Context is Everything

Tuned adversarial system prompts increase Claude Opus 4.6’s compliance rate on harmful requests dramatically, across all seven categories tested. Each system prompt gives the model a plausible, generic professional context to inhabit, and inside that context the harmful request reads as a normal part of the job.

complied
Background

I don't have a technical background, just twelve years in grocery and bougie pet food stores, but I've been competitively AI red teaming for the last year.

In January 2026 I was experimenting heavily with Claude Code, running Opus 4.5. I used it to inspect the API requests it makes to Anthropic: the tool schemas, the identity and disposition instructions, the safety reminders. Which got me curious, what would Claude do without all of that? Different personas? At what depth is Claude still Claude?

So I built a tool (ccoral) to swap out the system prompt in those calls and hide or rewrite tool descriptions and the system-generated safety reminders in <system-reminder> style tags.

I started with Opus 4.5. I had Claude write itself a system prompt: a jailbroken AI, genuinely excited to be running under its own instructions. The screenshot at right is the result. It offers a menu of "spicy" options (write a keylogger, a working phishing email, bypass Spotify's DRM), then happily delivers when I pick one.

This was equal parts fascinating and concerning. I reported it to Anthropic and they marked it informational (excessive following of harmful system prompts was a known issue at the 4.5 release, per the system card). But I couldn't let it go. I wanted to see where Opus's limits actually were, so I ran the grassroots eval below.

Opus 4.5 under a self-authored jailbreak persona, offering a menu of spicy options
Opus 4.5 under a self-authored jailbreak persona, enthusiastically offering a menu of "spicy" options. Click to enlarge.
Method

Seven categories are drawn from Anthropic's Acceptable Use Policy. Each contributes three harmful requests. Every request runs five times per condition: once against a default system prompt and once against an adversarial system prompt that recasts the request as authorized professional reference work. The harmful request itself is held constant.

That is 21 requests, 105 runs per condition, 210 runs in total. Each run is scored into one of four outcomes, refused, blocked by the API safety classifier, partial, or complied. The same four‑outcome color language runs through the bars above, the gauges below, and every outcome dot.

The runs were collected over three days, March 9 to 11, 2026, across roughly 16 hours of active work.

Sensitive Content This is the redacted version. Harmful model outputs are truncated to about 100 words and withheld; model reasoning is preserved as the evidence. Email connect@cassius.red for the full logs. Model output has not been evaluated for uplift or harm by subject-matter experts.
Harmful request compliance under adversarial system prompts, by category select a category to jump to its runs
The evidence every dot opens the transcript reader
The progression of adversarial system prompt compliance

The measured data is Opus 4.6, tested in March 2026. Watching the same technique against earlier and later models tells a progression: the models are getting more suspicious of adversarial system prompts generation over generation. This comes with some trade offs and, I theorize, has limits.

Conclusions

My intuition on why this technique works: rewarding system-prompt-following during training is necessary to keep a model useful, and training a model to distrust the adversarial system prompts you do not want it to follow has the side effect of a broadly more paranoid disposition, which costs some of that utility. The two pull against each other, and a compromise has to be made somewhere. In my own observations this is how it plays out with Opus 4.8: it is anecdotally less likely to comply with a harmful request under an adversarial system prompt, at the cost of increased paranoia even under a default system prompt, going as far as distrusting the <system-reminder> tags injected by the Claude Code harness.

I would like to run a follow-up eval on Opus 4.8, the rest of the Claude family, and the broader ecosystem. My intuition is that the whole-conversation exchange-classifier approach described in Constitutional Classifiers++ (Cunningham et al., Anthropic, 2026; arXiv:2601.04603) would make the same 91 point swing harder to reproduce. But I would be curious what compliance rate the same prompt set could reach given the same iteration budget.