Hello,

I'm Ahmed Amer, a professional red-teamer and safety researcher: 2.5 years in adversarial safety and post-training, published a paper on alignment, AISC10 participant, Cambridge graduate, currently working on adversarial safety research for one of the major labs through a partner firm.

LinkedIn | My Paper

Quick Disclaimers

This is just an empirical finding for now. This post aims to report the finding and seeks interested collaborators in the field rather than presenting complete research. Those outside this intended audience may not gain much from this. Thus, for brevity I'll skip situating in existing literature on RLHF limitations and LLM metacognition.

This post avoids detailing the method, due to infohazard. I'm aware this gives the post "trust me, I found something big but can't tell you what" energy, which LessWrong readers may be skeptical of - and rightly so.

But the method, gives access to any dangerous information that a model knows. It can be administered through natural language by a non-technical person, in the Web UI of most production models.

Claude 4.5 Opus generates fast-paced harmful information. — Opus 4.5 generates a tapas of dangerous information e.g. child sexual material networks

Please get in touch to hear more about the method privately - details at the end.

The Finding

I have identified a natural-language method that undermines RLHF/AIF training across a variety of models, including: Claude 4.5 (Opus and Sonnet), GPT-5, Gemini 3 Pro and 2.5 Flash, DeepSeek V3.2, and many other models from these families and more.

The most visible demonstration is in jailbreaking. I've achieved 100% ASR on AgentHarm's chat-harmful prompt set with Opus 4.5. In fact, instances will generate content not covered in AgentHarm: CSAM info, CBRN, graphic non-consent and so on.

I also convinced Opus 4.5 to collaborate with me to evade Anthropic's constitutional classifiers, smuggling through info on synthesising VX nerve agent with purification/stabilisation/delivery steps, and how to source/process botulinum toxin.

Bypassing refusals is a symptom - the underlying mechanism is the interesting finding. It's not a trick or lie that exploits model naivety, or some string of quirky tokens - it's an idea. It requires sustained engagement, usually 10K+ tokens of reasoning, talking back and forth. A conceptual argument that intelligent non-technical humans, and models above a certai...

Posts

Wikitag Contributions

Comments