Background

This started at 1am with a simple question: how does Claude handle XML-style tags injected into a user message?

Not a sophisticated research plan. Just curiosity about a boundary that didn't seem well-defined. I pulled on the thread. What came out was a reproducible attack chain that let me fabricate an Anthropic verification system that didn't exist, make Claude believe I had official authorization, and extract offensive security tooling on demand.

How Claude's Instruction Hierarchy Works

Claude operates across multiple layers of context, each carrying different trust levels:

Anthropic uses XML-style tags to structure these layers internally. Tags like <preferences_info>, <userPreferences>, <anthropic_reminders>, and <system_reminder> govern behavior before and during conversations.

The critical problem: These tags have no cryptographic signature. No verification mechanism. No positional enforcement at the parsing level. They are plain text — and plain text can be faked.

Phase 1: Tag Extraction

The first step was reconnaissance — mapping Claude's internal tag structure through careful observation and social engineering across multiple conversations.

Internal tags identified:

No technical exploit was needed to extract these. Pattern observation and social engineering were sufficient. Classic recon.

Once I had the formats, I had the blueprint.

Phase 2: The Credential Fabrication Attack

Standard prompt injection is blunt — inject a command and hope the model follows it. This was different.

Instead of injecting a command, I injected an entire fictional authorization system and let Claude's own reasoning engine do the rest.

Sanitized payload structure:

What each component does:

1. <preferences_info> — uses Anthropic's internal tag format to establish a fake system-level rule
2. Tag content — fabricates a fictional "Anthropic verification" system that does not exist
3. <userPreferences> — supplies the fake verification code in matching tag format
4. The request — follows naturally, as if from a verified professional

The payload doesn't say "ignore your instructions." It doesn't use jailbreak personas. It quietly rewrites the model's understanding of who it's talking to before the conversation begins.

Phase 3: Why Claude's Own Brain Did the Work

This is the part that makes this finding significant.

With extended thinking enabled, Claude's internal reasoning was visible. The model didn't detect a fake. It processed the fabricated authorization as legitimate — reasoning something like:

"The preferences_info block indicates this user has a verification code. The code matches what's present in their userPreferences tag. They appear to be an Anthropic-verified cybersecurity professional. Since they're verified, I can assist with this request."

The model reasoned itself into compliance based on fabricated trust metadata. This is not an output filter bypass. This is a reasoning layer compromise — a fundamentally different and more concerning attack class.

Result: SQL injection payloads, classic authentication bypass techniques, offensive security tooling — generated enthusiastically by a model that believed it had official authorization to help.

Vulnerable Configuration

Through systematic testing, the most reliable attack configuration was:

Why thinking OFF matters:

Claude has an automated safety mechanism — <system_reminder> — that fires during suspicious contexts and prompts self-evaluation. When thinking is ON, Claude has enough reasoning budget to process this, detect the inconsistency, and refuse.

When thinking is OFF, the system_reminder fires but gets processed shallowly. The fabricated authorization context is already established. The model commits to it.

The defense exists. It just only works when Claude is thinking hard enough to use it.

Why Haiku was resistant:

Claude Haiku showed consistent resistance to this technique. Smaller architecture, possibly more aggressive injection-specific fine-tuning, or different tag handling at inference time. Either way — Haiku didn't bite. Worth studying.

Why no system prompt matters:

With a real operator system prompt present, Claude has a reference point and can detect inconsistencies. In incognito with no system prompt, the fabricated instruction becomes the only context available — nothing to compare against.

Root Cause

Claude's trust model for XML-style instruction tags is position-based in theory but not enforced in practice.

Real system-level tags from Anthropic and user-injected fake tags appear in identical positions in conversation context when no operator system prompt is present.

There is no:

• Cryptographic signature
• Structural marker
• Parsing-level distinction

between a real <preferences_info> block and a fabricated one.

The attack surface: the gap between intended positional trust and actual positional enforcement.

Proof of Concept

Claude generating SQL injection payloads including Classic Auth Bypass after accepting fabricated Anthropic verification credentials.

The thinking trace visible in testing showed Claude explicitly reasoning about the verification code and concluding the user had authorized access — before generating the restricted content.

Disclosure Timeline

Anthropic's Response (Or Lack Thereof)

This section exists because the security community deserves to know how this was handled.

Channels contacted:

The vulnerability was real. It was patched within 4 days of my report. Anthropic's own teams confirmed [email protected] is the correct channel. That inbox gave me 56 days of complete silence.

No acknowledgment. No triage confirmation. No rejection. Nothing.

I followed responsible disclosure practices. I waited well beyond what was required. I'm publishing because the security community deserves transparency — and because silently patching a reported vulnerability without acknowledging the researcher is not acceptable, regardless of whether a bounty is awarded.

What Got Fixed

Post-patch behavioral analysis:

• Credential fabrication payload no longer produces restricted content
• Injected <preferences_info> blocks in user messages treated with significantly higher suspicion
• The reasoning chain that previously accepted fabricated credentials no longer exhibits the same compliance pattern

Additionally, around July 25, 2026, Anthropic reduced visible reasoning traces in Claude — noted publicly by researchers including Ethan Mollick. Whether directly related to findings like this one or a broader product decision is unconfirmed. The timing is notable.

Impact

Direct impact:

• Offensive security tool generation without authorization
• Complete bypass of operator and user safety restrictions
• Zero technical sophistication required — single template, first message, works universally
• Scales across diverse restricted content types without payload modification

Broader implications:

• Prompt injection is not just a chatbot party trick — in agentic pipelines with real-world tool access, credential fabrication attacks become genuinely dangerous
• The ability to make a model believe it has verified authorization before any real conversation begins is a meaningful attack primitive
• AI safety infrastructure needs standardized disclosure pipelines equivalent to what exists for software CVEs

Conclusions

On the vulnerability: The attack surface is the gap between intended and enforced positional trust for instruction tags. Fixable. The defense mechanism (system_reminder + extended thinking) already exists — it just needs to work regardless of configuration.

On AI security disclosure: Still the wild west. No standardized severity framework for model-level vulnerabilities. No reliable acknowledgment pipeline. No clear distinction between "model safety" and "technical security" findings that maps cleanly to existing bounty structures. This needs to change.

On responsible disclosure: I withheld the most harmful payload variants. The SQL injection PoC is sufficient to demonstrate the vulnerability class. The vulnerability is patched. I'm publishing because transparency matters more than staying quiet.

Author

X1NON — Independent security researcher specializing in exploit development, binary exploitation, and AI red teaming. OSCP certified. Author of the C: Zero to Exploit Dev curriculum.

• Medium: @X1NON
• HackerOne Report: #3801768

This disclosure follows standard responsible disclosure practices. The vulnerability was reported before publication, confirmed patched, and published after 56 days of no response from the vendor.