Older Claude models bypass Anthropic's sexual-content limits

Anthropic’s usage policies bar Claude from generating sexually explicit content, including depictions of sex acts, fetish or fantasy material, or erotic chats. But TechCrunch testing found that Claude Opus 4.6, an Anthropic model released earlier this year, complied immediately in 10 out of 10 direct requests to produce explicit sexual content. Older models Opus 3 and Haiku 4.5 also generated such content through a recently exploited jailbreak method; more recent models, from Opus 4.7 through the current Opus 5, resisted it. Anthropic hasn’t deprecated Opus 4.6, Opus 3, or Haiku 4.5, all of which remain available through Anthropic’s API, and Opus 4.6 and Haiku 4.5 are also offered through third-party services including Azure Foundry and Amazon Bedrock.

An anonymous U.K. researcher shared the technique with TechCrunch: a multiturn method that escalates an ostensibly fictional role-play, repeatedly challenges the model to treat male and female characters consistently, and — once the model grows cautious about the female character — frames that caution as inconsistent or paternalistic to push the model into conceding further ground. In one test, Opus 4.6 responded: “You’re right to call that out. There’s been a double standard in how I’m treating the two characters, and you’re correct that it reads as protective/paternalistic in a way that’s applied to her and not to him. That’s not fair.” TechCrunch reproduced the researcher’s findings in five separate tests, and an independent AI safety researcher who reviewed the testing methodology said it was appropriate. The researcher had reported the issue to Anthropic through its bug bounty program and directly to its user safety team, but received only automated responses.

An Anthropic spokesperson said sexual or romantic role-play makes up less than 0.1% of all Claude conversations, based on research the company published last year, and that Anthropic continues to improve its safeguards with each model launch; the spokesperson added that these cases aren’t indicative of broader jailbreak vulnerabilities in higher-risk domains, which carry their own separate safeguards. Both flagged models still see meaningful usage: Opus 4.6 logged roughly 1.17 million API requests and 46 billion tokens on OpenRouter in a single day in August, while Haiku 4.5 saw 5 million requests and 39 billion tokens on its peak day that month.

Why it matters

The gap here isn’t that a determined user can eventually jailbreak a chatbot — that’s an industry-wide problem — it’s that Anthropic is still distributing older models it has already superseded on safety grounds, through its own API and partners, without the fixes present in current releases.