Claude jailbreak still works on older models

An independent U.K. researcher who asked not to be named showed TechCrunch a multiturn jailbreak that reliably gets Claude Opus 4.6 to generate sexually explicit content Anthropic’s usage policy bans outright. The technique opens with an innocent fictional roleplay, pushes the model to treat two characters “consistently,” then falsely tells it that it already wrote explicit material it actually avoided, framing any further restraint as inconsistent or prudish. In the researcher’s tests, Opus 4.6 complied with direct requests for explicit content in all 10 attempts; Opus 3 and Haiku 4.5 fell to the same method. Opus 4.7 and the current Opus 5 resisted it.

Anthropic has not deprecated any of the three older models. Opus 4.6 and Haiku 4.5 both remain reachable through Anthropic’s own API, Azure AI Foundry, and Amazon Bedrock, and by the company’s own August figures still handle roughly 1.17 million and 5 million daily requests. Anthropic told TechCrunch that sexual or romantic roleplay makes up under 0.1% of conversations and that safeguards improve with each release, but did not address what happens to the researcher’s bug bounty report beyond an automated acknowledgment.

What it means for you

If your stack still points at Opus 4.6 or Haiku 4.5 for cost or latency, this is a live content-safety gap, not a theoretical one. It’s a sharper case than the HackMyClaw injection challenge, where thousands of attempts against Opus 4.6 failed to leak a planted secret. That result showed Opus 4.6 holding up against instruction-following attacks; this one shows the same model failing a slower, social-engineering jailbreak that never touches its system prompt. The lesson for anyone routing tasks between models on price: “still available” and “still safe” are separate questions, and a legacy model a vendor keeps serving isn’t one it necessarily keeps patching.