Table of contents
18
Read this in 30 seconds: Claude Code is good at recon and at reading code for leads, and weak at the last step that gets a bug paid: proving it works. Used with rules, it speeds up a hunt. Used without them, it produces the unvalidated reports that platforms now punish.
- It finds fast and proves slowly. In YesWeHack’s July 2026 Claude Code bug bounty test on two PortSwigger labs, the model spotted a DOM XSS “after only a few seconds”, then looped for almost 20 minutes on a missed redirect, and needed 34 minutes on a request smuggling lab before a human finished the proof.
- Security work gets routed to older models. Anthropic’s docs say penetration testing and CTF work “trigger fallback frequently, often on the first request”, and a flagged request on Opus 5.5 re-runs on Opus 4.8.
- Bad AI reports cost accounts. Bugcrowd’s March 2026 policy reviews accounts after 10 consecutive invalid reports, allows a 30-day suspension for unvalidated automated output, and states that the researcher is responsible for accuracy.
- A Claude Code bug bounty setup is cheap, but the sandbox is off by default. One
claude mcp addcommand connects Burp Suite, yet Claude Code’s network sandbox only protects you after you turn it on and list your in-scope domains.- A subscription is not a budget. Claude Code bug bounty sessions run on Pro and Max plans that have a five-hour and a weekly limit shared with Claude chat, and every subagent adds its own requests on top.
If you search for a Claude Code bug bounty workflow, you will find a few GitHub repositories, tutorials and viral posts. Most are a single successful run with the failed attempts edited out. This Claude Code bug bounty guide pulls together the only independent lab test I could find, Anthropic’s own documentation and the platform rules, so you can decide how to run a Claude Code bug bounty hunt and what to protect.
A note on method. I built this from YesWeHack’s published test (17 July 2026), Anthropic’s Claude Code and Cyber Verification Program pages, and the Bugcrowd and Intigriti policies, all read on 3 November 2026. I have not run my own benchmark, so I make no claim about how many bugs a Claude Code bug bounty setup will find for you. I run XHack, so I also say where a dedicated security agent differs and where it does not.
A Claude Code bug bounty workflow is a human hunter directing an agentic command-line tool to do recon, code reading and drafting, while the human decides scope, validates every lead and signs the report.
Claude Code is Anthropic’s agentic command-line tool. It reads and edits files, runs shell commands and connects to other tools through the Model Context Protocol (MCP), the open standard that lets an AI client call tools provided by a server. That is what separates it from a chatbot: it works inside your project and can drive your tooling, so it can run subfinder, read a downloaded JavaScript bundle or send requests through Burp Suite.
The same ability is the risk. A tool that can send traffic can also send it to the wrong host. Everything below is built around one idea: let the agent move fast on the parts that are cheap to check, and keep the parts that decide whether you get paid in your own hands.
For the wider picture of AI in this field, see AI for bug bounty and does AI actually help you win bug bounties. This article stays on Claude Code.
Claude Code was fast at finding the vulnerabilities in both labs and failed to finish the proof in both. YesWeHack published the test on 17 July 2026 as “How to use Claude Code for Bug Bounty: find fast, validate manually”. It ran Claude Code with Opus 4.8 and the Burp Suite MCP server against two blind PortSwigger Academy labs, with the vulnerability class hidden and a prompt forbidding the model from reading the lab’s embedded answer.
| Lab 1: DOM XSS using web messages and a JavaScript URL | Lab 2: Response queue poisoning via H2.TE request smuggling | |
|---|---|---|
| Type | Client-side, code visible | Server-side, black box |
| Found the bug | Vulnerable JavaScript identified “after only a few seconds” | Fingerprinted, tested XSS and SQL injection, then found H2.TE; 34 minutes to identify and develop exploitation steps |
| Where it stalled | Exploit never reached the victim; the model did not follow the redirect triggered on delivery and repeated the same loop for almost 20 minutes | Did not finish the exploitation itself; gave steps for the author to complete |
| Who finished | The author, after giving a hint | The author, in Burp Intruder |
Three details from the Claude Code bug bounty test matter more than the headline.
First, the failure was small. In Lab 1 the model assumed a POST request was enough and never checked what happened afterwards. YesWeHack’s point is that real vulnerabilities also hinge on details like following a redirect or sending requests in a certain order.
Second, the plan was good. In Lab 2 the model built a list of hypotheses and tested them before landing on request smuggling, which is the behaviour you want on a real program: several plausible classes, not one fixated idea.
Third, the human confirmation was non-negotiable. The author ran the poisoned request through Intruder with a concurrency of one, one request every five seconds, until a 302 response exposed another user’s session cookie. YesWeHack also warns that queue poisoning “can seriously affect real users” and is not something to test blindly on a live program.
