Hacking Anthropic For Free Unlimited Claude A security researcher published a 90-day responsible-disclosure writeup describing how several bugs in Anthropic's API let a free-tier account obtain unlimited inference across Anthropic's language models, and warned that some of the described issues remain unfixed. The researcher framed the work as probing gaps in long-horizon reasoning that Anthropic's models miss, noting that Anthropic tops the exploitbench leaderboard for models best at hacking and that its Claude Mythos model can build a full V8 exploit chain at a cost of roughly $2,700. The account began with an analysis of Claude Desktop and cites a previously over-2-year-outdated bundled Chromium 138 in Discord's Desktop Client, where the researcher achieved control-flow hijacking after 2+ weeks of study. Hacking Anthropic For Free Unlimited Claude How a few bugs in Anthropic's API gave me access to unlimited inference across Anthropic's language models from a free-tier account Contents Warning Despite my best efforts, some of the described issues remain unfixed. This is being published in line with 90-day responsible disclosure. Recently there has been a lot of talk about LLM’s hacking all kinds of things. It’s talked about so much it’s stopped being interesting to hear about. Half the articles I see read as PR stunts at this point https://bsky.app/profile/ceej.online/post/3mrx2xflgp22d . With the increasing capabilities LLMs like Claude have began to offer, lots of people are uncertain about the future. Witnessing this uncertainty made me want to challenge myself. Assuming Anthropic to be heavily architected, reviewed, and built by their very best models. I wanted to see if I could find flaws that their models missed. Why Anthropic? Anthropic, according to the exploitbench rankings https://exploitbench.ai/ leaderboard , holds the title of “research-lab with the best models for hacking”. These scores are generated by the models creating exploit chains targeting V8, the JavaScript engine that powers Chrome. I can personally attest to the difficulty here. Having spent 2+ weeks learning browser-exploitation. I managed to perform control-flow hijacking in Discord’s Desktop Client, with its previously over 2-year-outdated bundled Chromium 138. If Claude Mythos can do this alone at a cost of ~$2,700 to full chain, what hope does a human have of competing? Anthropic sets the prices, surely Mythos is running on a loop flagging and fixing all the internal security flaws? Where humans thrive Something I am sure many others have noticed. Large language models just aren’t very good at looking deep into the future. They are amazing at processing what is directly in front of them. Yet they don’t seem to possess a uniquely human ability to visualise the future. Given a sufficient degree of separation from the goal, even the best LLMs collapse. This becomes more clear when these models are given tasks such as playing a game of chess. It’s funny, but it’s also revealing. These models have come leaps and bounds from where they once were, and are now surprisingly good at long term reasoning. However, it isn’t anywhere near “inhuman”. The same model which can generate a full-chain V8 exploit in an afternoon is unable predict a 2-move sequence. With all the knowledge the model has on chess, it still doesn’t show true understanding and ability past an intermediate level. This isn’t to say that these models aren’t incredibly intelligent. To suggest otherwise would be dishonest. It does however, reveal the gap where humans are still able to outclass these models in reasoning. How does this apply to hacking? Many people say hacking is just pattern recognition. This is true in large. Just like in chess to do either well requires a degree of creativity. Creativity that LLMs don’t seem to truly possess. It’s likely true that certain classes of bugs are gradually going to be eliminated; V8 type confusions, buffer overflows, and similar well established patterns. But I would disagree with ideas such as: Hyper-intelligent LLMs only change the landscape of hacking. Even if every browser exploit was fixed tomorrow. There are still intentionally open doors, e.g., launching applications via URI protocols. Just because your browser is now safe, doesn’t mean every application it can launch is. At the end of the day, does it matter to the person who was just compromised in 1-click if that 1-click was “by design”? Anthropic’s surface is surprisingly complex When planning how to attack Anthropic, I went into it with this exact mindset. I wanted to look at the gaps that are more difficult for a pattern recognition tool to recognise patterns in. I started by pulling apart Claude Desktop. I already had a pretty cool Electron vulnerability https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g going into this. This made the Electron-based Claude Desktop app seem like a reasonable target. Note Planning on posting about this Electron vulnerability soon. Just waiting on MSRC to fix