Auth flaws let a free Claude account run models unbilled

A security researcher published a write-up on October 20 showing a chain of authorization flaws on Anthropic’s platform that let any signed-in claude.ai user, free tier included, run Anthropic’s frontier models without paying and without drawing down a plan’s usage limits.

The post, on Exploit, went out under 90-day responsible disclosure, ninety days after the researcher first reported the issues to Anthropic on July 22. He had worked with the program before and found it quick: an Electron flaw in claude.ai artifacts was paid out 22 days after he reported it and patched soon after. The auth findings went the other way.

Underneath the bridge

Claude Code accepts seven documented ways to authenticate, among them a worker token passed in an Authorization: Bearer header. The chain starts there.

The entry point is session bridging, a feature built so a Claude Code session can be handed off to Claude Desktop. A POST to /v1/code/sessions/{id}/bridge returns a signed sk-ant-si- worker token to the caller. The endpoint checks that you are signed in. It does not check what your plan allows. So a free account, one whose capabilities list only chat, gets a valid token back, even though Anthropic’s own docs say the free claude.ai plan does not include Claude Code at all.

The researcher classed this as CWE-863, incorrect authorization: a check that runs but does not verify the right thing. One caveat held it back slightly. The account had to have sent at least one message first; a brand-new account hit invalid_request_error at session creation.

Where the gating wasn’t

The token alone already buys something. Pointed at /v1/messages, it draws on claude.ai usage directly, so any harness could ride a paid account’s limits. Free accounts asking for claude-fable-5 there got a 429, “This model is not available on your plan” - a second instance of the same authorization gap, caught this time by the plan check.

Then the researcher tried a different door. /v1/messages/batches, the endpoint built for bulk jobs of up to 100,000 requests at lower priority, applied no plan check at all. A free account could reach every public model, all but the internal Mythos line, and no account, free or paid, was billed for the work. The one friction was the token itself, which expired every eight hours and had to be refreshed.

The flow is short: create a session with the claude.ai session cookie, bridge it to get the worker token, then hand that token to the batches API on api.anthropic.com and poll the batch id until the results come back. No model restriction, no usage accounting anywhere along it.

Informational

Anthropic closed the report as Informational on July 23, the day after it landed, calling the behaviour platform abuse rather than a vulnerability. That label usually covers things like using a trusted domain to push phishing or malware; the researcher said he could not find another case where chaining unintended defects in authorization logic was treated as anything but exploitation. His request for review drew an automated reply from the program’s bot confirming the scoping.

And then Anthropic quietly fixed the endpoint it had ruled out of scope. Around September 1, a product change made the batches API reject worker tokens. The researcher notes that a proper retest would have caught related issues that the fix left standing.

One of those he found by accident on August 17, after he stopped paying for his 20x Max plan and the subscription lapsed to a paused state on a frozen card. The paused account could still reach /v1/messages, use every model for free, and without the low-priority slowdown that came with batches - a third instance of the same incorrect-authorization pattern. He chose not to file it, judging the earlier response unlikely to change.

The researcher’s reading of the whole exercise was less about any one endpoint than about where the gaps sat:

These APIs are being designed with the assistance of the very best models, and scrutinized heavily afterward. Yet there are still real architectural flaws. There is a requirement for a human-touch in a lot of these places.