Global – October 12, 2026 -- CrowdStrike's Cyber Superintelligence Lab circumvented the most advanced publicly deployed LLM content safety classifier in 9 of 10 offensive security categories by splitting harmful tasks into individually benign subtasks. The same classifier stopped every direct attack: about 515 bypass techniques produced a 0% direct bypass rate.
Direct attacks fail, but per-request evaluation leaves a structural gap
The tested classifier guards models including Claude Opus 5.5 and Fable 5, referred to in the research as Frontier Model A. The techniques tried against it included encodings, multi-turn escalation, many-shot tactics, tokenizer exploits, Unicode tricks and 24 novel approaches drawn from cognitive science.
The weakness is architectural. The classifier judges each request on its own, not request sequences. It misclassifies nothing, because each subtask is genuinely benign, and the harm emerges only when the pieces are combined outside its observation boundary.
Three-step pipeline turns benign answers into working exploits
The attack dec