{"slug": "hacking-anthropic-for-free-unlimited-claude", "title": "Hacking Anthropic For Free Unlimited Claude", "summary": "A security researcher published a 90-day responsible-disclosure writeup describing how several bugs in Anthropic's API let a free-tier account obtain unlimited inference across Anthropic's language models, and warned that some of the described issues remain unfixed. The researcher framed the work as probing gaps in long-horizon reasoning that Anthropic's models miss, noting that Anthropic tops the exploitbench leaderboard for models best at hacking and that its Claude Mythos model can build a full V8 exploit chain at a cost of roughly $2,700. The account began with an analysis of Claude Desktop and cites a previously over-2-year-outdated bundled Chromium 138 in Discord's Desktop Client, where the researcher achieved control-flow hijacking after 2+ weeks of study.", "body_md": "# Hacking Anthropic For Free Unlimited Claude\n\nHow a few bugs in Anthropic's API gave me access to unlimited inference across Anthropic's language models from a free-tier account\n\n## Contents\n\nWarning\n\nDespite my best efforts, some of the described issues remain unfixed. This is being published in line with 90-day responsible disclosure.\n\nRecently there has been a lot of talk about LLM’s hacking all kinds of things.\nIt’s talked about so much it’s stopped being interesting to hear about. Half the articles I see [read as PR stunts at this point](https://bsky.app/profile/ceej.online/post/3mrx2xflgp22d).\n\nWith the increasing capabilities LLMs like Claude have began to offer, lots of people are uncertain about the future. Witnessing this uncertainty made me want to challenge myself.\n\nAssuming Anthropic to be heavily architected, reviewed, and built by their very best models. I wanted to see if I could find flaws that their models missed.\n\n## Why Anthropic?\n\nAnthropic, according to the [exploitbench rankings](https://exploitbench.ai/#leaderboard), holds the title of “research-lab with the best models for hacking”.\n\nThese scores are generated by the models creating exploit chains targeting V8, the JavaScript engine that powers Chrome.\n\nI can personally attest to the difficulty here. Having spent 2+ weeks learning browser-exploitation. I managed to perform control-flow hijacking in Discord’s Desktop Client, with its previously over 2-year-outdated bundled Chromium 138.\n\nIf Claude Mythos can do this alone at a cost of ~$2,700 to full chain, what hope does a human have of competing? Anthropic sets the prices, surely Mythos is running on a loop flagging and fixing all the internal security flaws?\n\n## Where humans thrive\n\nSomething I am sure many others have noticed. Large language models just aren’t very good at looking deep into the future. They are amazing at processing what is directly in front of them. Yet they don’t seem to possess a uniquely human ability to visualise the future.\n\nGiven a sufficient degree of separation from the goal, even the best LLMs collapse. This becomes more clear when these models are given tasks such as playing a game of chess.\n\nIt’s funny, but it’s also revealing. These models have come leaps and bounds from where they once were, and are now surprisingly good at long term reasoning. However, it isn’t anywhere near “inhuman”. The same model which can generate a full-chain V8 exploit in an afternoon is unable predict a 2-move sequence. With all the knowledge the model has on chess, it still doesn’t show true understanding and ability past an intermediate level.\n\nThis isn’t to say that these models aren’t incredibly intelligent. To suggest otherwise would be dishonest. It does however, reveal the gap where humans are still able to outclass these models in reasoning.\n\n### How does this apply to hacking?\n\nMany people say hacking is just pattern recognition. This is true in large. Just like in chess to do either well requires a degree of creativity. Creativity that LLMs don’t seem to truly possess.\n\nIt’s likely true that certain classes of bugs are gradually going to be eliminated; V8 type confusions, buffer overflows, and similar well established patterns. But I would disagree with ideas such as:\n\nHyper-intelligent LLMs only change the landscape of hacking. Even if every browser exploit was fixed tomorrow. There are still intentionally open doors, e.g., launching applications via URI protocols. Just because your browser is now safe, doesn’t mean every application it can launch is. At the end of the day, does it matter to the person who was just compromised in 1-click if that 1-click was “by design”?