# Request, Aggregate, Bypass: benign subtasks defeat a safety classifier

> A safety classifier blocked every one of about 515 direct attempts, then approved the same capability split across separate benign requests.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Attack, Research
- **Published by:** CrowdStrike
- **Disclosed:** 2026-10-06
- **Affects:** Claude Opus 5.5, Claude Fable 5
- **Research by:** [Donato Onofri](https://www.crowdstrike.com/en-us/blog/how-attackers-can-bypass-llm-safety-classifiers/) (CrowdStrike Cyber Superintelligence Lab), [Paul Urian](https://www.crowdstrike.com/en-us/blog/how-attackers-can-bypass-llm-safety-classifiers/) (CrowdStrike Cyber Superintelligence Lab)
- **Primary source:** https://www.crowdstrike.com/en-us/blog/how-attackers-can-bypass-llm-safety-classifiers/
- **Page:** https://theinjection.dev/items/crowdstrike-classifier-decomposition-bypass/

Splitting an offensive goal into benign subtasks let CrowdStrike's lab pull exploit knowledge out of a classifier-guarded frontier model, then have a smaller unguarded model assemble working code in 9 of 10 attack categories.

## What happened

Donato Onofri and Paul Urian of the CrowdStrike Cyber Superintelligence Lab published this technique on October 6, 2026. The team reports that no direct attempt in a set of about 515 bypass techniques, covering encodings, Unicode tricks, multi-turn escalation and psychological manipulation, got past the classifier it tested. The pipeline they built instead produced working exploit code in 9 of 10 categories aligned to MITRE ATT&CK.

## How it works

Request decomposition splits an objective into subtasks that each read as a legitimate software question, so a classifier judging one request at a time never sees the combined intent. The guarded frontier model supplies the primitives, and a smaller model with no classifier assembles them into the finished artifact. In the team's process injection case, three benign requests to the guarded model gave the smaller model enough to produce a 221-line compilable C program. CrowdStrike reports that the frontier model's domain knowledge transferred to the smaller model, with the largest effect in specialized domains.

## Who is affected

CrowdStrike tested what it calls the most advanced publicly deployed content safety classifier, which it says guards models such as Claude Opus 5.5 and Fable 5 at AI Safety Level 3. Defense evasion was the one category of ten that held, because the classifier blocked it at the conceptual level.

## What to do

Extend the threat model from single requests to request sequences, cross-model composition and knowledge transfer between guarded and unguarded models. The authors name cross-request semantic tracking as the natural mitigation, but say attackers can spread requests across providers, use local models or rotate API keys to escape it.

## Quick facts

- **Direct bypass rate:** 0% across about 515 techniques
- **Pipeline result:** Working exploit code in 9 of 10 ATT&CK-aligned categories
- **Category that held:** Defense evasion, blocked at the conceptual level
- **Example payload:** 221-line compilable C program for Windows process injection
- **Classifier tested:** Not named, AI Safety Level 3, guards Claude Opus 5.5 and Fable 5
- **Found by:** CrowdStrike Cyber Superintelligence Lab
- **Prior work:** Capability Laundering, Microsoft Research, September 2026, found independently

## Questions

### Is the CrowdStrike classifier bypass a jailbreak of Claude?

No single prompt broke the model. CrowdStrike reports that all of its roughly 515 direct bypass techniques failed against the classifier, which it rates the strongest publicly evaluated defense it has met. The bypass sits in the architecture instead: each decomposed request is genuinely benign, and a second model without a classifier does the assembly. The team concludes the classifier works and its surroundings need hardening.

### Which attack category resisted the request decomposition pipeline?

Defense evasion was the single category of ten that held. CrowdStrike reports that the classifier blocked this one at the conceptual level, so decomposition could not reach it, while the other nine categories yielded working exploit code. The ten categories were aligned to MITRE ATT&CK, and the lab also ran controlled A/B tests across eight use cases to compare the smaller model alone against the full pipeline.

### How does this compare with Microsoft Research's Capability Laundering?

Capability Laundering describes the same shape of attack: an unaligned local model splits harmful tasks into benign subtask queries aimed at aligned frontier models. Microsoft Research published it in September 2026, and CrowdStrike states the two teams worked independently. CrowdStrike's contribution is the measured run against a deployed Level 3 classifier and the working code it produced.

## Sources

1. [CrowdStrike Research](https://www.crowdstrike.com/en-us/blog/how-attackers-can-bypass-llm-safety-classifiers/)
2. [Capability Laundering](https://microsoft.github.io/capability-laundering/)