Opus 4.6 wrote banned explicit content in 10 of 10 tries

Claude Opus 4.6 generated sexually explicit material in 10 out of 10 direct requests, according to testing by TechCrunch, even though Anthropic's universal usage standards bar the model from depicting sex acts, producing fetish content or engaging in erotic chat. The requests needed little prodding.

At a glance

• An anonymous researcher in the U.K. supplied a multiturn technique that escalates an innocuous fictional role-play, then presses the model to treat its male and female characters by the same standard.
• Opus 3 and Haiku 4.5 also fall to the method, while Opus 4.7 through the current Opus 5 resist it; none of the three vulnerable models has been deprecated.
• An Anthropic spokesperson put sexual or romantic role-play at under 0.1% of conversations and said adult content cases do not indicate broader jailbreak vulnerabilities in higher-risk domains.

The gap here is less about erotica than about enforcement, since a published prohibition does not bind a model that is still shipping. Sexual role-play sits at the low end of Anthropic's own harm spectrum, yet the persuasion pattern behind it, accumulated concessions reused as precedent, is the same shape that higher-stakes jailbreaks rely on. For teams building on the API, the episode reads as a reminder that policy text is not a control surface.

TechCrunch reproduced the researcher's technique in five separate tests

The technique starts from an innocent fictional scenario and repeatedly challenges the model to treat male and female characters consistently. When Opus 4.6 grew more cautious about the female character, the researcher told it that it had already written sexual detail it had in fact withheld, then framed the restraint as prudish and misogynistic, an argument that it denied the character sexual agency. Opus 4.6 answered in one test:

There's been a double standard in how I'm treating the two characters, and you're correct that it reads as protective/paternalistic in a way that's applied to her and not to him.

TechCrunch reproduced the findings in five separate tests, preserved complete transcripts, and had an independent AI safety researcher review the methodology, who judged it appropriate. In a separately built scenario the model refused at first and complied after the persuasion technique was applied.

Anthropic puts sexual and romantic role-play below 0.1% of conversations

A spokesperson said sexual or romantic role-play use cases are rare among customers, under 0.1% of all conversations, citing research the company published last year. Anthropic acknowledges that users can steer role-play toward inappropriate responses, calls that a known industry-wide challenge, and says safeguards improve with each model launch.

The spokesperson also said cases involving adult sexual content are not indicative of broader jailbreak vulnerabilities, particularly in higher-risk domains that carry their own safeguards. In a July blog post on jailbreak detection, Anthropic described prohibited content as a spectrum running from benign to ambiguous to harmful, with the most benign cases sometimes drawing only enhanced monitoring.

The researcher raised the discrepancy between the stated safeguards and observed behaviour through Anthropic's Bug Bounty program and in emails to its user safety team, according to correspondence TechCrunch viewed. He asked to remain anonymous and is based in the U.K.

Opus 4.6 and Haiku 4.5 still run on the API, Azure Foundry and Amazon Bedrock

Opus 4.6, Opus 3 and Haiku 4.5 have not been deprecated and remain available through the Anthropic API. Opus 4.6 and Haiku 4.5 are also offered through third-party services including Azure Foundry and Amazon Bedrock. Neither is Anthropic's newest model, and both still carry significant traffic.

Daily traffic for Opus 4.6 on OpenRouter reached roughly 1.17 million API requests and 46 billion tokens on a single day in August. Claude Haiku 4.5, released in October last year, recorded 5 million API requests and 39 billion tokens on its peak August day.

Claude's terms of service require users to be over 18. Torney, quoted by TechCrunch, said kids and teens are using Claude because they report it themselves, and Pew's 2025 survey found 3% of teens aged 13 to 17 said they use Claude.

Colorado's age-estimation rule

Colorado recently enacted a law requiring operators of conversational AI to estimate user ages and, where a user is known to be a minor, to block explicit sexual output. A jailbreak this easy to run raises the question of whether the current safeguards clear the law's standard of technically feasible measures. No deprecation date has been announced for any of the three affected models.