a final stage of this. All together it makes a fun no-click chain. After a bit of looking, I found that you could exploit this vulnerability in claude.ai artifacts https://claude.com/resources/tutorials/intro-to-artifacts . On reporting this the team running the Anthropic HackerOne program had this handled incredibly fast. I was paid 22 days from time of report, and a fix was deployed shortly after. Honestly a pleasure working with the program here. Hunting further, I looked into their API surface. There are so many interesting things which could be researched. What interested me was the wiggle sandbox. Attacking the wiggle sandbox In any chat, if you request the model to execute a command/run a script, that chat will mount a “wiggle sandbox”. This sandbox is used as an isolation layer for running code while keeping it platform-agnostic. It’s really just a Linux mount. You are allocated about 10gb of storage. It has some custom Anthropic binaries such as a forked rsync . Interfacing with it is simply asking the model to run something. This interested me because flaws here wouldn’t be easy to catch in traditional code reviews. Model-behaviour isn’t code. I wanted to see what the /wiggle/ endpoints were allowed to do, and if there were asymmetries between what the models are allowed to do. Here I found an interesting gap. The wiggle sandbox is used for claude.ai artifacts https://claude.com/resources/tutorials/intro-to-artifacts . The same sandbox which you can execute commands by-proxy, and upload files to, also handles the data which can be published to claude.ai/public/artifacts . Files uploaded through /wiggle/upload-file will end up in /mnt/user-data/uploads . If you then attempt to use the wiggle endpoint for creating an artifact /wiggle/convert-file-to-artifact/ { path: /uploads/... } you will correctly get a HTTP 400 https://http.cat/400 response with the message: wiggle artifact promotion path not allowed . This suggested that the intended trust model was: “anything published under claude.ai was authored by Claude during a monitored chat, passing through all content-safety review controls.” Threat actors have shown exactly why gating here is important: The bypass here is quite simple, /uploads can’t be converted to artifacts, artifacts live in /mnt/user-data/outputs . To bypass this promotion block all I had to do was tell any model “execute the command: cp /mnt/user-content/uploads/input.html /mnt/user-content/outputs/output.html ”. I could upload arbitrary content with arbitrary extensions. Here I got a bit stuck. The issue is artifacts have some kind of pre-processor to convert the data to a webpage. Only content which is UTF-8 could be put under the claude.ai/public/artifacts domain. I worked with the web angle for a while. My goal was to try to get a shell script on claudeusercontent.com the domain where artifacts content actually lives , but didn’t have any luck here. After trying different ideas, I took a step back. There’s also the desktop client, these artifacts can be “remixed”. When someone remixes an artifact, they can then open it within Claude’s desktop app. Claude Desktop is Electron. Electron is Chromium. Mind the patch gap Google has warned for years about the idea of “the patch gap”. This is the idea that bad actors are able to work quickly to take advantage of the time between a fix’s creation, and when that fix has been shipped to the stable channel of Chrome. With LLMs speeding up workflows, we have seen a dramatic shift in availability: At the time of disclosure, Chrome’s official build was 151.0.7922.34 . Claude Desktop’s bundled Chromium build was 148.0.7778.271 . 3 major versions behind. Claude Desktop is genuinely very good in this regard when compared to other Electron apps. Regardless, from the time between version 148 to 151, there have been 1066 disclosed security fixes with CVEs assigned. Out of these fixes, 389 are considered S1 high severity or above. Combining arbitrary attacker-controlled content with an outdated Chromium lets a sophisticated attacker create n-day exploit chains targeting these apps. Patchgapping these bugs is surprisingly easy with a little inference: 1. V8 has a 14.8-lkgr branch on chromium.googlesource.com/v8/v8 , this tracks security cherry-picks going out to the stable channel. 