A Tampermonkey Script, a Fake IBAN, and a Payment State Machine Bug Unlocked Free Claude Max 20x
The exploit didn't require hacking a server or forging a payment confirmation. It succeeded because the backend trusted a checkout-flow flag set by the client, accepted an unverified IBAN, and granted service before settlement. Any team integrating asynchronous payment methods inherits this same risk surface.
A short Tampermonkey script intercepted the `checkout_capabilities` API response and rewrote it to `cassia`, tricking the frontend into displaying a SEPA Debit payment form that was normally hidden. Users filled it with a randomly generated IBAN that passed format validation but pointed to no real bank account. The subscription system then upgraded accounts to the $200/month Max 20x tier immediately, treating the payment initiation as a completed transaction.
The exploit chain combined three failures: the backend trusted a client-supplied checkout flow value without re-verifying eligibility, the payment integration accepted a structurally valid but non-existent IBAN, and the subscription state machine conflated a `PROCESSING` debit status with settled funds. SEPA Direct Debit is asynchronous; rejections and returns can arrive days later, but by then users had already burned through hundreds of dollars' worth of API tokens.
Anthropic's response was an indiscriminate ban on all new accounts, not just those from the German region where SEPA is common. The script itself was dead within hours, but the incident exposed how a chain of mundane trust-boundary mistakes can produce a loss measured in the hundreds of millions when the asset being protected is token consumption.
Calling this a frontend vulnerability understates it. The real failure was the backend treating a UI configuration flag as an authorization credential, a textbook CWE-602 violation.
Random IBAN generators were the fuse, not the bomb. The damage came from a payment state machine that treated 'debit initiated' as 'paid,' a mistake that would have eventually surfaced with any asynchronous payment method.
The speed of the ban wave suggests Anthropic lacked real-time anomaly detection on subscription grants versus settlement events. A system that can't correlate these two streams in near-real-time will always be vulnerable to this class of abuse.
The secondary market on Xianyu for exploited accounts shows that even a short-lived exploit window creates a financial incentive for resellers, amplifying the blast radius beyond the original script users.