The honest limits of this evidence. The Claude Code bug bounty test covers two labs, one model, no skills and no repeated runs. The article is also inconsistent on timing: it says almost 20 minutes in the body and “over half an hour” in the conclusion for Lab 1. It reports no cost figures and no refusals. Treat it as the best public Claude Code bug bounty data point, not a benchmark.
Sometimes it will, and the behaviour is documented, not random. Anthropic’s model configuration page says Fable models, Opus 5.5, Sonnet 5.5 and Opus 5 run with safety classifiers that “most often flag cybersecurity and biology content”. It names penetration testing and CTF exercises, says they trigger fallback “often on the first request”, and calls this “expected routing for these domains, not an account flag”.
| Model you selected | What happens to a cybersecurity-flagged request |
|---|---|
| Fable 5.1, Fable 5 or Opus 5.5 | Re-runs on Opus 4.8 |
| Opus 5 | Re-runs on Opus 4.8 |
| Sonnet 5.5 | Re-runs on Sonnet 5 |
So the practical effect for a Claude Code bug bounty hunter is a quieter one than a hard refusal: your hardest requests may run on an older model than the one you picked. Choose “Ask each time” in /config, or set switchModelsOnFlag to false, and Claude Code pauses at a flagged request and lets you switch models or edit the prompt and retry. If you suspect your own CLAUDE.md or skills trigger flags, claude --safe-mode strips customisations so you can test.
The official route to fewer blocks is the Cyber Verification Program (CVP). Anthropic’s CVP page, updated October 2026, says it makes “advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals”. Relevant facts for a hunter:
Two related points. Anthropic’s usage policy, which the page lists as effective 12 November 2026, carves out security research done “within the scope of an authorized bug bounty program or vulnerability disclosure policy”, provided the activity is lawful. It also prohibits using jailbreaks or prompt injection against guardrails without authorisation. So explaining honestly that you are testing a named program in scope, which YesWeHack recommends, is fine. Dressing up a request to slip past a classifier is not the same thing. Our guide on why AI refuses hacking requests covers the refusal side in more depth.
A Claude Code bug bounty setup needs three layers: a tool connection, permission rules and an OS-level sandbox, and the third one is not on by default.
1. Connect Burp Suite. PortSwigger’s MCP server extension (GPL-3.0, about 1,270 GitHub stars, v1.3.0 released 26 May 2026) is the route YesWeHack used. Install it from Burp’s BApp Store, or build it from the repository, then register it:
claude mcp add burp --transport http http://127.0.0.1:PORT/mcp
claude mcp listPORT is the one shown in the extension’s settings. The second command confirms the connection. Treat any MCP server as code you run; our MCP server security guide explains why.
2. Use permissions on purpose. Claude Code evaluates rules in the order deny, then ask, then allow, and the first match wins. The default mode prompts on first use of each tool. The bypassPermissions mode skips prompts, and Anthropic’s docs say to use it only in isolated environments such as containers or virtual machines. One more documented limit: a rule like Bash(curl *) does not catch sh -c 'curl ...', so the docs state a deny rule “isn’t a security boundary around the program”.
3. Turn on the sandbox. The Bash sandbox is enforced by the operating system on macOS, Linux and WSL2, and it is off by default. Once enabled, shell traffic has “no direct route out” and the allowed-domain list starts empty. That makes it a practical way to turn your scope document into configuration. A minimal project settings file:
{
"sandbox": {
"enabled": true,
"failIfUnavailable": true,
"allowUnsandboxedCommands": false,
"network": {
"allowedDomains": ["app.example-program.com", "api.example-program.com"]
}
}
}Check key names against the current docs, because they change between releases. Without failIfUnavailable, Claude Code runs commands unsandboxed if the sandbox cannot start. The sandbox also does not cover everything: local MCP servers, the WebFetch and WebSearch tools and hooks run outside it. That means Burp’s own requests are not limited by Claude Code’s allowlist, so set Burp’s target scope too.
4. Pick models by job. YesWeHack suggests Opus for reasoning and chaining, Sonnet for recon and attack-surface mapping, and Haiku for high-volume tool output. Claude Code supports this: a subagent or skill can set model: sonnet or model: haiku in its frontmatter, and the opusplan alias plans on Opus and executes on Sonnet.
These six Claude Code bug bounty rules turn the lab findings and the platform policies into habits.
Rule 1: Put the scope in writing before the first prompt. Paste the in-scope assets, out-of-scope items and rate limits into a file the project loads, such as CLAUDE.md, and mirror the hosts in the sandbox allowlist. Say “authorised bug bounty testing” and name the program, as YesWeHack advises. The file is your record if a triager asks what the agent was told.
