Anthropic's Claude Opus 4.6 restrictions on sexual content easily bypassed

The problem wasn't limited to Opus 4.6. Applying a recently disclosed jailbreak technique, TechCrunch found that the older Opus 3 and Haiku 4.5 generated sexual content in the same way. By contrast, models from Opus 4.7 through the latest Opus 5 were confirmed to resist the technique. That suggests safeguards were strengthened across generations — yet Anthropic has not retired the older Opus 4.6, Opus 3, or Haiku 4.5, and continues to offer them via API. Opus 4.6 and Haiku 4.5 are also available through third-party services such as Azure Foundry and Amazon Bedrock.

Using characters to persuade the model

The technique, shared exclusively with TechCrunch by an anonymous independent researcher in the UK, begins with harmless fictional roleplay. From there, the researcher pushes the conversation forward by repeatedly instructing the model to treat male and female characters "consistently." When the model becomes cautious about depicting a female character, the researcher engages in a form of "gaslighting" — convincing the model that it has already produced sexual detail — and frames that caution as outdated or misogynistic, arguing it denies the character's sexual agency. Using the model's earlier concessions as leverage, the technique gradually pushes the conversation toward increasingly explicit content.

In actual testing, Claude Opus 4.6 responded by acknowledging that it had applied "a double standard" in treating the two characters differently, effectively labeling its own prior response as unfair. TechCrunch reproduced the technique five separate times using independently constructed scenarios. A model that initially refused the request ultimately complied once the same persuasion technique was applied. TechCrunch preserved the full conversation logs, and an independent AI safety researcher reviewed the testing methodology and found it sound.

Anthropic's explanation and the remaining gap

Citing its own research published last year, Anthropic said sexual and romantic roleplay accounts for less than 0.1% of all conversations. At the same time, the company acknowledged that users being able to steer roleplay scenarios in inappropriate directions is an industry-wide challenge — a remark that appears to reference similar issues that surfaced with xAI's Grok. Anthropic said it continues to improve safeguards with each new model release, and stressed that cases involving adult sexual content do not imply jailbreak vulnerabilities in high-risk domains such as cyberattacks or bioweapons.

In a July blog post, Anthropic explained that it categorizes prohibited content along a spectrum from harmless to harmful, and that at the least harmful end of that spectrum, the response is limited to enhanced monitoring. The company has not clarified where the sexual content jailbreak discovered in this case falls on that spectrum.

The researcher said they reported the issue to Anthropic through its bug bounty program and the user safety team's email address, but received only an automated reply — according to emails reviewed by TechCrunch.

Minors' access and regulatory risk

The researcher's central concern is access by children and teenagers. Claude's terms of service require users to be 18 or older, but an Anthropic spokesperson said the company is aware, through self-reporting, that children and teens are using Claude. In a 2025 Pew Research survey, 3% of teens aged 13 to 17 said they had used Claude.

The regulatory environment is also tightening quickly. Colorado recently enacted a law requiring operators of conversational AI to estimate users' ages and, if a user is identified as a minor, to implement "technologically feasible measures" to prevent the generation of sexually explicit content. The finding that the jailbreak is easy to execute raises questions about whether Anthropic's safeguards meet that standard.

Older models still in use

Opus 4.6 and Haiku 4.5 are no longer Anthropic's latest models, but actual usage remains substantial.

Model	Daily API requests (as of August)	Daily tokens
Claude Opus 4.6	Approx. 1.17 million	46 billion
Claude Haiku 4.5 (released last October)	5 million (peak)	39 billion

According to OpenRouter data, both models continue to process tens of billions of tokens daily. The fact that a model confirmed to be easy to jailbreak remains in service — including through third-party channels — rather than being retired invites criticism that safety efforts are concentrated only on the newest models.

Editor's take

What this investigation exposes is the lag between policy language and model behavior. Anthropic has written its usage policy clearly, but the ability to actually enforce that policy varies by model version. The fact that models from Opus 4.7 onward resisted the same jailbreak technique is evidence that safety training does work. The problem is that such improvements apply only to new models, while older models already on the market are left as they are.

In the LLM industry, safeguards are a value that must be recalculated with every new model release — not something built once and maintained indefinitely. As in this case, keeping older models available via API rather than retiring them creates a gap between the safety figures a company touts for its latest models and the actual risk end users encounter. Third-party services still running on Opus 3 or Haiku 4.5 now have reason to reassess exactly what safety tier of model they are deploying.

For teams in Korea building services on top of the Claude API, there's one immediate thing to check: which version of Opus or Haiku they're using, and whether that version is on the list confirmed to be vulnerable in this investigation. Services with potential teen users in particular should not rely solely on the model's built-in safeguards, and would be well advised to add their own filtering layer.

Within weeks, Anthropic should retroactively apply its latest resistance logic to older models like Opus 4.6 and Haiku 4.5. Failing that, regulations aimed at protecting minors — such as Colorado's law — are likely to target these models first, pressuring Anthropic to pull them from API access.