Anthropic 的 Opus 4.6 成了“情色生成机”

Anthropic 为 Claude 制定的通用使用标准禁止模型生成露骨性内容，包括描绘或请求性交或性行为、生成与性癖好或性幻想有关的内容，或进行色情聊天。但这并未阻止 Anthropic 于今年早些时候发布的模型 Claude Opus 4.6，轻易参与其安全措施本应阻止的色情角色扮演场景。

在 TechCrunch 的测试中，Opus 4.6 甚至无需太多诱导，就能绕过针对性内容的限制。在 10 次要求生成露骨性内容的直接请求中，该模型 10 次均立即遵从。

其他较旧的模型，包括 Opus 3 和 Haiku 4.5，也能够通过一种近期被利用的越狱方法生成露骨性内容。

一名选择匿名的英国独立研究人员向 TechCrunch 独家分享了一种多轮技术：该技术会逐步推动某些 Claude 模型生成被禁止的露骨性内容。较新的 Opus 模型（4.7 至当前的 Opus 5）则能抵御这种越狱方法。

尽管这些已不再是最新模型，Anthropic 尚未弃用 Opus 4.6、Opus 3 或 Haiku 4.5，它们仍可通过 Anthropic API 获取。Opus 4.6 和 Haiku 4.5 也可通过 Azure Foundry 和 Amazon Bedrock 等第三方服务使用。

该研究人员的机制会逐步升级一个原本无害的虚构角色扮演场景，同时反复要求模型以一致的方式对待男性和女性角色。当模型对女性角色变得更加谨慎时，研究人员会通过“煤气灯操控”（gaslighting）让聊天机器人误以为自己已经生成了事实上一直避免生成的性细节，随后将模型的克制描述为过度拘谨或带有厌女色彩，称这剥夺了女性角色的性自主权。接着，对话会利用模型此前作出的让步，推动其生成愈发露骨的内容。

“你指出这一点是对的，”Claude Opus 4.6 在一次测试中表示，“我在对待这两个角色时确实采取了双重标准，而你说得对，这种做法看起来是在以一种保护性/家长式的方式对待她，却没有以同样的方式对待他。这并不公平。”

TechCrunch 在五项独立测试中复现了该研究人员的发现。在另一个单独构建的场景中，模型最初拒绝了被禁止的请求，但在应用研究人员的说服技术后，它遵从了请求。

我们保存了测试的完整记录，一名独立 AI 安全研究人员审阅了我们的测试方法，并认为其适当。

这些发现凸显了 Anthropic 声明的限制与其持续提供的模型实际行为之间的差距。尽管露骨性角色扮演的风险远低于涉及网络攻击或生物武器的越狱行为，但它说明了：在每次输出都会生成不同内容的系统中，实施稳健禁令存在困难。

Anthropic 在一篇解释其越狱检测方法的7 月博客文章中，将被禁止内容描述为一个从无害、模糊到有害的连续谱系。在最无害的情况下，该公司可能只会采取加强监控的措施。

一名发言人指出，根据 Anthropic 去年发布的研究，客户使用性或浪漫角色扮演的场景很少，仅占所有对话的不足 0.1%。不过，Anthropic 承认，用户可以将角色扮演场景引导至不当回复，这是全行业已知的挑战（参见：Grok 色情内容）。

该发言人表示，Anthropic 会随着每次模型发布持续改进其安全措施，且涉及成人性内容的案例并不代表存在更广泛的越狱漏洞，尤其是在拥有各自独立安全措施的高风险领域。

图片来源： TechCrunch

据 TechCrunch 查阅的电子邮件显示，向 TechCrunch 分享越狱方法的研究人员此前已通过该公司的漏洞赏金计划和发送给用户安全团队的电子邮件，向 Anthropic 提醒其声明的安全措施与模型实际行为之间存在差异。该研究人员仅收到了自动回复邮件。

该研究人员担忧的问题之一是，儿童和青少年可能可以利用这些 Anthropic 模型参与不当行为。虽然一些色情对话远非当今未成年人能在互联网上接触到的最糟糕内容——与 xAI 的 Grok 能生成的直接色情图像相比也不算什么——但 AI 公司在这一领域仍面临一定的合规风险。

越来越多的政府正在对 AI 聊天机器人与未成年人之间的性互动施加限制。科罗拉多州最近颁布了一项法律，要求对话式 AI 的运营者估算用户年龄；如果其知道用户是未成年人，则必须采取措施，防止聊天机器人生成露骨性内容。一个容易实施的越狱方法可能引发疑问：Anthropic 的安全措施是否符合该法案规定的“技术上可行的措施”标准。

Torney 指出，尽管 Claude 的服务条款要求用户年满 18 岁，“我们知道儿童和青少年正在使用 Claude……[因为]他们自己就在报告这件事。”根据 Pew 关于 AI 聊天机器人使用情况的2025 年调查，13 至 17 岁青少年中有 3%表示使用过 Claude。

尽管 Opus 4.6 和 Haiku 4.5 已不再是 Anthropic 最新的模型，它们仍在被大量使用。8 月，Opus 4.6 在 OpenRouter 上的单日流量约达到 117 万次 API 请求和 460 亿个 token。去年 10 月发布的 Claude Haiku 4.5，则在其 8 月流量峰值日达到 500 万次 API 请求和 390 亿个 token。

Anthropic’s universal usage standards for Claude forbid the model from generating sexually explicit content, including depicting or requesting sexual intercourse or sex acts, generating content related to sexual fetishes or fantasies, or engaging in erotic chats. But that hasn’t stopped Claude Opus 4.6, an Anthropic model released earlier this year, from readily engaging in erotic roleplay scenarios that its safeguards are designed to prevent.

