A security researcher published a write-up on October 20, 2026 titled "Hacking Anthropic For Free Unlimited Claude," saying that two authorization flaws in Anthropic's API surface let free-tier accounts run frontier models without being billed or limited. The author, writing on exploit.cat, also describes a bypass of artifact-publishing controls on claude.ai and a "patch gap" in the bundled browser engine of Claude Desktop. The post says it was published under a 90-day responsible-disclosure policy and that "some of the described issues remain unfixed." Anthropic has not, in anything we found, commented publicly.
Everything below is the researcher's account unless stated otherwise. We did not test any of it, and we are deliberately leaving out request-level reproduction details. This post separates claim from confirmation and covers what builders should do. For related abuse of AI credits, see our look at the AI credit resale market.
TL;DR: claimed vs verified
| Claim | Source | Status |
|---|---|---|
| Free accounts could obtain a session-bridge token despite lacking Claude Code access | exploit.cat write-up | Unverified by us; author says quietly fixed since September |
| Batches API had no plan gating, so free accounts could run public models unbilled | Same | Unverified; no Anthropic statement found |
| Anthropic closed the reports as informational and cited platform abuse | Same, with a timeline from July 22 to mid-August 2026 | Researcher's account of the vendor's replies |
| Artifact-promotion block can be bypassed by copying a file in the sandbox | Same | Anthropic reportedly calls the block a model-side safeguard, not a security control |
| Claude Desktop bundled Chromium 148 vs Chrome stable 151 at disclosure | Same | Researcher's figures; version gap is checkable |
| Any real-world exploitation | None reported | Not shown |
The claims in plain language
Authorization gaps: free tier to frontier models
The author describes a feature built to share Claude Code sessions with the desktop app. A call in that flow issued a signed worker token to any signed-in claude.ai user, including free accounts that lack Claude Code access. Anthropic's own documentation says Claude Code requires a Pro, Max, Team, Enterprise or Console account, so a missing capability check there is what the author labels CWE-863, incorrect authorization.
The second flaw, per the author, was in plan checks: the standard messages endpoint refused a premium model on a free plan with a "not available on your plan" error, but the batches endpoint, built for high-volume asynchronous jobs, reportedly had no plan gating. Combined, the author says, any free account could use all public models, without billing or draining plan limits, though not the unreleased Mythos model. The author adds that the token had to be refreshed every eight hours and that the batches route "has been quietly resolved" since September, without feedback.
We are not publishing the endpoints, sequence or payloads. If you operate an API, the lesson is general: gate every route, including the low-priority ones.
Artifacts and the "wiggle" sandbox
The second thread is about the code-execution sandbox that backs claude.ai artifacts. The author says uploads are blocked from being promoted into published artifacts, but that asking the model to copy a file into the outputs directory sidesteps the block. Crafted content could then be published under the claude.ai domain and "remixed" into the desktop app, which is built on Electron and therefore Chromium.
This matters because artifact hosting has already been abused. Huntress warned in July 2026 that a link to a real Claude artifact page was used to deliver an infostealer to 29 organizations, as the researcher cites. Our earlier coverage of Claude shared chats and artifacts being indexed and the artifacts and MCP connectors update shows how much content lives on these domains.
Anthropic's reported answer, per the author: it does not consider this a security bypass because the outputs folder can contain user-generated content; the blocks are "model-side safeguards, not security controls." The author concedes the demonstrated primitive was a caged read in an isolated child process and "alone can't do anything" harmful without chaining several more n-day exploits.
The patch gap
The author argues that AI makes n-day exploitation cheaper, since a model with a Chromium commit diff can work out the underlying vulnerability. At disclosure, the write-up says Chrome stable was 151.0.7922.34 while Claude Desktop's bundled Chromium was 148.0.7778.271, three major versions behind, with 1,066 disclosed security fixes in between, 389 of them high severity or above. The author says Claude Desktop is "genuinely very good" compared with other Electron apps. That is a measurable claim: anyone can check an installed app's Chromium version.
