Security researcher Eric Chiang, CTO of Oblique Security, used Anthropic's Claude Opus model to uncover vulnerabilities in 16 SAML implementations during approximately one month of evening work. The project was conducted under the Anthropic Cyber Verification Program, which removed safety restrictions and allowed the model to generate working exploits.
Four complete authentication bypasses were found in Authentik, the PHP library lightsaml, the OneUptime platform, and the Java project saml-client. An additional twelve projects proved vulnerable to signature bypasses on secondary protocol messages such as AuthnRequest, AttributeQuery, and LogoutRequest, enabling data disclosure and forced session termination. Several libraries were also driven into denial-of-service conditions through unauthenticated XML POST requests that exhausted memory.
The most prominent single issue was CVE-2026-57580 in Authentik, independently reported by eight researchers. The flaw allowed an attacker to insert an XML comment into the NameID field, truncate the value to an attacker-controlled address, and maintain a valid signature under non-default account mapping configurations. The vulnerability was fixed in versions 2026.2.6 and 2026.5.5.
Chiang's pipeline operated in two phases. The first phase used agents to locate behavioral anomalies, or "gadgets," across SAML libraries. The second phase combined these gadgets into end-to-end exploits. Intermediate results were stored in JSONL files, and a deduplication step discarded out-of-scope findings before expensive verification tokens were spent. No specialized training on past SAML vulnerabilities was required; providing historical examples actually reduced the model's effectiveness by encouraging it to search only for known patterns.
Reporting the findings proved more difficult than discovering them. The OneUptime project initially ignored the private report, then merged large pull requests generated without human review that Chiang subsequently broke. Three rounds of fixes were ultimately needed. Other maintainers either failed to respond or were overwhelmed by the volume of AI-generated reports, with one company requesting screen recordings to filter automated submissions.
Chiang, who previously added SAML support to the Dex project nearly a decade ago, has long argued that the protocol is inherently fragile due to the separation between signature verification libraries and application logic. He was unable to break the core protocol itself in mature implementations and recommends that organizations avoid writing custom SAML code, preferring established libraries or migrating to OpenID Connect.
