Anthropic prioritizes system security

Anthropic's mission includes ensuring AI benefits humanity, which requires secure systems and protecting user data. The company actively encourages security researchers to identify vulnerabilities.

Report bugs to all affected AI companies

If a vulnerability affects multiple AI services, submit separate reports to each organization. This ensures all impacted services can properly assess and address the issue.

What systems are covered

The policy covers all internet-facing systems owned or operated by Anthropic, including websites and applications on Anthropic domains and subdomains. Third-party systems are excluded.

Covered vulnerability types

Report technical vulnerabilities like misconfigurations, cross-site request forgeries, privilege escalation, SQL injection, cross-site scripting, and directory traversal attacks.

What's not covered here

Excluded vulnerabilities include social engineering, phishing, denial of service attacks, insider compromises, and widely publicized zero-days without patches or less than 30 days old.

Report AI safety issues separately

Safety concerns, jailbreaks, and model-related issues should go to usersafety@anthropic.com with enough detail to replicate the problem.

How to submit your report

Include vulnerability type and severity, technical details, reproduction steps, affected URLs, proof-of-concept materials, potential impacts, and remediation suggestions. One vulnerability per report.

Research must be ethical

Test only to identify vulnerabilities, avoid harming systems or data, don't exploit beyond proof of concept, and never access or exfiltrate data without permission.

Disclosure timing rules

Don't publicly disclose vulnerability details until you receive written notice from Anthropic. The company supports researchers' right to disclose and will coordinate timing to prevent harm.

“We fully support researchers' right to publicly disclose vulnerabilities they discover.”

Additional researcher requirements

Don't target accounts that aren't yours, don't phish Anthropic employees, don't demand payment for disclosure, and comply with all U.S. sanctions laws and local regulations.

What Anthropic will do

Acknowledge reports within three business days, protect your identity, investigate promptly, confirm remediation strategy on a timeline, and attribute your contribution if you consent.

Safe harbor protection

Good-faith researchers following this policy won't face legal action from Anthropic for their research or responsible disclosure activities.

Questions before you start

Contact disclosure@anthropic.com if you're unsure whether your research aligns with these guidelines before proceeding.