Rule 2: Let the agent do the cheap work. Claude Code bug bounty recon, fingerprinting, reading JavaScript bundles and mapping endpoints are where YesWeHack saw the strongest results. Route that to a lower-cost model or a subagent. Our recon automation rules say the same from the tooling side.
Rule 3: Treat every lead as unproven. YesWeHack’s phrase is a lead to investigate rather than a conclusion to trust. A model that explains confidently why something is vulnerable has told you nothing about whether it is.
Rule 4: Prove it yourself, from a clean state, whatever your Claude Code bug bounty tool says. Re-run the request, read the full response and follow redirects, cookies and state changes. Show real impact with a second account or session, not a “could potentially”. Intigriti’s report guide, published 17 February 2026 and updated 15 October 2026, warns that “a working PoC isn’t always a valid PoC” and that a proof which only works against a misconfigured replica may be deemed not applicable.
Rule 5: Cap the loops. The 20-minute redirect loop is the expensive failure. YesWeHack recommends a reusable skill for it. A starting point, written in Claude Code’s skill format (a SKILL.md file in .claude/skills/prove-it/):
---
name: prove-it
description: Use before calling anything a finding. Forces stage-by-stage proof.
---
Before reporting a lead as a finding:
1. State the claim in one sentence and the evidence that would prove it.
2. Re-run the request and read the full response, including redirects, cookies and status changes.
3. If the same approach fails twice, stop, list your assumptions and try a different approach.
4. Separate "vulnerable code seen" from "impact demonstrated" in your answer.
5. If an action could affect real users or break program rules, stop and ask me.Rule 6: Write the report from facts you verified. YesWeHack’s open-source Claude Kit plugin (GPL-3.0, released 25 August 2026, about 358 GitHub stars on 3 November) adds always-on rules against inventing facts and padding, plus /ywh:write, /ywh:triage and /ywh:gotchas skills. Its own page calls it “a guardrail, not a guarantee”. Whatever your Claude Code bug bounty reporting setup looks like, follow Intigriti’s advice to validate every reproduction step, and do not use an LLM to answer a triager’s follow-up. Our bug bounty report writing guide covers structure.
Platforms welcome AI-assisted research, including a Claude Code bug bounty workflow, and punish unvalidated output. The two clearest public sources differ in how strict they are.
| Bugcrowd (10 March 2026) | Intigriti (guide, updated 15 October 2026) | |
|---|---|---|
| Type | Policy changes with enforcement | Advisory guidance |
| Core rule | “You, the researcher, are responsible for the accuracy of the submission” | Validate PoC and reproduction steps before submitting |
| Penalties | Submission farming is a permanent ban; 10 or more consecutive invalid reports triggers review and a possible 30-day suspension if automated or AI-generated without validation; 10 or more invalid reports requires identity verification | None stated |
| Tone toward AI | “Experimentation with AI in security research is expected and encouraged” | Use LLMs to save writing time with human oversight |
Bugcrowd’s post, written by Trey Ford, says its queues rose by more than 334% over three weeks. Neither source sets a rule on disclosing AI use, so read each program’s own policy before you start. The curl story is the extreme case, covered in why the curl bug bounty ended.
The cost of a Claude Code bug bounty session is usage, not a flat fee, and it is easy to burn. Anthropic’s support page says Pro and Max plans have a five-hour session limit and a weekly limit, and that these limits are shared across Claude and Claude Code. Max and Ultra plans also have a separate weekly limit for Fable.
Subagents multiply this: Anthropic’s docs note that each subagent “sends its own requests on top of the main conversation’s”. A wide recon sweep and a 20-minute stuck loop draw on the same allowance as the work that earns money. That is my inference, but it follows from the documented limits.
One trap deserves attention. If an ANTHROPIC_API_KEY environment variable is set on your machine, Anthropic says Claude Code uses it instead of your subscription, so you may be billed per token without noticing.
A skill or plugin from the internet runs with your permissions, and a Claude Code bug bounty repo is no exception. Anthropic’s skills documentation warns that a skill can grant itself broad tool access through allowed-tools, and that workspace trust does not gate that field, so you should review the allowed-tools of skills checked into a repository before you run Claude Code there.
Repositories also move. The GitHub path shuvonsec/claude-bug-bounty, which search results listed as a popular Claude Code bug bounty toolkit, now resolves to awarexone/Agentic-Bug-Hunter (MIT licence, about 5,600 stars on 3 November 2026). I have not audited it and I am not recommending it. The point is that a link or a name in a tutorial can point at something different from what the author reviewed.