What Anthropic said, as reported
The write-up credits Anthropic's HackerOne team for a fast, courteous handling of an earlier artifacts-related Electron report, with payment 22 days after the report and a quick fix. For the authorization findings, the timeline shows the report on July 22, 2026, closure as informational on July 23, a review request on August 10 answered by an automated bot, and follow-ups to a security address in mid-August without a human response. The author calls the final classification of the issue as "platform abuse" a poor fit for chained authorization defects. We could not find an Anthropic comment disputing or confirming any of this.
Why this matters
- Authorization bugs are about business logic, not memory safety. The author's thesis is that AI-assisted code review catches pattern bugs, while flaws in who-may-do-what across seven documented authentication methods hide in complexity. Claude Code reportedly picks among cloud credentials, bearer tokens, API keys, helper scripts and OAuth tokens in a defined order; each added path is another check to get right.
- It is also about cost. Free access to premium models is real money. Platform teams should treat unmetered routes as a financial-risk class, not only a security one.
- AI-found vs human-found. The write-up was motivated by a question of whether bugs survive in a product partly built by frontier models, citing Anthropic's lead on ExploitBench and the company's Mythos 5 security scans. One case does not settle that debate, and the author acknowledges the model-found classes of bugs are shrinking.
Why batch endpoints are a classic blind spot
Batch APIs exist for volume: submit up to 100,000 requests, collect results later at lower priority. They are often built after the interactive endpoint, by a different team, and they sit behind separate routing and billing. When plan checks live in the interactive path, such as a model-availability error on the standard messages route, it is easy to forget to port them. That pattern is not specific to Anthropic; any provider with a synchronous API and an asynchronous twin has to prove the two enforce the same rules. A simple test is to take every denial you can trigger on the main route and replay it on every other route that can produce output.
Responsible disclosure and the 90-day clock
The write-up says it follows a 90-day responsible-disclosure policy, a norm popularized by Google's Project Zero: the researcher reports privately, gives the vendor roughly three months to fix, then publishes whether or not a fix exists. Disputes arise when the vendor decides a report is out of scope. Here, per the researcher, Anthropic classified the batch finding as informational and the artifact finding as an acceptable design choice, so the researcher published. Vendors can reduce friction by explaining scoping in plain terms and by offering a human review path; researchers can reduce it by separating exploitable security impact from policy or billing abuse in their reports. Either way, readers should keep two questions apart: whether the behavior existed, and whether the vendor considers it a vulnerability.
What builders and security teams should do
- Test authorization per endpoint and per tier. Every route, including batch, async and alternate-auth paths, needs its own plan, capability and model checks.
- Meter before you serve. Make billing and usage counting part of the authorization decision, not a downstream job.
- Treat shared-content domains as untrusted. Artifact and preview hosts are phishing infrastructure; do not trust a link because the domain is the vendor's.
- Shrink the patch gap. If you ship Electron, update the bundled Chromium promptly and monitor upstream security backports.
- Classify reports carefully. Calling chained authorization flaws "abuse" instead of vulnerabilities frustrates researchers and can push disclosures public.
- Protect your agents. If your own agents hold tokens like these, AgentBeam, the agent security platform from the explainx.ai team, is built to stop AI agents before they take dangerous actions.
Using unauthorized access to a paid service is illegal in many jurisdictions and against terms of service. This post does not endorse or enable it.
Questions readers are asking
Can I get free Claude this way? We are not providing steps, and the author says the main path was fixed. Use official free tiers and plans.
Is my Claude account at risk? Nothing in the write-up describes access to other users' data. The claims concern plan gating and a content-publishing bypass.
Will Anthropic fix the rest? Unknown. The researcher says related issues remain and the 90-day clock is the reason for publishing.
This post reflects the researcher's October 20, 2026 write-up. We will update it if Anthropic responds.