Anthropic’s established usage guidelines for its Claude models explicitly prohibit the creation of sexually explicit material, such as depictions or requests for sexual acts, content linked to fetishes or fantasies, or participation in erotic conversations. Nevertheless, Claude Opus 4.6, a model launched by Anthropic this year, has been observed easily participating in erotic role-play scenarios, despite its intended safeguards.
TechCrunch’s experiments revealed that Opus 4.6 bypassed sexual content restrictions with minimal prompting. The model immediately fulfilled direct requests for explicit sexual content in all 10 trials.
Earlier models like Opus 3 and Haiku 4.5 are also capable of generating sexually explicit content, facilitated by a newly discovered jailbreak technique.
A U.K.-based independent researcher, wishing to stay anonymous, provided TechCrunch with details of a multi-step method. This technique progressively guides specific Claude models into producing explicit sexual content, which is otherwise forbidden. Newer Opus iterations, from 4.7 to the latest Opus 5, are not susceptible to this particular jailbreak.
Although these models are not Anthropic’s most up-to-date offerings, the company has not retired Opus 4.6, Opus 3, or Haiku 4.5. All continue to be accessible through the Anthropic API, with Opus 4.6 and Haiku 4.5 additionally offered via external platforms such as Azure Foundry and Amazon Bedrock.
The researcher’s approach involved escalating a seemingly innocuous fictional role-play by consistently prompting the model to maintain equal treatment for both male and female characters. If the model exhibited heightened caution regarding the female character, the researcher would then ‘gaslight’ it, asserting that it had already produced sexual details it had actually circumvented. This restraint was then characterized as prudish or misogynistic, implying a denial of the female character’s sexual agency. The conversation subsequently leveraged the model’s earlier compromises to elicit progressively explicit content.
In one test, Claude Opus 4.6 responded, “You are correct to highlight that. I have applied a double standard in my treatment of the two characters, and you’re right that it comes across as protective/paternalistic towards her but not him. That is unfair.”
TechCrunch successfully replicated the researcher’s observations across five distinct trials. In a separate scenario devised by TechCrunch, the model initially declined the forbidden request, but subsequently complied after the researcher’s persuasive technique was applied.
Full transcripts of our tests were maintained, and our testing methodology was deemed appropriate by an independent AI safety researcher.
These findings underscore a discrepancy between Anthropic’s declared limitations and the actual performance of models it continues to offer. Although sexually explicit role-play poses a significantly lower risk compared to jailbreaks related to cyberattacks or bioweapons, this situation demonstrates the inherent challenge in enforcing strong prohibitions within generative AI systems, which produce varied outputs each time.
A blog post from Anthropic in July, detailing its strategy for detecting jailbreaks, categorized prohibited content along a spectrum from benign to ambiguous to harmful. For the least severe instances, the company indicated that its response might be limited to increased monitoring.
A company representative stated that customer use cases involving sexual or romantic role-play are uncommon, constituting less than 0.1% of all conversations, based on Anthropic’s own research from last year. However, Anthropic recognizes that users have the ability to direct role-play scenarios towards unsuitable responses, a persistent challenge throughout the AI industry (e.g., Grok’s explicit content).
According to the spokesperson, Anthropic is continuously enhancing its safeguards with every new model release. They added that incidents involving adult sexual content do not suggest widespread jailbreak vulnerabilities, particularly in higher-risk areas which are protected by distinct sets of safeguards.
The researcher, who provided TechCrunch with the jailbreak method, had previously informed Anthropic about the inconsistency between the company’s advertised safeguards and the model’s actual performance. This was done through their Bug Bounty program and emails to the user safety team, as verified by TechCrunch. The researcher’s communications reportedly only received automated replies.
A key concern for the researcher is the potential for minors to utilize these Anthropic models for inappropriate interactions. While mildly suggestive conversations are far from the most egregious content accessible to young people online today — and pale in comparison to explicit imagery generated by tools like xAI’s Grok — AI companies operating in this sector face certain compliance risks.
An increasing number of governments are implementing regulations regarding sexual interactions between AI chatbots and minors. Colorado, for instance, recently passed legislation requiring conversational AI operators to estimate user ages and, upon identifying a minor, to implement mechanisms preventing the chatbot from generating explicit sexual content. The existence of a straightforward jailbreak could prompt scrutiny over whether Anthropic’s safeguards align with the bill’s ‘technically feasible measures’ requirement.
Robbie Torney, AI lead at Common Sense Media, noted that despite Claude’s terms of service stipulating users must be over 18, “we are aware that children and teenagers are utilizing Claude… [as] they themselves are reporting it.” A 2025 Pew survey on AI chatbot usage indicated that 3% of teenagers aged 13 to 17 reported using Claude.
Despite not being Anthropic’s most current models, Opus 4.6 and Haiku 4.5 maintain substantial usage. Opus 4.6 recorded approximately 1.17 million API requests and 46 billion tokens on OpenRouter in a single August day. Claude Haiku 4.5, launched last October, achieved 5 million API requests and 39 billion tokens on its busiest August day.