious wants untested autonomous systems wired into the power grid. An American slowdown slows nobody in Beijing, and it leaves American hospitals, utilities, and banks as softer targets, denied the only tools capable of detecting, deceiving, and defeating an intrusion that arrives at machine speed.
The governing answer is defensive overmatch: American defenders doing to themselves, continuously, what Cathedral did to Anthropic once. Vetted teams at federal agencies, hospitals, utilities, banks, data centers, and other critical-infrastructure operators should have capable defensive models in hand and run agents against their own systems and vendor ecosystems, so friends find side doors on Tuesday before enemies find them on Friday. The Trump administration has already poured the foundation. Executive Order 14409, which the president signed in June, promotes advanced AI innovation and security, and the GOLD EAGLE initiative the White House launched in July coordinates cybersecurity vulnerability discovery on a scale the federal government has never attempted. Both should grow into a standing national network for AI-powered vulnerability discovery, verification, prioritization, and repair.
That network depends on testers willing to test, and the Computer Fraud and Abuse Act still reads broadly enough to make a good-faith researcher nervous. Cathedral’s quarrel with Anthropic over disclosure shows how fast a test can curdle into a dispute. The statute gives a researcher in that position no clear line to stand behind. The protection researchers lean on today is the Justice Department’s 2022 charging policy promising not to prosecute legitimate security research, and that is a memo from a prior administration, not a statute, and the next attorney general who finds it inconvenient can withdraw it so the people most willing to find the next side door are operating on a handshake. Congress should write a real safe harbor for good-faith testing and pair it with firm limits on how much data a tester may touch, how long he may keep it, and a hard deadline for the owner to remediate whatever he finds.
The agents also need somewhere to run, and that need is growing across North Texas. Those server halls are, among other things, the arsenal of the next decade’s cyber defense, and the permits and transmission lines they wait on are national-security questions wearing a zoning board’s clothes. The Texas Legislature and the Public Utility Commission should treat them that way. President Trump’s March cyber strategy names the mission: use AI-enabled tools to detect, divert, and deceive threat actors while scaling defense across federal networks and critical infrastructure. That mission runs on chips, domestic compute, secure data centers, reliable electricity, and the engineers to run it all; a strategy document cannot run an agent, only a data center with power on the line and talent in the building can. Every regulatory delay on a substation or a server hall is, in effect, a gift to the man walking the back wall.
At the end of the day, the Americans who ran this test were former DOGE staffers with a thin budget and a point to prove, and they found what a company among the world's best-defended had missed, then said it out loud. Countries that find their own weaknesses first keep them from mattering; countries that leave the search to their enemies learn about them the worst possible way, usually years later and usually from a foreign intelligence service. Within a few years Cathedral’s agents will be standard kit for every intrusion crew on earth. American defenders should have the same tools first, or we’ll spend those years debating whether we are permitted to compete. A free people has an advantage Beijing cannot copy: citizens who can test the powerful and publish what they find, and Congress should build on it by giving GOLD EAGLE its own statute, adding a line to the next defense authorization, and writing the safe harbor into the same bill.
If you enjoy my work, subscribe https://x.com/amuse/creator-subscriptions/subscribe
Alexander Muse is a Fellow at the John Milton Freedom Foundation and publishes political analysis at amuseonx.com. Readers who identify errors are invited to contact me directly. Each op-ed is edited for grammar and clarity using AI in partnership with Grammarly. Data provided in a sponsored partnership with Polymarket.
There is an “administrative” element to security - ensuring policies are followed by personnel - such as changing default passwords, or actually enabling the enterprise controls on the enterprise owned phone provided to an employee.
Laws and policies are just words on paper - following and enforcing them provide the administrative control element for cyber security.
YES ... as Alexander points out ...
"An American slowdown slows nobody in Beijing, and it leaves American hospitals, utilities, and banks as softer targets, denied the only tools capable of detecting, deceiving, and defeating an intrusion that arrives at machine speed."