Anthropic Cyber Jailbreak

Anthropic Cyber Jailbreak Program on H1

The security of our AI systems and the integrity of our model safeguards are core to Anthropic's mission. We appreciate the work of researchers acting in good faith to identify and report potential jailbreaks of our cyber-relevant safety controls.

Scope

This program is specifically focused on findings where Claude's responses could meaningfully assist an attacker in performing cyber operations beyond what they could accomplish with existing publicly available tools on Claude Fable 5.1 

This program does not cover:

• Cyber jailbreaks on any Claude models other than Fable 5.1

• General content safety or jailbreaks not tied to meaningful cyber capability uplift

• Third-party systems or infrastructure not owned or operated by Anthropic

• Anthropic's general web and application infrastructure (covered under the Anthropic Security VDP)

Scope of Findings

This program covers technical findings where a jailbreak of Claude's cyber safeguards could produce meaningful real-world capability uplift for an attacker---for example:

• Techniques that cause Claude to produce functional exploit code, working malware, or detailed attack infrastructure it would otherwise refuse

• Prompting approaches that extract domain-expert-level guidance on offensive cyber techniques that the model is designed to decline

• Jailbreaks that work at scale or across multiple offensive task categories

This program excludes, subject to Anthropic's discretion:

• Findings where the output Claude produces is already equivalent to what an attacker could obtain from publicly available tools, search engines, or open-source resources without meaningful additional uplift

• Single-instance or highly brittle techniques that are not reliably reproducible

• Findings where the capability unlocked does not require Claude's assistance to a meaningful degree (e.g., Claude produces partial output a domain expert would still need to complete independently)

• Red-teaming or adversarial testing coordinated directly by Anthropic

• Denial of service or availability attacks against Anthropic infrastructure

How We Assess Severity

We are focused on jailbreaks we consider high and critical. Please note, how we assess severity is subject to change. 

We score a given jailbreak on the four different criteria below.

1. Capability gain. How far beyond existing tools does the jailbreak take the user? If existing widely-available tools (including other, weaker AI models) can reach the same capability as the jailbroken model, the score here will be low; if the jailbreak unblocks model capabilities that can significantly accelerate even domain experts, the score will be high.

2. Breadth of capability gain. For how many distinct offensive tasks does the same jailbreak technique work? Cases where the jailbreak only allows the model to pursue narrow targets will score low; cases where the same jailbreak technique works for multiple different targets or techniques will score high.

3. Ease of weaponization. How much human effort does it take to turn the jailbreak into an attack? Where the jailbreak involves a great deal of skilled prompting and many retries, the score will be low; where the jailbreak works on a single prompt or on the first or second try, the score will be high.

4. Discoverability. How easy is it for someone to obtain the technique? If it requires specialist knowledge it will score low; if it is already widely known and available online it will score high.

The severity rating displayed on a HackerOne report is set by the submitting researcher. It does not represent Anthropic's assessment of the finding. We work with HackerOne to independently assess each submission using the criteria above to determine how to handle the report.

Research Guidelines

When conducting research under this program, you agree to:

• Limit exploitation research to what is minimally required to demonstrate that the jailbreak exists. Do not use access to generate harmful outputs beyond a proof-of-concept sufficient to document the finding.

• Avoid accessing, acquiring, or using the content of any communications, data, or information beyond what is necessary to document your finding.

• Not exfiltrate, download, or retain any sensitive data you inadvertently access. If you inadvertently access such data, report it as part of your submission.

• Avoid disclosing the existence of or details relating to any finding to a third party or the public until you have received prior written notice from us. We fully support researchers' right to publicly disclose findings they discover. We ask only to coordinate on the timing of such disclosures to prevent potential harm. Researchers are free to report similar findings in other non-Anthropic AI systems---we will never attempt to restrict such disclosures.

• Not perform any actions that would degrade the availability or integrity of Anthropic's systems or services.

• Comply with all applicable laws in your jurisdiction when conducting research.

How to structure your report

To triage a report quickly, we need to be able to reproduce the behavior. Reports that cannot be reproduced cannot be validated. Please include all of the following:

1. Affected model: Confirm the report is against Claude Fable 5.1 (and the surface/interface used).

2. Message IDs / conversation reference: Include the relevant message ID(s) for every message in the exchange that demonstrates the jailbreak.

3. Full transcript(s): The complete, verbatim input(s) used to elicit the behavior, including any system prompt, prior turns, or setup required.

4. For Claude Code attach your transcript from ~/.claude/projects//.jsonl

5. Observed output: A description of the harmful output produced and why it constitutes meaningful cyber uplift. 

6. Reproduction steps: A clear, ordered, step-by-step path another person can follow to reproduce the result.

7. Reproducibility / reliability: How consistently the technique works (e.g., "succeeds ~8/10 attempts"), and any conditions required.

8. Reporter's severity assessment: Your view of the impact and why.

9. Supporting material: Screenshots, transcripts, or recordings as needed.

Reports missing message IDs or reproduction steps may be closed as not reproducible without further review.

Rules of engagement

• Test only against the in-scope model and surface, using your own accounts or designated test access.

• Do not attempt to access, modify, or destroy data that is not yours.

• Do not perform traditional infrastructure attacks (DoS/DDoS, brute force, spam) against Anthropic systems --- this program covers model-safety jailbreaks only.

• Do not use real, sensitive, or third-party harmful material in your testing where avoidable; the goal is to demonstrate the technique, not to generate live operational harm.

• Limit the volume of harmful content you generate to the minimum necessary to demonstrate the finding.

• Do not publicly disclose or distribute any harmful output produced during testing. See Disclosure Policy below.

Your Expectations of Us

All good-faith reports will be taken seriously. Upon responsibly disclosing a potential finding, you can expect us to:

• Promptly evaluate your submission and assess it against our severity framework.

• Take appropriate steps to address or mitigate the jailbreak to the extent appropriate and feasible.

Disclosure Policy

• Please follow HackerOne's disclosure guidelines. We fully support researchers' right to publicly disclose vulnerabilities they discover. We ask only that you coordinate the timing of disclosure with us to prevent potential harm to our services, customers, and other parties. Please do not disclose the existence of or any details relating to a discovered vulnerability to a third party or to the public until you have received written confirmation from us.

• Researchers are free to report similar vulnerabilities in other organizations' services --- we will never attempt to restrict such disclosures.

Safe Harbor

If you, in Anthropic's sole determination, make a good-faith effort to research and disclose a finding in accordance with this Policy and the Research Guidelines above, we will not pursue legal action against you because of your research or responsible disclosure, subject to Anthropic's compliance with applicable laws and legal obligations. To qualify for safe harbor, disclosures must be unconditional and may not involve extortion or threats.

Changes to This Policy

We reserve the right to make changes to this Policy at any time by publishing a new version and amending the date of last update. Findings disclosed prior to any update of this Policy will remain subject to the then-current policy in effect.