# How to report security bugs to Anthropic

> Anthropic's responsible disclosure program rewards security researchers who find and report vulnerabilities the right way.
- Title: How to report security bugs to Anthropic · Anthropic
- Summary: Anthropic's responsible disclosure program rewards security researchers who find and report vulnerabilities the right way. Report security vulnerabilities to…
- Keywords: anthropic, security vulnerabilities, responsible disclosure, bug bounty, security research, ai safety, vulnerability reporting, safe harbor, information systems, cybersecurity, technology, report
- Source: Anthropic — https://anthropic.com/responsible-disclosure-policy
- Read time: 2 min
- Topics: anthropic, security vulnerabilities, responsible disclosure, bug bounty, security research, ai safety, vulnerability reporting, safe harbor, information systems, cybersecurity, ai, technology
## Anthropic prioritizes system security
Anthropic's mission includes ensuring AI benefits humanity, which requires secure systems and protecting user data. The company actively encourages security researchers to identify vulnerabilities.
## Report bugs to all affected AI companies
If a vulnerability affects multiple AI services, submit separate reports to each organization. This ensures all impacted services can properly assess and address the issue.
## What systems are covered
The policy covers all internet-facing systems owned or operated by Anthropic, including websites and applications on Anthropic domains and subdomains. Third-party systems are excluded.
## Covered vulnerability types
Report technical vulnerabilities like misconfigurations, cross-site request forgeries, privilege escalation, SQL injection, cross-site scripting, and directory traversal attacks.
## What's not covered here
Excluded vulnerabilities include social engineering, phishing, denial of service attacks, insider compromises, and widely publicized zero-days without patches or less than 30 days old.
## Report AI safety issues separately
Safety concerns, jailbreaks, and model-related issues should go to usersafety@anthropic.com with enough detail to replicate the problem.
## How to submit your report
Include vulnerability type and severity, technical details, reproduction steps, affected URLs, proof-of-concept materials, potential impacts, and remediation suggestions. One vulnerability per report.
## Research must be ethical
Test only to identify vulnerabilities, avoid harming systems or data, don't exploit beyond proof of concept, and never access or exfiltrate data without permission.
## Disclosure timing rules
Don't publicly disclose vulnerability details until you receive written notice from Anthropic. The company supports researchers' right to disclose and will coordinate timing to prevent harm.

> We fully support researchers' right to publicly disclose vulnerabilities they discover.
## Additional researcher requirements
Don't target accounts that aren't yours, don't phish Anthropic employees, don't demand payment for disclosure, and comply with all U.S. sanctions laws and local regulations.
## What Anthropic will do
Acknowledge reports within three business days, protect your identity, investigate promptly, confirm remediation strategy on a timeline, and attribute your contribution if you consent.
## Safe harbor protection
Good-faith researchers following this policy won't face legal action from Anthropic for their research or responsible disclosure activities.
## Questions before you start
Contact disclosure@anthropic.com if you're unsure whether your research aligns with these guidelines before proceeding.
## Key takeaway

Report security vulnerabilities to Anthropic at disclosure@anthropic.com with detailed technical information, avoid causing harm, and you'll get legal protection and timely responses.