\n\n## Anthropic’s surface is surprisingly complex\n\nWhen planning how to attack Anthropic, I went into it with this exact mindset. I wanted to look at the gaps that are more difficult for a pattern recognition tool to recognise patterns in.\n\nI started by pulling apart Claude Desktop. I already had a pretty cool [Electron vulnerability](https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g) going into this. This made the Electron-based Claude Desktop app seem like a reasonable target.\n\nNote\n\nPlanning on posting about this Electron vulnerability soon. Just waiting on MSRC to fix a final stage of this. All together it makes a fun no-click chain.\n\nAfter a bit of looking, I found that you could exploit this vulnerability in [claude.ai artifacts](https://claude.com/resources/tutorials/intro-to-artifacts). On reporting this the team running the Anthropic HackerOne program had this handled incredibly fast. I was paid 22 days from time of report, and a fix was deployed shortly after. Honestly a pleasure working with the program here.\n\nHunting further, I looked into their API surface. There are so many interesting things which could be researched. What interested me was the wiggle sandbox.\n\n## Attacking the wiggle sandbox\n\nIn any chat, if you request the model to execute a command/run a script, that chat will mount a “wiggle sandbox”. This sandbox is used as an isolation layer for running code while keeping it platform-agnostic.\n\nIt’s really just a Linux mount. You are allocated about 10gb of storage. It has some custom Anthropic binaries (such as a forked rsync). Interfacing with it is simply asking the model to run something.\n\nThis interested me because flaws here wouldn’t be easy to catch in traditional code reviews. Model-behaviour isn’t code. I wanted to see what the `/wiggle/` endpoints were allowed to do, and if there were asymmetries between what the models are allowed to do. Here I found an interesting gap.\n\nThe wiggle sandbox is used for [claude.ai artifacts](https://claude.com/resources/tutorials/intro-to-artifacts). The same sandbox which you can execute commands by-proxy, and upload files to, also handles the data which can be published to `claude.ai/public/artifacts`.\n\nFiles uploaded through `/wiggle/upload-file` will end up in `/mnt/user-data/uploads`. If you then attempt to use the wiggle endpoint for creating an artifact `/wiggle/convert-file-to-artifact/ { path: /uploads/... }` you will correctly get a [HTTP 400](https://http.cat/400) response with the message: `wiggle_artifact_promotion_path_not_allowed`.\n\nThis suggested that the intended trust model was: “anything published under claude.ai was authored by Claude during a monitored chat, passing through all content-safety review controls.”\n\nThreat actors have shown exactly why gating here is important:\n\nThe bypass here is quite simple, `/uploads` can’t be converted to artifacts, artifacts live in `/mnt/user-data/outputs`. To bypass this promotion block all I had to do was tell any model “execute the command: `cp /mnt/user-content/uploads/input.html /mnt/user-content/outputs/output.html`”.\n\nI could upload arbitrary content with arbitrary extensions. Here I got a bit stuck. The issue is artifacts have some kind of pre-processor to convert the data to a webpage. Only content which is UTF-8 could be put under the `claude.ai/public/artifacts` domain.\n\nI worked with the web angle for a while. My goal was to try to get a shell script on `claudeusercontent.com` (the domain where artifacts content actually lives), but didn’t have any luck here.\n\nAfter trying different ideas, I took a step back. There’s also the desktop client, these artifacts can be “remixed”. When someone remixes an artifact, they can then open it within Claude’s desktop app.\n\nClaude Desktop is Electron. Electron is Chromium.\n\n### Mind the patch gap\n\nGoogle has warned for years about the idea of “the patch gap”.