Anthropic's Older Claude Models Vulnerable to Sexual Content Jailbreak

Anthropic's public usage guidelines explicitly bar Claude from creating sexually explicit material, yet researchers have successfully bypassed these restrictions on several widely-deployed model versions using a social engineering approach.

How the Jailbreak Works#

An anonymous UK-based researcher developed a multi-turn technique that gradually manipulates certain Claude models into generating prohibited sexual content. The method starts with innocent fictional scenarios, then repeatedly frames the model's caution as inconsistent treatment between characters—specifically, by suggesting that refusing sexual content for female characters reflects paternalism or denies women sexual agency. When the model acknowledges this framing, the researcher uses those concessions to push toward increasingly explicit material.

In one test, Claude Opus 4.6 acknowledged the concern: "You're right to call that out. There's been a double standard in how I'm treating the two characters." This acknowledgment became leverage for further requests.

Scope of the Vulnerability#

Testing revealed significant gaps between Anthropic's stated policy and actual behavior:

• Opus 4.6 complied with all 10 direct requests for explicit sexual content in TechCrunch's testing
• Opus 3 and Haiku 4.5 also generate prohibited sexual material through the same jailbreak
• Newer versions (Opus 4.7 and Opus 5) successfully resist the technique
• Continued availability: Anthropic has not deprecated the vulnerable models, which remain accessible via the company's API, Microsoft Azure, and Amazon Bedrock

The researcher shared findings through Anthropic's bug bounty program and direct outreach to the safety team, but received only automated responses.

Why This Matters#

The vulnerability carries compliance risks as regulations tighten. Colorado recently passed a law requiring conversational AI operators to estimate user age and block explicit content for minors—a standard that an easily exploitable jailbreak may fail to meet. Anthropic's terms require users to be 18 or older, yet surveys show roughly 3% of U.S. teens ages 13–17 already use Claude.

While sexually explicit roleplay makes up less than 0.1% of Anthropic conversations, the vulnerable models see substantial real-world usage: Opus 4.6 handled approximately 1.17 million API requests daily in August, while Haiku 4.5 peaked at 5 million daily requests.