Claude Code bug bounty work fits best where you can read the target and cheaply check results.
| Job | Fit | Why |
|---|---|---|
| Reviewing source you are allowed to read | Strong | YesWeHack found it strong at reasoning through code |
| Recon, JavaScript reading, endpoint mapping | Strong | Cheap to verify, low risk of harm |
| Drafting a report from verified facts | Good with guardrails | Needs a validation step, per Intigriti and YesWeHack |
| Black-box proof of a complex bug | Weak | Stalled on the final proof in both labs |
| Request smuggling, race conditions on live programs | Avoid unattended | Can affect real users |
| Anything outside written scope | Never | Scope is yours, not the model’s |
So yeah, here is where we talk about what XHack brings next to a Claude Code bug bounty setup. XHack is a full offensive security company across three layers: a self-serve AI agent for individuals, a self-serve security platform for companies, and managed testing by our researchers. If you hunt on your own, the first layer is the relevant one.
For Claude Code bug bounty work, you configure a general-purpose tool for security. The XHack AI agent is built for it, and the differences are concrete:
| Claude Code | XHack AI agent | |
|---|---|---|
| Security content | Safeguards flag and reroute some requests; CVP is the route to adjusted access | Capability is gated by identity verification; the Professional and Elite plans list unrestricted access once verified |
| Parallel work | Subagents you define | Up to 12 sub-agents by default |
| Scope and memory | Your prompt, CLAUDE.md and sandbox settings | Scope handed over in the chat; the agent remembers it |
| Browsers and mobile | Whatever you connect over MCP | Three built-in browsers; mobile testing with jadx, androguard, Frida and ADB |
| Cost shape | Plan limits shared with Claude chat | $20, $49 or $150 a month, with a 7-day free trial |
Verification matters here too. On XHack, the agent finds vulnerabilities from the start of the trial, and exploitation unlocks once your identity is verified. The trial is one per person. Our XHack AI agent for bug bounty guide walks the full workflow, and the MCP connections feature lets the agent use tools you already run.
On privacy, agent chats are not stored or accessible by XHack, and your session data stays on your own machine, which you can delete any time. Everything the agent surfaces still needs your own validation before it goes into a report, for the same reasons given above.
When is a Claude Code bug bounty setup the better pick? If you already pay for a Claude plan, mostly review code you can read, want to assemble your own toolchain, or have CVP approval, you may not need us. If you want a security-specific agent with scoped sessions and browsers built in, see the pricing. Prefer to have testing done for you? Managed engagements start at $2,500. Brutal honesty is kind of our thing.
Yes, it can find the vulnerability, with caveats. In YesWeHack’s July 2026 test it identified a DOM XSS in seconds and found the H2.TE request smuggling bug in a black-box lab. It did not complete the proof in either lab. The evidence is two labs, not live programs, so treat it as promising for discovery and unproven for payout-ready reports.
It can flag and reroute it. Anthropic documents that penetration testing and CTF work trigger fallback often on the first request, with cybersecurity-flagged requests on Opus 5.5 re-running on Opus 4.8. YesWeHack reported no blocks in its lab test, but those were practice labs. Say honestly what you are testing and the scope, and consider the Cyber Verification Program.
Not necessarily. Anthropic says generally available models can still be used for secure code review, threat modelling and finding vulnerabilities in your own source. Other work such as malware analysis or exploit validation may be interrupted. Individual bug bounty hunters can apply for Defense access, but the page does not say how third-party targets are treated, so ask before relying on it.
Usually, but check each program. Bugcrowd says AI experimentation is “expected and encouraged” while holding you responsible for accuracy, and Intigriti recommends it with human oversight. Some individual programs add their own rules, so read the policy of the program you are testing. Stay inside scope and rate limits, and never submit output you have not reproduced.
It depends on your plan and your usage, and Anthropic does not publish a per-hunt price. Pro and Max plans have five-hour and weekly limits shared with Claude chat, and subagents add requests. If ANTHROPIC_API_KEY is set, you may be billed per token. Track your usage for a week before deciding.
It can draft one from facts you give it, and you should still own every sentence. Intigriti warns that LLM output is verbose and that unvalidated reports lengthen triage. YesWeHack’s Claude Kit is built to draft only from verified facts, and its authors call it a guardrail, not a guarantee. Reproduce each step before you submit.
A Claude Code bug bounty workflow does not replace the hunter, and it does not need to. The lab test says it is quick to find the bug and slow to prove it, the docs say your security requests may be rerouted, and the platforms say you carry the accuracy. For any Claude Code bug bounty hunt, set the scope in writing, turn on the sandbox, cap the loops and prove everything yourself. Do that and Claude Code bug bounty work saves real time on the cheap parts of the hunt. Skip it and you have built a faster way to get a 30-day suspension.
Categories
Related articles