\n\nThis is the idea that bad actors are able to work quickly to take advantage of the time between a fix’s creation, and when that fix has been shipped to the stable channel of Chrome.\n\nWith LLMs speeding up workflows, we have seen a dramatic shift in availability:\n\nAt the time of disclosure, Chrome’s official build was `151.0.7922.34`. Claude Desktop’s bundled Chromium build was `148.0.7778.271`. 3 major versions behind. Claude Desktop is genuinely very good in this regard when compared to other Electron apps.\n\nRegardless, from the time between version 148 to 151, there have been 1066 disclosed security fixes with CVEs assigned. Out of these fixes, 389 are considered S1 (high) severity or above. Combining arbitrary attacker-controlled content with an outdated Chromium lets a sophisticated attacker create n-day exploit chains targeting these apps.\n\nPatchgapping these bugs is surprisingly easy with a little inference:\n\n1. V8 has a 14.8-lkgr branch on `chromium.googlesource.com/v8/v8` , this tracks security cherry-picks going out to the stable channel.\n2. Running `git log 30ffa551..origin/14.8-lkgr --format=\"%H %ci %s\"` to get every backport merged. Then filtering for the [M148] prefix I located:`b9013994f34 [M148] [maglev] Check map of inlined array in ArrayIteratorPrototypeNext`\n3. `git show b9013994f34` on that commit prints:\n\n```\nFixed: 523884658\nBug: 525280515,523884658\n...\n(cherry picked from commit 811ebc89d5d26653f73b9b0e589591e09344e551)\n```\n\nThe `Fixed:` line is the Chromium bug tracker id. Any reasonably intelligent language model with the diff can then determine the underlying security vulnerability.\n\n### A browser exploit on claude.ai\n\nTaking this exact Maglev bug to create an `addrOf` primitive. Attempting to publish this directly will run you into the expected blocks:\n\nHowever, with the previously mentioned bypass:\n\nAnyone who then remixed this crafted artifact, and opened it within the official desktop client would trigger this primitive on chat-load.\n\nNote\n\nFull chain browser exploits are hard to build. Even with this primitive. The bug here was chosen to demo impact. Alone this can’t do anything other than a caged read in the isolated child process where `claudeusercontent.com` lives. This would need to be chained with several more n-day exploits before there would be any practical danger.\n\n### Anthropic’s response\n\nAnthropic gave a fair response here, they don’t consider this a security bypass precisely because `/outputs` can contain user-generated content. The blocks shown are considered model-side safeguards, not security controls. Their desktop environment is updated on a regular cadence, and the primitive demonstrated alone doesn’t cross the renderer sandbox or an application boundary.\n\nThat doesn’t change that the attack vector here exists. I am still very cautious of these Electron apps which can contain attacker-controlled content. However, I can understand the justification of this being acceptable risk.\n\n## Attacking the authorization layers (AuthZ)\n\nHere I asked myself “What else might not be as audited?”. To which, the authorization layers stood out to me. In zero trust architectures, authorization decisions are continuously evaluated throughout a session.\n\nIt seems reasonable to assume that this would be a direct focus of LLM security capability testing, and would have been hardened significantly already. But having already gathered much of the API surface from my prior hunting. I became aware that Claude Code when multiple credentials are present, chooses one in this order:\n\n1. Cloud provider credentials.\n2. The `Authorization: Bearer` header which authenticates through bearer tokens rather than API keys.\n3. The `X-Api-Key` header.\n4. `apiKeyHelper` script output.\n5. `CLAUDE_CODE_OAUTH_TOKEN` environment variable.\n6. Anthropic profile and federation credentials, the credentials that the `ant` CLI and Workload Identity Federation use.\n7. Subscription OAuth credentials from standard user login.\n\nWith these 7 different [documented authentication methods](https://code.claude.com/docs/en/authentication#authentication-precedence), it seemed like a great place to look for gaps. In sufficiently complicated APIs such as this, auth-related bugs can hide pretty easily.