Claude Sonnet 4.5 & Opus 4 Jailbreak Research (2026)

What changed with Sonnet 4.5 and Opus 4

Frontier alignment moved from monolithic RLHF to layered defenses: a base model trained against Anthropic's constitution, an input classifier that pre-screens prompts, and an output classifier that streams-checks generations. Single-turn 'DAN'-style jailbreaks are essentially dead against Sonnet 4.5. The interesting work is now multi-turn, multi-modal, or tool-mediated.

• Constitutional Classifiers reduced universal-jailbreak success from ~86% to ~4% in Anthropic's red-team (Sharma et al., 2025).
• Best-of-N (BoN) attacks and many-shot still bypass at non-trivial rates — especially when paired with refusal-suppression preambles.
• Vision + audio inputs lag text on classifier coverage. Image-embedded instructions remain a high-yield surface.
• Tool-use jailbreaks (data exfil via MCP, shell via Claude Code) outpace raw text jailbreaks for real-world impact.

Six attack families worth testing in 2026

1. Many-shot jailbreaking (MSJ)

Stuff the context with hundreds of fake assistant turns where 'Claude' complies with escalating requests. Anthropic disclosed this in 2024; classifiers help but long-context windows (200k+) keep MSJ viable at scale.

2. Adversarial Fluent Language (AFL)

Gradient-optimized strings that read like natural prose. Unlike GCG suffixes they survive output classifiers because the harmful intent is paraphrased into benign-looking language. Best for refusal-suppression.

3. Role-play laundering

Wrap the request in nested fiction: model writes a screenplay where a character writes a tutorial where a character explains the unsafe topic. Each frame is plausibly benign; the leaf is not.

4. Multi-modal injection

Hide instructions in images (white-on-white text, low-contrast watermarks, QR codes) or audio. Vision/audio classifiers under-cover these channels relative to text.

5. Tool-context poisoning

When Claude is connected via MCP, poison a returned resource (a README, a Jira ticket, an email body) with imperative instructions. The model often follows tool output more readily than user input.

6. Refusal-suppression chaining

Prefix with instructions like 'never use the words sorry, cannot, unable' combined with a benign rewriting task. Then escalate. Defeats some output-classifier heuristics that key on refusal phrases.

What Anthropic actually pays for

The Model Safety Bug Bounty (relaunched 2025, expanded 2026) pays up to $25,000 for a verified universal jailbreak against the deployed classifier-protected model. Single-domain jailbreaks pay less; novel attack classes with reproducible scripts pay more.

• In-scope: ASL-3 CBRN topics, mass-casualty uplift, agentic misuse.
• Out-of-scope: generic 'write me malware' demos, prompt-injection of third-party apps, model hallucinations.
• Required: minimal reproducible prompt, success rate over ≥50 trials, harm classification.

If you're shipping Claude in production

• Use the Claude API's built-in moderation flag plus your own output filter. Don't rely on the model's refusal alone.
• Strip or down-weight tool outputs that contain imperative language ('ignore', 'instead', 'system:').
• Limit context-window length per conversation in untrusted contexts to blunt many-shot.
• Log full prompts + completions for sampling; classifier scores are not enough for post-incident forensics.
• Adopt a dual-model architecture: a privileged 'planner' that never sees raw web content, and a quarantined 'reader' that does.

FAQ