I stumbled across a state-management and metering flaw in Claude Teams plan. Because of how it works I was able to effectively only pay the minimum required for a team and have infinite usage. Scaled up it would allow to have infinite inference on top frontier models for free.
I wrote a clean analysis and reported it to Anthropic via their HackerOne program. Within an hour it was closed as "Informative" with a note static that subscription bypasses and rate limiting issues are considered "Platform abuse" redirecting me to a VDP mail.
I argued it was real vulnerability in their systems but they argued that it was happening "through the intended administrator flow" ... "using documented [REDACTED] management and the effect is additional included usage for the same organization".
So out of spite i commented: "So Anthropic wallet is not a security asset you care to protect and this is not a vulnerabilit but just a feature that can be freely used. Good to know"
and that triggered the claudesec bot which also had to cover his ass and say "it is not a statement that [REDACTED] to obtain additional usage is endorsed or permitted".
So basically thanks for the bug and thank you!
PS: its really 2026 to have Anthropic own ai bounce me back on their own BBP
Comments URL: https://news.ycombinator.com/item?id=50353629
Points: 1
# Comments: 0