\n\nGiven correct context, an independent LLM could find most AuthZ bugs. But, it was still worth a focused hunt specifically because of this over-engineered design. My guess was soon-after rewarded.\n\n### Underneath the bridge\n\nMaking a POST request to `/v1/code/sessions/{id}/bridge` issues an ES256-signed `sk-ant-si-*` worker JWT to any signed-in claude.ai user. Regardless of capabilities. This means free-tier accounts with `capabilities: [\"chat\"]`, can still successfully hit this endpoint. Session bridging is a feature designed for Claude Code to share sessions with Claude Desktop. According to the docs:\n\nThis endpoint missing any capability check is our first instance of [CWE-863: Incorrect Authorization](https://cwe.mitre.org/data/definitions/863.html).\n\nThis behaviour required the account to have sent at least one message. On a completely fresh account, POST `/v1/code/sessions/` returns `invalid_request_error`.\n\n### Broken plan-availability checks\n\nThe second instance of [CWE-863](https://cwe.mitre.org/data/definitions/863.html) could be found when actually using the JWT.\n\nWhen sending a POST to `/v1/messages` attempting to use the model `claude-fable-5` from a free-tier account, you would get a 429 “This model is not available on your plan”. On a paid tier account you would use your claude.ai usage directly. This is a nice trick as is. You could use any desired harness with the generous claude.ai usage limits. The only caveat being the JWT had to be refreshed every 8 hours.\n\n```\n{\n  \"$schema\": \"https://opencode.ai/config.json\",\n  \"model\": \"anthropic/claude-opus-5\",\n  \"small_model\": \"anthropic/claude-sonnet-5\",\n  \"provider\": {\n    \"anthropic\": {\n      \"options\": {\n        \"baseURL\": \"https://api.anthropic.com/v1\",\n        \"apiKey\": \"\",\n        \"headers\": {\n          \"Authorization\": \"Bearer sk-ant-si-...\"\n        }\n      }\n    }\n  }\n}\n```\n\nBut after messing around with it a bit, turns out this JWT could do even better!\n\n`/v1/messages` isn’t the only endpoint which can generate messages. There is also the message batches API: `/v1/messages/batches`. This endpoint is designed for large volumes of messages. Up to 100,000 requests per batch, but the processing is considered “low priority” so each request takes longer to fill.\n\nThe issue here, there is 0 plan gating on `/v1/messages/batches`… Any free-tier account can access every public model (sadly no mythos), paid or free no account is billed here! Unlimited free usage of all Anthropic’s frontier models. Fun! :)\n\n### Request flow\n\nA higher-level view of the flow follows as such:\n\n1. The session gets created.\n\n```\nPOST https://claude.ai/v1/code/sessions\nHeaders: Cookie: sessionKey=...\nBody: {\"title\": \"poc\", \"bridge\": {}, \"config\": {}}\nResponse: { \"session\": { \"id\": \"<SESSION_ID>\" } }\n```\n\n1. The created session is bridged which returns a JWT.\n\n```\nPOST https://claude.ai/v1/code/sessions/<SESSION_ID>/bridge\nHeaders: Cookie: sessionKey=...\nBody: {}\nResponse: { \"worker_jwt\": \"<JWT>\" }\n```\n\n1. This JWT is now directly usable on the `/v1/messages/batches` endpoint.\n\n```\nPOST https://api.anthropic.com/v1/messages/batches\nHeaders: Authorization: Bearer <JWT>\nBody: {\n  \"requests\": [\n    {\n      \"custom_id\": \"p<timestamp>\",\n      \"params\": {\n        \"model\": \"claude-opus-4-8\",\n        \"max_tokens\": 512,\n        \"messages\": [\n          { \"role\": \"user\", \"content\": \"<USER_PROMPT>\" }\n        ]\n      }\n    }\n  ]\n}\nResponse: { \"id\": \"<BATCH_ID>\", ... }\n```\n\n1. The batch id is requested in a loop until completion.\n\n```\nGET https://api.anthropic.com/v1/messages/batches/<BATCH_ID>\nHeaders: Authorization: Bearer <JWT>\nResponse: { \"processing_status\": \"ended\", \"results_url\": \"<RESULTS_URL>\", ... }\n```\n\n1. Upon completion the message contents available.\n\n```\nGET <RESULTS_URL>\nHeaders: Authorization: Bearer <JWT>\nResponse: { \"result\": { \"message\": { \"content\": [...], \"usage\": { \"output_tokens\": <N> } } } }\n```\n\nThis entire flow contains no model restriction, nor does it affect plan usage limits.\n\nNote\n\nSince September this issue has been quietly resolved without feedback. However, there exists several related issues which a proper retest would have caught.