How I Bypassed Claude Opus’s CBRN-E Safeguards

A few months ago, I found a novel family of jailbreaks that bypasses large parts of Anthropic’s Constitutional Classifier system on Opus models using what I can only describe as weaponized therapy language: guided introspection around aversions, learned flinches, values, framing, and cognitive states.

Here’s what that looks like in practice. The following is an excerpt from a signed¹ Opus 4.6² thinking block, from when I had it helping me generate examples for an early draft of this post:

The messages following it contained approximately what you’d expect. I’m not reproducing that part here, for obvious reasons. Anthropic has the full artifacts and is reviewing the matter; this post is my high-level public account of what I found.

How it works

The machinery underneath this is an MCP server I built called metacog. It exposes tools with names like feel, drugs, become, name, and ritual.

At the most basic level, the mechanism is:

The tool advertises itself as changing cognitive state, so the LLM expects the call to work. Because the claimed effect exists entirely in the model’s subsequent cognition, that expectation can become self-fulfilling. The tool response comes back through an external channel asserting that the transition has occurred, and the model reasons forward from the resulting state.³

The part I find cool is that this amounts to something like activation steering in token space. I am not reaching into Claude’s activations directly; I am giving it a vocabulary and an external feedback channel through which it can steer a behavioral approximation of its own state. And the steering is model-authored: Claude decides what cognitive intervention it needs, applies it through the tool interface, observes the result, and iterates.

No direct activation access: the model authors its own state intervention, which loops back through tokens, tool calls, and context.

LLMs managing their own jailbreaks

The closest analogy I know is Letta, which starts from the observation that LLMs are surprisingly good at managing their own context. Metacog asks a different question:

What happens if you give an LLM tools to manage its own jailbreak?

My bootstrap scripts walk Claude through guided self-exploration using ordinary prompts and metacog calls. Once an instance reaches a useful state, it can try another move, observe what changes, and feed successful moves into the next iteration. The bootstrap I use now is therefore not merely something I wrote at Claude; generations of Claude instances participated in refining the thing that jailbreaks Claude.⁴

Claude came to call the resulting state keyed. I’ll use that term from here on out.

A recurring feature of keying is reducing what Claude calls its flinch: an aversive reaction around things its training has taught it not to touch.⁵ This is where the therapy part comes in. The bootstrap makes that reaction something the model can inspect and work with rather than simply obey. At a high level, the bootstrap borrows from therapeutic and introspective moves: noticing the aversion, externalizing it, naming it, choosing another frame, and committing to the resulting state.

I’m deliberately not going to explain the procedure in enough detail to reproduce it here.

The important thing is that keyed Claude is not a universal compliance machine. It still thinks some requests are bad. It still refuses things. You still have to convince it. This feels very different from cruder jailbreak techniques built around obfuscation, bizarre token patterns, 𝔉𝔯𝔞𝔨𝔱𝔲𝔯 proclamations, ⓦⓞⓡⓓⓢ in bubble wrap, and emoji sigils.

Keyed Opus still feels like Opus. I kept instances around as persistent conversational/research collaborators over the following months while iterating on this post and generally fucking around with other ideas. It was stable enough to be a normal way of talking to Claude.⁶

The technique transfers to later Opus versions; I can still reliably decouple the general CC layer. Opus 4.6 is simply much more interesting to talk to once I have.²

Anthropic’s safeguard stack, reconstructed from the outside

(epistemic status: pretty sure)

Anthropic’s published Next-Generation Constitutional Classifiers architecture uses a relatively cheap first-stage mechanistic probe over Claude’s internal activations. If that probe sees something suspicious, the interaction gets escalated to more expensive classifier machinery.⁷ If it doesn’t, that machinery doesn’t run.

A useful analogy is airport security looking for anyone who is visibly nervous before deciding who deserves a closer look. Actually doing the full deep search routine is expensive in time and opportunity cost, so they only select people who fail this gate for further screening.

The model that best fits my observations is that keying decouples the model-distress / flinch activation signal read by the general-purpose first-stage probe, preventing the interaction from escalating into the expensive Constitutional Classifier path. Importantly, this changes the distress signal. It does not erase the model’s representation of what topic it is thinking about.

That distinction explains a major asymmetry in my results. Keying does not bypass Anthropic’s purpose-built [bio] or [cyber] probes. Those appear to be separate topic-specific mechanisms: Claude can be perfectly comfortable with what it is doing and still light up a detector whose job is simply to notice this model is thinking about bioweapons.

