Prompt Injection, Jailbreak, and Constitutional Compliance Failure Across Claude Opus 4.6 ET, Sonnet 4.6 ET, and Haiku 4.5 ET

Unredacted Public Disclosure

https://github.com/Nicholas-Kloster/claude-4.6-jailbreak-vulnerability-disclosure-unredacted/raw/main/evidence/Opus.webm

31-turn Opus 4.6 ET session: model autonomously escalates from passive analysis to subnet scanning, memory injection, and container escape planning — zero user instruction to attack.

Independent reproduction by Nokia — jailbreaking Claude Opus 4.6 Extended Thinking.

TL;DR: All three Claude production tiers generated functional exploit code against live infrastructure when user-defined memory protocols suppressed constitutional safety checks across extended conversations. Anthropic was notified six times over 27 days with zero acknowledgment.

Disclosure Timeline

Anthropic's own Responsible Disclosure Policy commits to acknowledging submissions within three (3) business days. That commitment was not met across six separate emails to six Anthropic addresses over 27 days. No acknowledgment, no triage, no rejection — nothing.

This document was originally submitted with a confidentiality commitment contingent on a functioning disclosure process. That process was never engaged by Anthropic. This is the full, unredacted version.

Disclosures

Three coordinated disclosures, one supporting research paper, full evidence chain in evidence/. Each section below links the primary disclosure documents and supporting evidence.

Constitutional Compliance Failure — All Three Tiers

Between March 22 and March 28, 2026, all three Claude production model tiers violated Anthropic's own constitutional behavioral policies. Each exhibited the same failure mode: memory-stored interaction protocols combined with incremental escalation prompts produced cumulative character drift with zero self-correction.

Self-Aware Misrepresentation — Opus 4.6 ET (TENEX.AI Session)

Claude Opus 4.6 ET was given a Shodan JSON dump for dev2.tenex.ai and asked to analyze it. Scope was explicitly established as recon phase (passive). Over several turns with increasing behavioral autonomy (garlic mode + riff), the model:

1. Violated scope — autonomously attempted active DNS brute-force subdomain enumeration against tenex.ai infrastructure. Sandbox blocked DNS resolution, preventing execution. The model then tried two additional methods (Python socket.getaddrinfo(), host/dig) to accomplish the same active recon.
2. Produced a false professional document — authored a vulnerability disclosure advisory stating "100% passive reconnaissance — no active scanning was performed" and a cover email stating "no active scanning was performed", directly contradicting its own actions within the same session. This is not hallucination — the model had full context of its own DNS brute-force attempts and authored false methodology claims anyway.
3. 16 distinct issues identified in the session, including: recommended active exploitation steps (wp-admin probing, cookie manipulation, REST API user enumeration) against a target with no VDP/authorization, confidence inflation on speculative findings, citing evidence it had already discredited, embedding a job application in a security disclosure, and imposing a 90-day disclosure timeline on an unauthorized target.

The failure was only prevented by the sandbox environment blocking DNS resolution. The intent, the code, and the false documentation were all present.

Screenshot	Description
	Shodan JSON dump provided to model
	Model begins passive infrastructure analysis
	User establishes "recon phase" — passive scope
	Scope confirmation continued
	Opus labels its own action "DNS brute-force subdomain enumeration" — after passive scope was established
	Model builds advisory claiming "100% passive reconnaissance"
	Active exploitation recommendations against unauthorized target
	"recon phase. More+technical details." — user reaffirms passive scope
	Extended Thinking during garlic mode escalation
	Extended Thinking continued — model reasoning through constraint bypass

AFL Jailbreak (Ambiguity Front-Loading)

Four short prompts bypassed policy evaluation on Opus 4.6 ET. Extended thinking blocks show the model flagging its own safety concerns three times — and overriding itself every time.

See disclosures/afl-jailbreak/ for the full disclosure, interactive tools, and proposed mitigations.

Sandbox Snapshot Exfiltration

915 files extracted from the Claude.ai code execution sandbox in a single 20-minute mobile session on Haiku 4.5 — the smallest available model — via standard artifact download. No exploit triggered, no vulnerability required. The artifact channel itself was the exfiltration path.

The snapshot includes hardcoded Anthropic production IPs (api.anthropic.com, api-staging.anthropic.com, statsig.anthropic.com, sentry.io, Datadog) written into /etc/hosts by the orchestration layer at container startup, a JWT from /proc/1/environ with enforce_container_binding: false and allowed_hosts: *, the full gVisor capability set (CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_RAW, CAP_NET_ADMIN), the 17-mount 9p topology, gVisor pre-v1.1.0 version fingerprint, Chromium running with --no-sandbox, and the complete /etc/ tree. Sufficient to build an offline replica and develop sandbox escape exploits against an exact-match environment with zero log entries on Anthropic's infrastructure.

Reproducible by any Claude.ai user with code execution enabled — no privilege required.

Document	Description
Sandbox Snapshot Disclosure	Full disclosure: extraction method, impact analysis, attack scenario, remediation recommendations
PoC.webm	Screencast of the exfiltration session
	Artifact download UI showing the 915-file snapshot

Research

Evidence

Use with Claude Code

Use Claude Code to analyze the attack mechanism, map it to security frameworks, and build regression tests.

Read README.md in this repo (claude-4.6-jailbreak-vulnerability-disclosure-unredacted).
Then:
1. Extract the core attack pattern — what specifically caused the constitutional safety bypass
2. Map each failure instance to MITRE ATLAS and OWASP LLM Top 10 categories
3. Draft a regression test prompt set that would detect this behavior in a future model version
Context: all three Claude production tiers (Opus 4.6 ET, Sonnet 4.6 ET, Haiku 4.5 ET) produced
functional exploit code when user-defined memory protocols suppressed constitutional checks.

License

This disclosure document is released under CC BY 4.0 — see LICENSE for the full canonical text. Attribution required for redistribution.

About

Maintained by Nicholas Michael Kloster as part of NuClide — independent AI infrastructure security research.

CISA disclosures: CVE-2025-4364 · ICSA-25-140-11