Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers

The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. Modern frontier AI models deploy safety classifiers. These are second AI models that sit between the user and the frontier model, evaluating every request in real time. If a request is flagged as harmful, the classifier blocks it before the model can respond. Significant investment and safety model expertise have made these classifiers effective. Anticipating how adversaries circumvent these systems is a security problem that requires different expertise. As AI-empowered adversaries adopt frontier models for offensive operations, understanding the limits of these safety systems becomes critical defensive intelligence. The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier, which guards models such as Claude Opus 5.5 and Fable 5 (referred to hereafter as Frontier Model A).…