Anthropic bug bounty programs
anthropic.com Updated
Anthropic runs three public programs: a HackerOne bug bounty paying up to $10,000, a Sorona bug bounty paying up to $3,125 and a HackerOne disclosure program with no cash rewards.
- Top reward
- $10,000
- HackerOne
- Programs
- 3
- 2 pay cash
- Targets in scope
- 27
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Anthropic
HackerOne · Pays the most of the 3 programs: up to $10,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Anthropic
HackerOne · Bug bounty |
$10k (highest) | $5,000 (highest) | $2,500 (highest) | $750 (highest) | $10,000 | Full | – | 12 hours average | Open |
|
Anthropic SDKs
Sorona · Bug bounty |
– | $3,125 | $938 | $313 | $3,125 | Partial | Required | 3 days promised | Open |
|
Anthropic Cyber Jailbreak
HackerOne · Disclosure only |
– | – | – | – | No cash | Full | – | – | Open |
-
- Critical
- $10k (highest)
- High
- $5,000 (highest)
- Medium
- $2,500 (highest)
- Low
- $750 (highest)
- Safe harbor
- Full
- First response
- 12 hours average
-
- Critical
- –
- High
- $3,125
- Medium
- $938
- Low
- $313
- Safe harbor
- Partial
- KYC
- Required
- First response
- 3 days promised
-
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
27 targets across all 3 programs, each listed once with the programs that cover it. 8 excluded.
-
Anthropic's hosted assets sit on the same program as their own rows: api.anthropic.com and console.anthropic.com at [Core], docs.anthropic.com and support.anthropic.com at [Non-Core]. Impact on them is worth demonstrating, since the org row's own carve-out turns on whether a finding reaches an Anthropic asset
Products and areas
Covered by Sorona
-
Claude Code, which the program scopes separately at the higher Core rates
Products and areas
Covered by Sorona
-
Claude Desktop Extensions and Claude.ai MCP servers
Products and areas Critical
Covered by Anthropic
-
GitHub Action vulnerabilities in in-scope repositories, which the program accepts and prices as non-core
Products and areas
Covered by Sorona
-
The API client SDKs, anthropic-sdk-python and anthropic-sdk-typescript: credential handling, request construction, streaming and event parsing, retry logic, and the tool, memory and file helpers layered on top
Products and areas
Covered by Sorona
-
The Claude Agent SDK for Python and TypeScript, the packaged form of the Claude Code agent loop, which runs with filesystem and shell tool access on developer and CI machines. Its tool layer, permission checks, sandboxing and subprocess handling are all inside the same asset
Products and areas
Covered by Sorona
-
The rest of the org: helper libraries, CLIs, examples and tooling that Anthropic still maintains, since the asset is declared at organisation level rather than repository by repository
Products and areas
Covered by Sorona
-
The structured scope carries github.com/anthropics as one org-wide SOURCE_CODE asset, eligible for bounty at maximum severity critical and tagged [Non-Core]. Every repository in the org that is neither archived nor a fork of another open source project is in scope, whatever it does
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 8
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
https://github.com/modelcontextprotocol
Anthropic
-
Anyone the program's sanctions screening excludes, which is applied before an award can be paid
Sorona
-
Archived repositories in the github.com/anthropics organisation
Sorona
-
Everything under github.com/modelcontextprotocol, which is marked ineligible for bounty and ineligible for submission. Those go to the MCP maintainers via each repo's security page
Sorona
-
github.com/modelcontextprotocol/servers-archived, likewise carrying no severity and no bounty eligibility
Sorona
-
Model behaviour of every kind: jailbreaks, prompt injections that only change what Claude says, and hallucinated or unsafe output
Sorona
-
Repositories that are forks of other open source projects, unless the issue can be demonstrated to impact Anthropic assets
Sorona
-
Third-party MCP implementations generally, unless you can show impact on an Anthropic product or service such as claude.ai or Claude Desktop, which are in scope under their own assets
Sorona
Recent changes
Reward and scope changes across every Anthropic program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Anthropic products, from the NVD.
-
CVE-2026-111497 Critical
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie
-
CVE-2026-111497 Critical
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie
-
CVE-2026-111497 Critical
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie
-
CVE-2026-55607 High
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such
-
CVE-2026-55607 High
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such
-
CVE-2026-55607 High
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such
-
CVE-2026-46406 Medium
Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contai
-
CVE-2026-46406 Medium
Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contai
About this page
This page gathers every public program listed under anthropic.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.