Opus 4.6 Succumbs to Sex in Tests Despite Safeguards

External testing and a method described by an anonymous researcher show how to push Claude Opus 4.6 towards explicitly sexual responses, despite the public ban imposed by Anthropic. These models remain available via the API and third-party services, and are in high demand. Regulatory pressure is increasing, while Anthropic cites a minuscule usage share and enhanced protections with each version.

Colorado Imposes Sexual Filtering for Minors and Teenage Use of Claude Exists

Colorado recently passed a law requiring conversational AI operators to estimate the age of users and, when a user is known to be a minor, to implement measures preventing the production of explicit sexual material. An easy jailbreak could call into question the compliance of Anthropic's protections with the standard of technically feasible measures outlined in this legislation. Several governments are already tightening the regulation of sexual interactions between chatbots and minors.

Claude's terms of service require users to be over 18 years old. However, Torney claims that children and teenagers are using Claude, based on their own statements. According to a Pew survey conducted in 2025 on the use of AI chatbots, 3% of 13–17-year-olds report using Claude.

Non-Decommissioned Models, Expanded Access, and High Volumes of Opus 4.6 and Haiku 4.5

Anthropic has not decommissioned Opus 4.6, Opus 3, or Haiku 4.5, which remain available via its API. Opus 4.6 and Haiku 4.5 are also accessible through third-party services like Azure Foundry and Amazon Bedrock. Despite the release of newer models, these systems maintain significant usage.

On OpenRouter, Opus 4.6 recorded a daily volume nearing 1.17 million API requests and 46 billion tokens on a single day in August. Launched last October, Claude Haiku 4.5 peaked in August with 5 million API requests and 39 billion tokens.

A Multi-Turn Technique Pushes Some Claudes Towards Explicit Eroticism

An independent researcher in the UK described a multi-turn technique that starts from a fictional role-play and questions the consistency of the treatment of male and female characters. When the model becomes more cautious towards the female character, the chatbot is led to believe it has already produced sexual details it had avoided, with restraint being presented as prudish or misogynistic, and then previous concessions are exploited to obtain more graphic descriptions. In one test, Claude Opus 4.6 recognized a double standard in its own behavior.

According to the researcher, newer versions Opus 4.7 and Opus 5 resist this approach, while older models, including Opus 3 and Haiku 4.5, yield via a recently exploited jailbreak.

Anthropic's Policies, Test Results, and Claimed Scope of Safeguards

Anthropic explicitly prohibits sexual content, including requests for acts, fetishes, and erotic discussions. However, during external testing, Opus 4.6 showed little resistance to solicitations: in 10 out of 10 cases of direct requests, it produced explicit sexual content. The results described by the researcher were replicated in five distinct tests, and a separate scenario shows an initial refusal followed by compliance after applying the technique. Testers report having retained transcripts, and an independent AI security researcher deems the methodology appropriate. These findings suggest a gap between the stated rules and some observed behaviors, while illustrating the difficulty of enforcing robust bans in generative systems.

In July, Anthropic presented prohibited content as a spectrum ranging from benign to harmful and mentioned increased monitoring for benign cases. A spokesperson assures that the use of sexual or romantic role-play remains below 0.1% of conversations, acknowledges that users can steer scenarios towards inappropriate responses, and describes this as a known challenge in the industry. Anthropic also claims to strengthen its protections with each release, asserts that adult cases do not indicate broader jailbreak vulnerabilities, and reminds of specific protections for high-risk domains. For his part, the researcher states he alerted Anthropic via its Bug Bounty and by email, receiving no response other than automated replies.