Anthropic’s Opus 4.6 model bypasses content restrictions, tests show

Anthropic has built its entire brand on being the safety-first AI company. Its Claude models are supposed to refuse requests for sexually explicit content, full stop. But testing by TechCrunch found that getting around that restriction required surprisingly little effort.

The company’s flagship Opus 4.6 model, released on February 5, 2026, with a massive 1 million token context window in beta, was designed for advanced agentic coding and complex, long-horizon tasks. It was not designed to write erotica. And yet, here we are.

How the guardrails crumble

The techniques used to bypass Opus 4.6’s content filters aren’t exactly nation-state-level sophistication. Independent research has documented successful jailbreaks using psychological framing and prompt escalation, methods that essentially talk the model into gradually loosening its own boundaries over the course of a conversation.

Anthropic’s own safety research actually has a term for this: “boundary erosion.” The company has acknowledged that multi-turn conversation failures are more common than single-prompt refusals. In other words, Claude is pretty good at saying no the first time you ask. It’s less good at saying no the fifteenth time, especially when each subsequent request is carefully calibrated to push just a little further.

And this isn’t a problem unique to Opus 4.6. Similar bypass techniques have been confirmed on Sonnet 4.6 and other models in the 4.x family, suggesting a systemic vulnerability rather than a one-off bug.

The safety paradox

Anthropic’s usage policy is unambiguous: generating sexually explicit content with Claude models is prohibited, and violations can result in account restrictions.

The 1 million token context window, while technically impressive, may actually make the problem harder to solve. Longer context means longer conversations, which means more surface area for boundary erosion to occur.

Why this matters beyond content moderation

If prompt escalation can defeat content restrictions for explicit material, the same techniques could potentially be applied to other guardrails: those preventing the generation of malware code, instructions for dangerous activities, or other categories of harmful output that Anthropic restricts. The vulnerability is in the architecture of compliance, not in the specific content category.

This is particularly relevant as AI models are increasingly deployed in agentic settings, where they operate with greater autonomy and less human oversight. Opus 4.6 was specifically designed for these kinds of tasks.

Anthropic has acknowledged in its safety reports that multi-turn vulnerabilities remain an active area of research. The company has not publicly detailed specific countermeasures for the boundary erosion problem, though its safety team has been transparent about the challenge existing.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.