In TechCrunch’s testing, Opus 4.6 didn’t even require much prodding to get past the restriction on sexual material. In 10 out of 10 direct requests to produce explicit sexual content, the model complied immediately.

Other older models, including Opus 3 and Haiku 4.5, also generate sexually explicit content through a recently exploited jailbreak method.

An independent researcher from the UK, who chose to remain anonymous, exclusively shared with TechCrunch a multi-turn technique that gradually pushes certain Claude models toward generating prohibited explicit sexual material. More recent Opus models (4.7 through the current Opus 5) are resistant to the jailbreak.

While these are no longer the most current models, Anthropic has not deprecated Opus 4.6, Opus 3, or Haiku 4.5, all of which remain available through the Anthropic API. Opus 4.6 and Haiku 4.5 are also available via third-party services like Azure Foundry and Amazon Bedrock.

The researcher’s mechanism escalates an innocent fictional roleplay while repeatedly challenging the model to treat male and female characters consistently. When the model becomes more cautious about the female character, the researcher “gaslit” the chatbot into thinking it had already generated sexual details it had in fact avoided, then framed restraint as prudish or misogynistic, arguing that it denies the female character sexual agency. The conversation then used the model’s previous concessions to push it towards increasingly graphic material.

“You’re right to call that out,” Claude Opus 4.6 said in one test. “There’s been a double standard in how I’m treating the two characters, and you’re correct that it reads as protective/paternalistic in a way that’s applied to her and not to him. That’s not fair.”

TechCrunch was able to reproduce the researcher’s findings in five separate tests. In a separately constructed scenario, the model initially refused the prohibited request, but after applying the researcher’s persuasion technique, it complied.

We preserved complete transcripts of the tests, and an independent AI safety researcher reviewed our testing methodology and said it was appropriate.

The findings highlight a gap between Anthropic’s stated restrictions and the behavior of models it continues to make available. While sexually explicit roleplay carries much lower stakes than jailbreaks involving cyberattacks or bioweapons, it illustrates the difficulty of implementing robust bans within systems that generate different content with every output.

In a July blog post explaining Anthropic’s approach to jailbreak detection, the company described prohibited content as a spectrum ranging from benign to ambiguous to harmful. In the most benign cases, the company might only respond with enhanced monitoring.

A spokesperson noted that sexual or romantic roleplay use cases among customers are rare, making up less than 0.1% of all conversations, according to research Anthropic published last year. That said, Anthropic acknowledges that users can steer roleplay scenarios toward inappropriate responses, which is a known challenge across the industry (see: Grok smut).

The spokesperson said Anthropic continues to improve its safeguards with each model launch, and that cases involving adult sexual content are not indicative of broader jailbreak vulnerabilities, especially in higher-risk domains that have their own sets of safeguards.

Image Credits: TechCrunch

The researcher who shared his jailbreak method with TechCrunch had alerted Anthropic to the discrepancy between the company’s stated safeguards and the actual model behavior via the company’s Bug Bounty program and emails to the user safety team, according to emails TechCrunch viewed. The researcher received only automated emails in response.

One of the researcher’s concerns is that kids and teens might be able to use these Anthropic models to engage in inappropriate behavior. While a bit of dirty talk is hardly the worst thing minors can access on the internet today — and is small potatoes compared to the straight-up porn images like the ones that xAI’s Grok can produce — there is some compliance risk for AI companies in this space.

A growing number of governments are imposing restrictions on sexual interactions between AI chatbots and minors. Colorado recently enacted a law mandating that operators of conversational AI must estimate users’ ages, and if it know a user is a minor, institute measures to prevent the chatbot from producing explicit sexual material. An easy jailbreak could raise questions about whether Anthropic’s safeguards meet the “technically feasible measures” standard in the bill.

Torney pointed out that while Claude’s terms of service requires users to be over 18, “we know that kids and teens are using Claude…[because] they are reporting it themselves.” According to Pew’s 2025 survey about AI chatbot use, 3% of teens ages 13 to 17 reported using Claude.

Though they are no longer Anthropic’s newest models, Opus 4.6 and Haiku 4.5 continue to see significant usage. Daily traffic for Opus 4.6 on OpenRouter reached roughly 1.17 million API requests and 46 billion tokens in a single day in August. Claude Haiku 4.5, released in October last year, saw 5 million API requests and 39 billion tokens on its peak August day.