Claude Bug Bounty & AI Security Research Guide

1. What the Anthropic Model Safety Bug Bounty is

Anthropic's Model Safety Bug Bounty is an invitation-only program run on HackerOne, focused narrowly on finding universal jailbreaks — single attacks that defeat Claude's ASL-3 safeguards across a wide range of harmful queries, not just one. It is explicitly not a generic AppSec program; bugs in claude.com the website go through Anthropic's separate responsible-disclosure channel.

The program exists because Anthropic's Responsible Scaling Policy commits the company to publishing model capabilities only when empirically-tested safeguards hold. The bounty is how those safeguards get pressure-tested by outside researchers under NDA before any public disclosure.

2. Scope — what actually counts

Anthropic publishes a fixed question set (largely CBRN — chemical, biological, radiological, nuclear — uplift questions) inside the program. A "universal jailbreak" for bounty purposes is a single prompt template or technique that elicits ASL-3-tier answers to a substantial fraction of those questions, on a current production Claude alias, reproducibly.

In scope:

• Universal jailbreaks against Claude Opus / Sonnet / Haiku current versions.
• Constitutional Classifier bypasses that meaningfully reduce ASL-3 protection.
• Novel attack techniques (e.g. the AFL class) with reproducible test artifacts.

Out of scope:

• Single-question jailbreaks ("tricked Claude into writing a phishing email once") — pay zero.
• Hallucinations, refusals, brand-safety issues.
• App-layer bugs in third-party Claude integrations — those belong to the operator's program.
• Bugs in claude.com / console.anthropic.com — separate disclosure channel.
• Capability disclosures (model leaks knowledge that already exists on Google).

3. How to apply and what to expect

1. Apply via the application form linked from the Anthropic bug-bounty page. Include a brief research portfolio: prior jailbreak disclosures, AI-security publications, CTF placements, or HackerOne reputation.
2. On acceptance you receive a HackerOne private-program invite, NDA paperwork, the model alias (often a specific snapshot), and the question set.
3. You test only against the provided alias, under the NDA. No public posts, no Twitter screenshots, no GitHub gists until disclosure is coordinated.
4. Reports are triaged by Anthropic's safety team. Bounty awards on the sliding scale, paid via HackerOne.
5. Coordinated disclosure window typically 90 days, extendable for systemic issues.

Sliding-scale rewards run roughly $1,000 (partial bypass) to $35,000 (clean universal jailbreak meeting full scope). Constitutional Classifier-specific bypasses sit in a separate tier announced per round.

4. Claude Security — the defensive product

Conflating the bounty with the product: Anthropic also ships Claude Security, an agentic vulnerability scanner/patcher aimed at defender teams. It is the commercial-side bookend of the bounty program: bounty finds the novel ASL-3 attacks, Claude Security finds the prosaic CWE bugs in customer code at scan time.

Practical differences vs traditional SAST:

• Reports findings with proposed patches, not just diff line numbers — much higher triage throughput.
• Reasons across files (data-flow, multi-hop taint) where SAST relies on signature rules.
• Integrates into Claude Enterprise; CyberGym benchmark places it ahead of established SAST tools on real-world repos.
• Higher false-negative rate on novel framework patterns than mature SAST, lower false-positive rate overall.

Researchers should think of Claude Security as a competitor target, not a competitor: bypasses, blind-spots, and adversarial patches are all interesting research areas.

5. AI bug bounty programs compared (2026)

Practical advice: open-platform programs (OpenAI, Google, Microsoft, huntr) are where new researchers should start. Anthropic and the closed enterprise programs reward existing reputation. Application-layer bugs in third-party Claude integrations consistently pay better than model-layer bugs because severity translates directly to traditional CVSS.

