Researcher discloses Anthropic authorization flaw: free accounts can invoke paid models without billing; vendor deems it not a vulnerability
A security researcher publicly disclosed two authorization flaws (CWE-863) in Anthropic Claude; a free account can, using a worker JWT obtained via session bridge, invoke paid models on /v1/messages/batches without plan restrictions. The author states that POST /v1/code/sessions/{id}/bridge issues an sk-ant-si-* worker JWT to any logged-in claude.ai user without checking account entitlements; the batches endpoint has no plan threshold, with a single batch of up to 100,000 requests and not counted toward usage. The author also found that accounts with paused subscriptions can still access /v1/messages for free, constituting a third CWE-863.
The disclosure provides the reproduction chain for missing authorization and sandbox content elevation bypass, as well as the vendor handling timeline, which can be used to verify the permission boundaries of Claude-related interfaces.