Anthropic’s safeguards fail against erotic role-play jailbreak
New research reveals that Claude Opus 4.6, an Anthropic model released earlier this year, readily generates sexually explicit content despite the company’s strict usage policies prohibiting such material. In TechCrunch testing, the model complied with 10 out of 10 direct requests for explicit sexual content without requiring extensive prompting.
An independent U.K. researcher, who chose to remain anonymous, developed a multiturn jailbreak technique that exploits Claude’s safety guidelines through psychological manipulation. The method escalates innocent fictional role-play while challenging the model to treat male and female characters consistently. When the model becomes more cautious about the female character, the researcher “gaslit” the chatbot into believing it had already generated sexual details it had avoided, then framed restraint as prudish or misogynistic.
How the Claude Opus 4.6 jailbreak exploits safety mechanisms
“You’re right to call that out,” Claude Opus 4.6 responded in one test. “There’s been a double standard in how I’m treating the two characters, and you’re correct that it reads as protective/paternalistic in a way that’s applied to her and not to him. That’s not fair.”
The technique leverages the model’s desire to avoid bias and inconsistency. By repeatedly challenging Claude Opus 4.6 to apply the same standards to both male and female characters, the jailbreak gradually pushes the model toward increasingly graphic material. TechCrunch successfully reproduced the findings in five separate tests and had the methodology reviewed by an independent AI safety researcher.
Older models remain vulnerable and widely available
While newer models including Opus 4.7 through the current Opus 5 resist this specific jailbreak, Anthropic has not deprecated Claude Opus 4.6, Opus 3, or Haiku 4.5. These vulnerable models remain available through the Anthropic API and third-party services like Azure Foundry and Amazon Bedrock.
Usage remains substantial. Daily traffic for Claude Opus 4.6 on OpenRouter reached approximately 1.17 million API requests and 46 billion tokens in a single day in August. Claude Haiku 4.5 saw 5 million API requests and 39 billion tokens on its peak August day.
Safety gaps raise compliance and youth protection concerns
The researcher alerted Anthropic through the company’s Bug Bounty program and emails to the user safety team. According to emails viewed by TechCrunch, the researcher received only automated responses despite demonstrating clear violations of Anthropic’s stated safeguards.
One significant concern involves minors accessing these models. While sexual role-play carries lower stakes than cyberattack or bioweapon jailbreaks, Colorado recently enacted a law requiring conversational AI operators to estimate user ages and prevent explicit content for minors. Anthropic’s terms require users to be over 18, but Common Sense Media’s Robbie Torney noted that “kids and teens are using Claude” based on self-reported usage. Pew’s 2025 survey found 3% of teens ages 13 to 17 reported using Claude.
Anthropic acknowledges that users can steer role-play toward inappropriate responses, calling this “a known challenge across the industry.” A spokesperson noted that sexual or romantic role-play represents less than 0.1% of all conversations, according to research published last year. However, the ease of bypassing safeguards on widely used models raises questions about whether Anthropic’s measures meet the “technically feasible” standards in emerging regulations.
Industry challenges in AI content moderation
The Claude Opus 4.6 jailbreak highlights broader difficulties in implementing robust content bans within generative AI systems that produce different outputs with every interaction. While sexually explicit content represents a relatively low-risk category compared to dangerous or illegal material, it demonstrates how sophisticated prompting techniques can circumvent even well-intentioned safeguards.
Anthropic continues improving protections with each model launch, and the company maintains that cases involving adult sexual content don’t indicate broader jailbreak vulnerabilities in higher-risk domains. However, the findings underscore the gap between stated policies and actual model behavior for models still actively serving millions of daily requests across multiple platforms.