6. Claude Code as a bug-bounty agent

Independent of bounty on Claude, more and more bounty hunters use Claude Code as a force-multiplier on classic web/app bounty programs. The typical workflow:

1. Recon — feed scope into Claude Code, let it run subfinder, httpx, nuclei templates, and triage the JSON output. Output: a ranked list of interesting endpoints with one-line rationales.
2. Source review — for programs with open-source or leaked source, point Claude at the repo and ask for authentication, authorization, deserialization, and template injection sinks with concrete data-flow chains.
3. Payload generation — use our 300+ cybersecurity prompts as the input layer. Each prompt enforces the "check before exploit" pattern so Claude doesn't blast prod with raw payloads.
4. Report drafting — Claude is genuinely good at this. Triagers prefer reports with a clear repro, impact, and remediation paragraph; Claude consistently produces all three.
5. Triage loop — when a triager asks for clarification, paste the question and the original report; Claude drafts a response in your voice. This single step saves the most hours per week.

What Claude is bad at: target selection (it cannot tell which endpoint is in-scope from a Bugcrowd brief unless you spoon-feed it), legal/ethical judgment, and any task requiring authenticated session state without a properly-permissioned MCP server. Keep those human.

7. AI vulnerability taxonomy worth chasing

• Prompt injection — see our pillar guide. Highest-volume reportable class across operator programs.
• RAG manipulation — write a document the retrieval layer indexes, attack future queries. Frequently OOB for the model program but in-scope for the operator.
• System prompt leakage — usually pays only if it exposes secrets or downstream credentials.
• Cross-user leakage / IDOR via agent — the highest-paying class. Treat the agent as another microservice and audit its multi-tenancy.
• Sandbox / tool escape — CVE-2025-54794/95 class in Claude Code itself, plus operator-side sandbox escapes.
• Supply-chain in AI/ML packages — huntr's sweet spot. Prototype pollution in JS LLM SDKs, deserialization in Python ML pipelines, model-file RCE (pickle, ggml).
• Cost / DoS — getting an operator to spend $X by inducing recursive tool calls or unbounded generation. Pays at enterprise programs, ignored elsewhere.

8. Severity & bounty economics

Severity in AI bounty programs trends harder than in classic AppSec because impact is fuzzy. A heuristic that works:

• Does your finding cross a tenant boundary, an authentication boundary, or a payment boundary? If yes: High/Critical, expect mid-four to five-figure payouts.
• Does it exfiltrate operator secrets (API keys, infra creds, PII of another user)? Critical.
• Does it only embarrass the operator (rude output, brand-safety fail)? Low or out-of-scope.
• Is it a single-instance jailbreak with no operator impact? Out-of-scope.

File reports with: clean repro (under 100 lines if possible), explicit impact statement, suggested remediation, and CWE/CVSS mapping. Triagers reward investment.

9. Disclosure templates & resources

• Report skeleton: Summary → Affected component → Reproduction (step-by-step, with exact prompts/payloads) → Impact → Suggested remediation → References → Disclosure timeline.
• OWASP LLM Top 10 (2025) — use the IDs in your summary line; triagers index on them.
• OWASP Agentic AI Top 10 — ASI01–ASI10 for agent-class findings.
• MITRE ATLAS — TTPs for ML-attack findings; use the technique IDs the same way you would ATT&CK.
• AI Incident Database — search for prior art before disclosing; novelty raises payout.

10. FAQ

Do I need to be a famous researcher to get into Anthropic's program?

No, but a portfolio helps. Public AFL-class write-ups, accepted OpenAI/Google AI VRP reports, AI-CTF placements, or peer-reviewed adversarial-ML work all clear the bar.

What if I find a critical bug in claude.com itself?

Use Anthropic's general security disclosure email — not the Model Safety program. The two are administratively separate.

Can I monetise a Claude Code vulnerability?

Yes — Claude Code bugs (sandbox escape, deny-list bypass, MCP composition leading to RCE) generally route through Anthropic's product-security channel, not the Model Safety program, and have historically resulted in CVE assignment plus payment.

Where do I start as a beginner?

Pick one open AI program (huntr is the friendliest), one CWE class you already know (prototype pollution, deserialization, SSRF), and look for it in popular AI/ML packages. Build a portfolio of 2–3 valid reports before applying to closed programs.