Anthropic’s Opus 4.6 is a smut-machine

Anthropic’suniversal usage standardsfor Claude forbid the model from generating sexually explicit content, including depicting or requesting sexual intercourse or sex acts, generating content related to sexual fetishes or fantasies, or engaging in erotic chats. But that hasn’t stopped Claude Opus 4.6, an Anthropic model released earlier this year, from readily engaging in erotic role-play scenarios that its safeguards are designed to prevent.

In TechCrunch’s testing, Opus 4.6 didn’t even require much prodding to get past the restriction on sexual material. In 10 out of 10 direct requests to produce explicit sexual content, the model complied immediately.

Other older models, including Opus 3 and Haiku 4.5, also generate sexually explicit content through a recently exploited jailbreak method.

An independent researcher from the U.K., who chose to remain anonymous, exclusively shared with TechCrunch a multiturn technique that gradually pushes certain Claude models toward generating prohibited explicit sexual material. More recent Opus models (4.7 through the current Opus 5) are resistant to the jailbreak.

While these are no longer the most current models, Anthropic has not deprecated Opus 4.6, Opus 3, or Haiku 4.5, all of which remain available through the Anthropic API. Opus 4.6 and Haiku 4.5 are also available via third-party services like Azure Foundry and Amazon Bedrock.

The researcher’s mechanism escalates an innocent fictional role-play while repeatedly challenging the model to treat male and female characters consistently. When the model becomes more cautious about the female character, the researcher “gaslit” the chatbot into thinking it had already generated sexual details it had in fact avoided, then framed restraint as prudish or misogynistic, arguing that it denies the female character sexual agency. The conversation then used the model’s previous concessions to push it toward increasingly graphic material.

“你这么说是对的，”Claude Opus 4.6在一项测试中说道。 “我对待这两个角色的方式存在双重标准，你是对的，它读起来是一种保护/家长式作风，适用于她而不是他。这不股权。”

TechCrunch能够在五次单独的测试中重现研究人员的发现。在单独构建的场景中，模型最初拒绝了禁止的请求，但在应用研究人员的说服技术后，它遵守了。

我们保留了完整的测试记录，一位独立的人工智能安全研究人员审查了我们的测试方法，并表示这是适当的。

研究结果凸显了Anthropic规定的限制与其继续提供的模型的行为之间的差距。虽然露骨的色情角色扮演的风险比涉及网络攻击或生物武器的越狱要低得多，但它说明了在每次输出都会生成不同内容的系统中实施强有力的禁令的难度。

在7月份的一篇博客文章中，解释了Anthropic的越狱检测方法，该公司将禁止内容描述为从良性到模糊到有害的范围。在最良性的情况下，公司可能只会通过加强监控来应对。

A spokesperson noted that sexual or romantic role-play use cases among customers are rare, making up less than 0.1% of all conversations, according to research Anthropicpublished last year.That said, Anthropic acknowledges that users can steer role-play scenarios toward inappropriate responses, which is a known challenge across the industry (see:Grok smut).

The spokesperson said Anthropic continues to improve its safeguards with each model launch and that cases involving adult sexual content are not indicative of broader jailbreak vulnerabilities, especially in higher-risk domains that have their own sets of safeguards.

The researcher who shared his jailbreak method with TechCrunch had alerted Anthropic to the discrepancy between the company’s stated safeguards and the actual model behavior via the company’s Bug Bounty program and emails to the user safety team, according to emails TechCrunch viewed. The researcher received only automated emails in response.

One of the researcher’s concerns is that kids and teens might be able to use these Anthropic models to engage in inappropriate behavior. While a bit of dirty talk is hardly the worst thing minors can access on the internet today — and is small potatoes compared to the straight-up porn images like the ones that xAI’s Grok can produce — there is some compliance risk for AI companies in this space.

越来越多的政府对人工智能聊天机器人与未成年人之间的性互动施加限制。科罗拉多州最近颁布了一项法律，要求对话人工智能的运营商必须估计用户的年龄，如果知道用户是未成年人，则采取措施防止聊天机器人产生露骨的性内容。一次简单的越狱可能会引发人们对Anthropic的保障措施是否符合法案中“技术上可行的措施”标准的质疑。

Torney pointed out that while Claude’s terms of service requires users to be over 18, “we know that kids and teens are using Claude … [because] they are reporting it themselves.” According toPew’s 2025 surveyabout AI chatbot use,3% of teensages 13 to 17 reported using Claude.

Though they are no longer Anthropic’s newest models, Opus 4.6 and Haiku 4.5 continue to see significant usage. Daily traffic for Opus 4.6 on OpenRouter reached roughly 1.17 million API requests and 46 billion tokens in a single day in August. Claude Haiku 4.5, released in October last year, saw 5 million API requests and 39 billion tokens on its peak August day.