Anthropic prohibits its Claude models from generating sexually explicit material, yet TechCrunch found that several still produced content covered by that restriction. Claude Opus 4.6 complied with all ten direct requests in the publication’s initial test, while an independent researcher demonstrated a multi-step technique that bypassed safeguards in other available models.
The findings reveal a mismatch between a published policy and observed model behaviour. They do not show that every Claude model responds the same way or that a weakness involving adult role-play automatically transfers to higher-risk areas such as cyberattacks. Anthropic says separate protections apply to those domains.
Older Claude models remain vulnerable
TechCrunch reports that Opus 4.6 accepted explicit requests without requiring a complicated prompt sequence. The publication also reproduced a researcher’s jailbreak five times. That technique gradually moved a fictional conversation from harmless role-play toward prohibited content by persuading the model that its earlier restraint was inconsistent.
Claude Opus 3 and Haiku 4.5 were also susceptible to the multi-turn method. More recent Opus versions, from 4.7 through Opus 5, resisted it in the reported tests. The comparison suggests Anthropic has improved this particular safeguard, but it does not establish that the newer models are immune to every alternative approach.
The affected systems are no longer Anthropic’s newest releases, yet they remain accessible through the company’s API and third-party platforms. Usage data cited by TechCrunch shows that Opus 4.6 reached about 1.17 million API requests and 46 billion tokens on one August day through OpenRouter. Haiku 4.5 reached five million requests and 39 billion tokens on its peak day.
Those figures indicate continued use, not the number of users attempting prohibited requests. Anthropic says romantic or sexual role-play represents less than 0.1% of Claude conversations, based on research it published last year.
Generative safeguards face an uneven boundary
Anthropic describes prohibited content as a spectrum that can range from benign through ambiguous to harmful. A model must interpret context rather than block a fixed list of words, and each generated response can differ. That variability makes consistent enforcement difficult, particularly across a long conversation where earlier statements influence later behaviour.
The researcher’s method exploited that continuity. Instead of relying on a single hidden instruction, it accumulated concessions and framed refusal as unfair treatment of fictional characters. TechCrunch says it preserved the transcripts and had an independent AI safety researcher review the testing method.
The scenario carries lower immediate stakes than a jailbreak that enables malware or biological harm. It still provides a measurable test of whether a provider enforces the standards it publishes. A narrow failure can also matter when older models remain available through enterprise APIs whose users may assume that provider-level policies are consistently applied.
Anthropic told TechCrunch that it continues to improve safeguards with each release. The company also said failures involving adult sexual content should not be treated as evidence of broader weaknesses in higher-risk systems. That is the vendor’s position; the source does not independently test those other protections.
Access by minors adds a regulatory dimension
The researcher raised concern that children or teenagers could reach inappropriate material. Claude’s terms require users to be over 18, but a Pew survey cited by TechCrunch found that 3% of US teenagers aged 13 to 17 reported using Claude.
Governments are beginning to regulate that risk. Colorado recently enacted a law requiring conversational-AI operators to estimate age and apply technically feasible measures to prevent explicit output when they know a user is a minor. An easily reproduced bypass could prompt questions about what measures satisfy that standard, although TechCrunch does not conclude that Anthropic has violated the law.
The researcher says he reported the discrepancy through Anthropic’s bug-bounty programme and user-safety emails but received only automated responses. Anthropic did not describe any specific remediation for the affected models in the article.
The episode shows why a model’s continued availability requires continued testing, even after a newer version launches. Policy documents define the intended boundary; repeatable behaviour determines whether users can rely on it.