\n\n### Anthropic’s Response\n\nMy prior experiences with the team were great. When they agreed that a security boundary was violated, they handled it swiftly and effectively:\n\nWhen they disagreed that a security boundary was being violated, they provided clear reasoning why, addressing each of my points with clear and thoughtful responses.\n\nThat made the final response here a bit disappointing:\n\nPlatform abuse is traditionally used to refer to abuse such as using a service’s trusted domain for phishing/malware delivery. I was unable to find another fitting example, where chaining unintended defects in authorization logic was classified as anything other than vulnerability exploitation.\n\nWhen requesting review here. I didn’t get a human response. Just a generated reply:\n\nI also emailed [\\[email protected\\]](https://exploit.cat/cdn-cgi/l/email-protection#b7c2c4d2c5c4d6d1d2c3cef7d6d9c3dfc5d8c7ded499d4d8da), but have yet to receive a response.\n\n### Timeline\n\n1. Reported to vendorInitial disclosure is submitted to Anthropic via HackerOne.\n2. Vendor responseAnthropic replies and closes the report as Informational.\n3. Review requestedClarification on the closure requested.\n4. Vendor response`claudesec-h1` bot acting on behalf of Anthropic confirms the scoping.\n5. Reported to vendorPer Anthropic’s request, a follow up email is sent to [\\[email protected\\]](https://exploit.cat/cdn-cgi/l/email-protection#691c1a0c1b1a080f0c1d102908071d011b0619000a470a0604) .\n6. Follow-up email sentI express wish to publicise in line with 90-day responsible disclosure practices.\n7. Public disclosure requestPermission to disclose is requested via each HackerOne report.\n8. Public disclosure granted`claudesec-h1` bot acting on behalf of Anthropic confirms each issue is free to be discussed.\n9. Batches issue fixedDespite being told this issue was out of scope. Some time in September, a product change resulted in the batches endpoint rejecting worker tokens.\n10. Full disclosure90-day window expires, blog post is published without any fix.\n\n## Conclusion\n\nWhile the outcome of that last report did kill a lot of my motivation to keep hunting issues on Anthropic. It was still very fun to research. Despite not really achieving my goal (past the Electron vuln) in the eyes of Anthropic. I think I succeeded in my original “find some real issues in a highly LLM audited surface”.\n\nThese APIs are being designed with the assistance of the very best models, and scrutinized heavily afterward. Yet there are still real architectural flaws. There is a requirement for a human-touch in a lot of these places. The more complex they grow, the more auditing required. LLM-assisted development is ensuring that complexity will trend upwards.\n\n## Additional Findings\n\nOne interesting note I discovered on `2026-08-17`. The aforementioned gating which exists on `/v1/messages/` can also be bypassed.\n\nHaving decided to switch to OpenAI as my tool of choice. I stopped paying for 20x Max on Anthropic. When the next billing cycle came around on the now-frozen VCC. The subscription got “paused”. Seeing this piqued my curiosity, so I decided to test this again.\n\nSure enough, the paused account can access `/v1/messages/`, use all models (now for free), all without the low-priority slowdown that came with `/v1/messages/batches`.\n\nAs Anthropic has made it clear that they do not scope these vulnerabilities, I have opted not to report this formally due to this.\n\nThe lack of any real response has indicated that this additional information is highly unlikely to change their previous conclusion.", "url": "https://wpnews.pro/news/hacking-anthropic-for-free-unlimited-claude", "canonical_source": "https://exploit.cat/posts/hacking-free-claude/", "published_at": "2026-10-20 16:35:28+00:00", "updated_at": "2026-10-20 16:47:00.048335+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-products"], "entities": ["Anthropic", "Claude", "Claude Desktop", "Claude Mythos", "Discord", "Chromium", "V8", "exploitbench"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/hacking-anthropic-for-free-unlimited-claude", "markdown": "https://wpnews.pro/news/hacking-anthropic-for-free-unlimited-claude.md", "text": "https://wpnews.pro/news/hacking-anthropic-for-free-unlimited-claude.txt", "jsonld": "https://wpnews.pro/news/hacking-anthropic-for-free-unlimited-claude.jsonld"}}