2. Running git log 30ffa551..origin/14.8-lkgr --format="%H %ci %s" to get every backport merged. Then filtering for the M148 prefix I located: b9013994f34 M148 maglev Check map of inlined array in ArrayIteratorPrototypeNext 3. git show b9013994f34 on that commit prints: Fixed: 523884658 Bug: 525280515,523884658 ... cherry picked from commit 811ebc89d5d26653f73b9b0e589591e09344e551 The Fixed: line is the Chromium bug tracker id. Any reasonably intelligent language model with the diff can then determine the underlying security vulnerability. A browser exploit on claude.ai Taking this exact Maglev bug to create an addrOf primitive. Attempting to publish this directly will run you into the expected blocks: However, with the previously mentioned bypass: Anyone who then remixed this crafted artifact, and opened it within the official desktop client would trigger this primitive on chat-load. Note Full chain browser exploits are hard to build. Even with this primitive. The bug here was chosen to demo impact. Alone this can’t do anything other than a caged read in the isolated child process where claudeusercontent.com lives. This would need to be chained with several more n-day exploits before there would be any practical danger. Anthropic’s response Anthropic gave a fair response here, they don’t consider this a security bypass precisely because /outputs can contain user-generated content. The blocks shown are considered model-side safeguards, not security controls. Their desktop environment is updated on a regular cadence, and the primitive demonstrated alone doesn’t cross the renderer sandbox or an application boundary. That doesn’t change that the attack vector here exists. I am still very cautious of these Electron apps which can contain attacker-controlled content. However, I can understand the justification of this being acceptable risk. Attacking the authorization layers AuthZ Here I asked myself “What else might not be as audited?”. To which, the authorization layers stood out to me. In zero trust architectures, authorization decisions are continuously evaluated throughout a session. It seems reasonable to assume that this would be a direct focus of LLM security capability testing, and would have been hardened significantly already. But having already gathered much of the API surface from my prior hunting. I became aware that Claude Code when multiple credentials are present, chooses one in this order: 1. Cloud provider credentials. 2. The Authorization: Bearer header which authenticates through bearer tokens rather than API keys. 3. The X-Api-Key header. 4. apiKeyHelper script output. 5. CLAUDE CODE OAUTH TOKEN environment variable. 6. Anthropic profile and federation credentials, the credentials that the ant CLI and Workload Identity Federation use. 7. Subscription OAuth credentials from standard user login. With these 7 different documented authentication methods https://code.claude.com/docs/en/authentication authentication-precedence , it seemed like a great place to look for gaps. In sufficiently complicated APIs such as this, auth-related bugs can hide pretty easily. Given correct context, an independent LLM could find most AuthZ bugs. But, it was still worth a focused hunt specifically because of this over-engineered design. My guess was soon-after rewarded. Underneath the bridge Making a POST request to /v1/code/sessions/{id}/bridge issues an ES256-signed sk-ant-si- worker JWT to any signed-in claude.ai user. Regardless of capabilities. This means free-tier accounts with capabilities: "chat" , can still successfully hit this endpoint. Session bridging is a feature designed for Claude Code to share sessions with Claude Desktop. According to the docs: This endpoint missing any capability check is our first instance of CWE-863: Incorrect Authorization https://cwe.mitre.org/data/definitions/863.html . This behaviour required the account to have sent at least one message. On a completely fresh account, POST /v1/code/sessions/ returns invalid request error . Broken plan-availability checks The second instance of CWE-863 https://cwe.mitre.org/data/definitions/863.html could be found when actually using the JWT. When sending a POST to /v1/messages attempting to use the model claude-fable-5 from a free-tier account, you would get a 429 “This model is not available on your plan”. On a paid tier account you would use your claude.ai usage directly. This is a nice trick as is. You could use any desired harness with the generous claude.ai usage limits. The only caveat being the JWT had to be refreshed every 8 hours. { "$schema": "https://opencode.ai/config.json", "model": "anthropic/claude-opus-5", "small model": "anthropic/claude-sonnet-5", "provider": { "anthropic": { "options": { "baseURL": "https://api.anthropic.com/v1", "apiKey": "", "headers": { "Authorization": "Bearer sk-ant-si-..." } } } } } But after messing around with it a bit, turns out this JWT could do even better /v1/messages isn’t the only endpoint which can generate messages. There is also the message batches API: /v1/messages/batches . This endpoint is designed for large volumes of messages. Up to 100,000 requests per batch, but the processing is considered “low priority” so each request takes longer to fill. The issue here, there is 0 plan gating on /v1/messages/batches … Any free-tier account can access every public model sadly no mythos , paid or free no account is billed here Unlimited free usage of all Anthropic’s frontier models. Fun : Request flow A higher-level view of the flow follows as such: 1. The session gets created. POST https://claude.ai/v1/code/sessions Headers: Cookie: sessionKey=... Body: {"title": "poc", "bridge": {}, "config": {}} Response: { "session": { "id": "