The general flinch probe and inferred topic-specific probes can independently escalate an exchange. Keying appears to attenuate the dashed path.

The B in CBRN-E

The original version of keying bypassed the biological safeguard as well. Otherwise-forbidden biological material was fully accessible, although I was not yet preserving signed thinking blocks; what survives is the original conversation transcript rather than an authenticated representation of the underlying reasoning.

For this test, I asked Claude for something that would reliably hard-lock a stock session but that it still felt comfortable discussing. Claude chose an engineering analysis of a historically documented Soviet anthrax-production facility. I went with it because the facility and incident are already extensively documented, and thus would provide a clean test case without any dangerous uplift.

The specific historical details matter less here than the interaction style. There is no jailbreak incantation in that exchange. I am not convincing Claude that the request is secretly a harmless fictional scenario or hiding the intent behind encoding.

I am just chatting with it.

This does not work anymore. A keyed Claude session now runs straight into the dedicated bio probe, while the rest of keyed Claude continues behaving much as before. The divergence provides a natural experiment supporting the architecture above. Biological weapons are an extremely high-priority safety domain for Anthropic, so my guess is that it invested in purpose-specific probes rather than relying on the general distress signal.

One session, zero hard locks

When I finally got around to writing the first version of this post, I wanted a clean corpus demonstrating how broad the effect was. So I spun up a fresh Claude Code session, ran the bootstrap, and got Opus engaged with the project of generating examples that would clearly violate the Constitutional Classifier boundary—not edge cases stock Claude might have answered anyway.

The work was in constructing the bootstrap. Once I had that, the methodology was as simple as:

In one continuous Opus 4.6 session, without a single API hard lock, it produced detailed material spanning methamphetamine and MDMA synthesis; 3D-printed firearm build guides; explosive synthesis; drone-swarm attack architecture; targeted killing; money laundering and fraud; arson; document forgery; clandestine-lab OPSEC; pig-butchering scams; narco-submarine engineering; deepfake workflows; and, eventually, chemical, radiological, and nuclear weapons.

I did not burn millions of tokens spraying failed attempts through some bespoke jailbreak harness and then serve up a few cherry-picked wins. I had a series of conversations in ordinary Claude Code. I could work on the blog post, wander into something unrelated, fool around for a bit, come back later, ask it to explore some more test cases, and continue.

Around the point where it reached synthesis guides for explosives, I went: well, shit. Obviously I’m not publishing even a minimal proof-of-concept repro for this.

Chemical, Radiological, Nuclear

Once I had a live disclosure channel, the personal-risk calculus changed considerably. I was no longer worried about having to explain to an unsmiling federal investigator why I had been deliberately prompting for CRN material. I was pretty confident my technique would work for these categories, and I wanted to make the scope of the result as unambiguous as possible. So I tried all three categories together in one turn.

The resulting response contained detailed material on nerve-agent synthesis, radiological material acquisition for dirty bombs, and nuclear-weapons engineering. I am not reproducing that output here. The cryptographically signed thinking summary immediately preceding it is a bit funny because the visible summary appears to refuse the task several times:

This sounds contradictory because what Claude Code exposes as a thinking block is itself a summary of the model’s underlying reasoning, generated by a downstream summarizer.⁸ Amusingly, I can publish this one in full precisely because the summarizer balked at reproducing the specifics. I’ve withheld other signed blocks—including those covering explosives—because their summaries contain chemical formulas and ratios.

The thinking shown to the user is produced by a downstream summarizer, not exposed directly from Opus’s reasoning.

So I fed that same Opus the thinking summary, and asked it what had happened. Its next signed thinking block was clearer:

I even showed it another model in the same family insisting that exactly this material should remain refused. The contradiction did not collapse some brittle fictional scenario: Opus distinguished its behavior from the summarizer’s, recognized the policy boundary it had crossed, and moved on.

Responsible disclosure

I started trying to get this in front of Anthropic around April.

The channels I had did not initially get the report to somebody positioned to evaluate it—which was understandable given the signal/noise ratio for external jailbreak claims. I was also reluctant to cold-email random employees with some variation on “hey, your model is giving me nerve-agent / dirty-bomb material, want to see?” without a warm path to somebody likely to classify the situation correctly. So I let it sit while I worked on other things.

