Anthropic SDKs

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Non-Core asset row, which is where the repos sit) │ $5,000 │ $6,000 High │ $2,500 │ $3,125 Medium │ $750 │ $938 Low │ $250 │ $313 Submit a vulnerability CVE history 6 Last 12 months 6 Lifetime Access control 35 % Code execution 25 % Info disclosure 25 % Parsing/validation 10 % Latest advisories Loading the feed Overview The Anthropic SDKs are the reference clients for the Claude API, and they ship inside a very large share of enterprise LLM integrations: usually arriving as a transitive dependency of whichever Python or TypeScript agent framework the team actually chose. The Claude Agent SDK is the packaged form of the Claude Code agent loop, and it runs with filesystem and shell tool access on developer workstations and CI machines, which is why every advisory published against these packages in the last twelve months has been sandbox-escape or file-permission work: all six CVEs on record landed in that window. The blast radius is developer and build infrastructure rather than public web servers, a different but not lesser risk profile. Anthropic pays them on HackerOne under an org-wide github.com/anthropics source-code asset, priced on the Non-Core row at $250 for Low up to $5,000 for Critical, with the higher Core rates reserved for the hosted services. sorona.xyz adds 1.25× on top of whatever Anthropic awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 3 business days (published acknowledgement commitment) First response ~14 hours Triage ~5 days Bounty In scope The structured scope carries github.com/anthropics as one org-wide SOURCE_CODE asset, eligible for bounty at maximum severity critical and tagged [Non-Core]. Every repository in the org that is neither archived nor a fork of another open source project is in scope, whatever it does The API client SDKs, anthropic-sdk-python and anthropic-sdk-typescript : credential handling, request construction, streaming and event parsing, retry logic, and the tool, memory and file helpers layered on top The Claude Agent SDK for Python and TypeScript, the packaged form of the Claude Code agent loop, which runs with filesystem and shell tool access on developer and CI machines. Its tool layer, permission checks, sandboxing and subprocess handling are all inside the same asset The rest of the org: helper libraries, CLIs, examples and tooling that Anthropic still maintains, since the asset is declared at organisation level rather than repository by repository GitHub Action vulnerabilities in in-scope repositories, which the program accepts and prices as non-core Claude Code, which the program scopes separately at the higher Core rates Anthropic's hosted assets sit on the same program as their own rows: api.anthropic.com and console.anthropic.com at [Core], docs.anthropic.com and support.anthropic.com at [Non-Core]. Impact on them is worth demonstrating, since the org row's own carve-out turns on whether a finding reaches an Anthropic asset Out of scope Everything under github.com/modelcontextprotocol , which is marked ineligible for bounty and ineligible for submission. Those go to the MCP maintainers via each repo's security page github.com/modelcontextprotocol/servers-archived , likewise carrying no severity and no bounty eligibility Archived repositories in the github.com/anthropics organisation Repositories that are forks of other open source projects, unless the issue can be demonstrated to impact Anthropic assets Model behaviour of every kind: jailbreaks, prompt injections that only change what Claude says, and hallucinated or unsafe output Third-party MCP implementations generally, unless you can show impact on an Anthropic product or service such as claude.ai or Claude Desktop, which are in scope under their own assets Anyone the program's sanctions screening excludes, which is applied before an award can be paid Most-valued findings Sandbox escape from the Claude Agent SDK's tool layer to arbitrary code execution or filesystem access outside the agent's working directory, the shape of the 2026 CVE cluster and the class that reaches Critical Access-control failure in tool permissioning, where an agent action completes despite the SDK's own allow and deny checks. Access control is the largest single bug class here Credential exposure through insecure default file permissions on anything the SDK writes to disk, the CVE-2026-34450 and CVE-2026-34451 pattern Tool output or server response that steers the client's control flow, turning attacker-controlled content into a privileged local action rather than merely a bad answer Parsing and validation flaws in streaming or tool-call handling that let malformed server output corrupt client state Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Use your HackerOne alias email and send the X-HackerOne-Handle header, which the program requires so your traffic is attributable Check the repository is neither archived nor a fork before writing it up, since both are excluded unless you can show the issue reaches an Anthropic asset Model behaviour is not a vulnerability here: jailbreaks, hallucinations and unsafe output are out of scope entirely Issues in the Model Context Protocol reference code go to the MCP maintainers directly, not to this program, which will not even accept the submission Sanctions screening applies before an award can be paid Hold all details until Anthropic gives written confirmation, which their terms require before any third party is told Program stats 379 Reports resolved $860k Bounties paid 98% Response efficiency Disclosure Coordinated through Anthropic on HackerOne, which acknowledges submissions within three business days but asks for written confirmation before any detail reaches a third party or the public. Because that clause can be read as covering a sorona.xyz-routed report, file directly with Anthropic first and let sorona.xyz follow the report rather than carry it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability