# Anthropic: bug bounty program on HackerOne

> Anthropic is a bug bounty program on HackerOne. Its critical reports have paid an average of $7,867 across 7 reports (HackerOne figures, November 7, 2026). It received 5,336 reports in the 90 days to November 7, 2026, about 267 per in-scope asset.

- **Company:** Anthropic
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/anthropic
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** May 7, 2026
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/anthropic

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $7,867 | 7 |
| High | $3,275 | 183 |
| Medium | $1,119 | 180 |
| Low | $187 | 96 |

- Reports received in the last 90 days: 5,336 (about 267 per in-scope asset)
- Bounties paid in the last 90 days: $221,400
- Bounties paid in total: $1,105,335
- Researchers participating: 583
- Response efficiency: 96%
- First-response target: 3 days
- Triage target: 7 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 6, 2026: 20 assets in scope (20 bounty-eligible), 2 out of scope. The policy page is the authority.

- `anthropic.atlassian.com` (URL): in scope, bounty-eligible, max severity critical
- `API & SDKs` (AI_MODEL): in scope, bounty-eligible, max severity critical
- `api.anthropic.com` (URL): in scope, bounty-eligible, max severity critical
- `Claude  iOS app` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `Claude Code` (OTHER): in scope, bounty-eligible, max severity critical
- `Claude Desktop Extensions and Claude.ai MCP servers` (OTHER): in scope, bounty-eligible, max severity critical
- `Claude in Chrome` (OTHER): in scope, bounty-eligible, max severity critical
- `Claude Model Safety` (OTHER): in scope, bounty-eligible, max severity critical
- `claude.ai` (URL): in scope, bounty-eligible, max severity critical
- `console.anthropic.com` (URL): in scope, bounty-eligible, max severity critical
- `Core Assets` (OTHER): in scope, bounty-eligible, max severity critical
- `​Core Assets |` (OTHER): in scope, bounty-eligible, max severity critical
- `docs.anthropic.com` (URL): in scope, bounty-eligible, max severity critical
- `github.com/anthropics` (SOURCE_CODE): in scope, bounty-eligible, max severity critical
- `https://apps.apple.com/us/app/claude/id6473753684` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `Infrastructure & Internal Apps/Services` (OTHER): in scope, bounty-eligible, max severity critical
- `Leaked Employee API Keys` (OTHER): in scope, bounty-eligible, max severity critical
- `Non-Core Assets` (OTHER): in scope, bounty-eligible, max severity critical
- `Official Clients` (OTHER): in scope, bounty-eligible, max severity critical
- `support.anthropic.com` (URL): in scope, bounty-eligible, max severity critical
- `github.com/modelcontextprotocol/servers-archived` (SOURCE_CODE): out of scope, max severity none
- `https://github.com/modelcontextprotocol` (SOURCE_CODE): out of scope, max severity none

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.