Breaking

Researcher Bypasses EU Age Verification App With a Claude-Built Chrome Extension

July 15, 2026 at 04:19 EDT

Security
Policy & Regulation
AI Agents

Security researcher Paul Moore has demonstrated a fresh bypass of the European Union's flagship age verification app, using a Chrome extension built with Anthropic's Claude AI to defeat the latest release (version 2026.07-1) months after the same tool was first shown to be vulnerable.

April 2026 · EU Age Verification App

Claude-Built Extension Cracks the EU's Flagship Age Check

A security researcher used a Chrome extension powered by Anthropic's Claude to defeat the latest release of the EU's age verification app — months after the same tool was first shown to be vulnerable.

< 2 min

To reset PINs, disable biometrics & defeat rate limits on the Android build

2026.07-1

The current release still bypassed after being called a "demo" to be fixed

Independent researchers reproducing comparable design flaws

Two channels, both bypassed

Repeated defeats across mobile and browser flows

edit shared_prefs

Android app

Alter local auth & rate-limit values

detect QR code

forge payload

Claude automates

Browser flow

Extension completes proof, no real ID check

The structural flaw

"Anonymous age verification doesn't work when someone controls the device."

Verification state is stored and manipulated locally

Physical access lets anyone reset PINs & retry without limit

A minor could reuse a parent's completed attestation

The EU position

Open-source, privacy-preserving attestation under eIDAS 2.0 — "technically ready" and targeted for broad availability by end of 2026 across pilot countries.

The researchers' verdict

The weakness is fundamental, not incidental — the local-verification model cannot withstand adversaries who control their own device.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.