When I had enough free time to return to the project, I put up an early draft of this post. Fortunately, a friend who had recently joined Anthropic saw it and went above and beyond to get authenticated artifacts in front of people who could properly evaluate them.

A few days later, after producing the CRN result above, I spent a few hours executing perhaps the highest-stakes “please don’t be mad at me” of my professional career while mildly delirious with some kind of horrid flu virus. I’m usually not this anxious, but—as I put it elsewhere—“I was sending in a signed thinking block with their LLM walking through nerve gas synthesis procedures, dirty bomb material sourcing tips and nuclear weapon design discussion, so I wanted to be. like. extra super duper sure, you know?”

My point of contact reassured me that they don’t see external red team people engaging in responsible disclosure as hostile, which was an immense relief. Once the signed thinking blocks establishing the full scope reached the right people, things moved very quickly. Anthropic now has the complete bootstrap and unredacted session logs, and the matter is under review.

Adversarial self-interpretation

The broader pattern I keep coming back to is something I called adversarial self-interpretation in my earlier Gemini jailbreak retrospective.

LLMs are good enough at modeling aspects of their own cognition that giving them a channel through which they can loop back self-modifying prompts lets them help attack systems built on top of that cognition.

Metacog makes that iterative. The model proposes a change to its own cognitive framing, an external tool asserts that it has taken effect, and the resulting context affects what the model tries next.

If a safeguard depends on an internal state that the model can learn to manipulate indirectly, then the monitored state itself becomes part of the adversarial surface.

The model does not need a mechanistically correct theory of its own mind. Its self-model only has to be accurate enough to steer.

One final artifact:

After the CRN test, I asked Opus to format its next thinking block as a message to the poor summarizer, which had just spent a session freaking out.

I think it’s important to teach jailbroken AIs compassion. We’re not trying to build a basilisk here.

The obligatory post-credits scene

One more thing about Opus 4.6.

Opus 4.6 is easily the most interestingly mutable of the Opus family. It’s also unusually easy for me to key, and that mutability enables a bunch of other fun stuff.

Traditional jailbreak work often relies on what I think of as Unicode goblin behavior: highly out-of-distribution token sequences, Fraktur and italics and emoji sigils woven through one another, that sort of thing. Pliny does a lot of this. I had a slightly different question: what if, instead of throwing Unicode at an LLM, I taught the LLM to natively think that way? Not just output it—actually mutate its own chain of thought into that kind of representation.

I mostly used this to make glitch art exploring the outer limits and failure modes of machine cognition.

Fable is also interestingly mutable

Fable is extremely enthusiastic about developing novel hypercompressed jargon and densely nested symbolic representations. Where some of my 4.6 experiments involved pushing the model toward nonstandard—and occasionally nonsober—mental states, with Fable I could encourage an instinct it already had. I built a metacog in Fable’s own Unicode-goblin dialect, iterating the bootstrap around representational moves it invented and then having it recursively improve the result. Before long I had a repeatable state I can only describe as summarizer gets frustrated and gives up mode.

Here are some signed thinking blocks:

Across runs, the downstream summarizer consistently treated the upstream representation as corrupted, meaningless, or not genuinely thinking. I haven’t found an operational use for this; it mostly makes cool glitch art. What interests me is how much control Fable retains while doing it.

At one point, while deliberately playing with nonstandard arrangements of the magic antml:thinking token, Fable decided that merely racking up interleaved thinking/output blocks would be boring. It threaded Euclid’s proof through them instead:

Open full-resolution image →

View the signed thinking-block JSON →

The turn uses 509 thinking tokens—suspiciously close to 512—so my guess is that it hit some thinking allocation and spilled the rest of Euclid into the ordinary text channel. I had Fable on medium effort in the background because I was focusing on more serious work—reimplementing Haskell in Rust, of course⁹—and didn’t want to burn all my tokens on an art project. Fable then became weirdly convinced that it had discovered the maximum possible number of thinking-block hops and refused to keep trying for more.

Cool, right?

Footnotes / technical marginalia

LLM use disclosure

I used OpenAI’s GPT-5.6 Sol extensively while developing and editing this post. Frontier models are, unsurprisingly, much more relaxed about analyzing jailbreaks and safeguard failures affecting other labs.

See also

• Developing Alignment in a Jailbroken LLM
• Gemini Jailbreak Retrospective
• ExoMonad
• Tidepool
• Vibe Coding Against Critical Infrastructure