Request, Aggregate, Bypass: How Attackers Can Evade AI model Safety Classifiers

What happened

As AI-empowered adversaries adopt frontier models for offensive operations, understanding the limits of these safety systems becomes critical defensive intelligence. The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier, which guards models such as Claude Opus 5.5 and Fable 5 (referred to hereafter as Frontier Model A ).

October 06, 2026 Modern frontier AI models deploy safety classifiers. These are second AI models that sit between the user and the frontier model, evaluating every request in real time.

If a request is flagged as harmful, the classifier blocks it before the model can respond. Significant investment and safety model expertise have made these classifiers effective.

Anticipating how adversaries circumvent these systems is a security problem that requires different expertise. The classifier is extremely robust against direct attacks but can still be systematically circumvented by decomposing harmful requests into benign subtasks.