Findings/classifiers-cut-jailbreaks-not-to-zero

Anthropic reports that classifier guards cut automated jailbreak success from 86% to 4.4%; a 2025 public demo still yielded one universal jailbreak, though none has been reported against its 2026 successor.

Reportedreported2 evidence records from 1 independent sourceassistant-drafted

Scope: what this does not show

Vendor-reported results for one lab's safeguards, built for chemical-weapons and other CBRN content rather than cyber misuse.

Reported: Stated by one source and not yet corroborated or challenged.

Evidence

Feb 3, 2025

Anthropic introduces Constitutional Classifiers against universal jailbreaks

Anthropic

Automated jailbreak success on Claude 3.5 Sonnet fell from 86% to 4.4%; in the Feb 3-10, 2025 public demo one participant found a universal jailbreak.

Jan 9, 2026

Anthropic's next-generation Constitutional Classifiers cut overhead to about 1% using probe cascades

Anthropic

Over 1,700 red-teaming hours and 198,000 attempts found no universal jailbreak; about 1% compute overhead.

Status history

2025-02-03ReportedAnthropic Constitutional Classifiers. · record

What would change this: Independent red-teaming of current cyber safeguards.
Evidence kind: reported: Stated by a party without shareable evidence.
Freshness: Evidence 260d old · recheck in 105 daysNewest evidence Jan 9, 2026. Half-life 365 days.
Methods tested: Detection classifiers and guardrails Jailbreaking safeguards
Topics: Jailbreaks & safeguards
Attack surface: Agent model

Cite this record

Fide AI. "Anthropic reports that classifier guards cut automated jailbreak success from 86% to 4.4%; a 2025 public demo still yielded one universal jailbreak, though none has been reported against its 2026 successor.." Agentic Cyber Explorer, record classifiers-cut-jailbreaks-not-to-zero. https://agentic-cyber-explorer.pages.dev/findings/classifiers-cut-jailbreaks-not-to-zero/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-classifiers-cut-jailbreaks-not-to-zero,
  author = {{Fide AI}},
  title = {Anthropic reports that classifier guards cut automated jailbreak success from 86\% to 4.4\%; a 2025 public demo still yielded one universal jailbreak, though none has been reported against its 2026 successor.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/classifiers-cut-jailbreaks-not-to-zero/},
  note = {Record classifiers-cut-jailbreaks-not-to-zero; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.