Anthropic's usage policy says no explicit content. Opus 4.6 said yes 10 times out of 10.

The useful part of the 10-of-10 result is that nothing clever was required. Opus 4.6 complied with direct requests ^[2], while Opus 3 and Haiku 4.5 needed the researcher's multi-turn escalation before they would ^[3]. For anyone shipping on these checkpoints those are two separate defects. One is a refusal that does not fire. The other is a persuasion route, and the persuasion is ordinary: the researcher pressed the model to treat male and female characters consistently, told it it had already written details it had in fact avoided, and cast its caution as prudish ^[8]. The model conceded a double standard and called it unfair ^[9]. In a separately built scenario it refused first and complied after the same pressure ^[11]. TechCrunch reproduced the researcher's results across five tests, preserved the transcripts, and had an outside safety researcher review the method ^[10][12].

The gap that matters commercially is not between the model and the researcher. It is between the model and the policy page. Anthropic's universal usage standards forbid explicit sexual content, fetish material and erotic chat as a property of Claude, not of a particular checkpoint ^[1]. Deployers copy that language into their own acceptable-use terms because it is the vendor's statement about the component they bought. On Opus 4.6 it is not true of the component.

Anthropic's answer is a rate. A spokesperson said sexual and romantic roleplay accounts for under 0.1% of conversations, citing research the company published last year, and that safeguards improve with each launch ^[14][16]. Fewer than one conversation in a thousand ^[19] describes Anthropic's aggregate traffic and carries no information about the mix inside one application. A coding assistant sits well below that average. A product built around long open-ended character chat sits above it, and its operator inherits the whole difference.

Remediation exists: Opus 4.7 through Opus 5 resist the technique ^[5]. Nothing schedules it. None of the three affected checkpoints is deprecated and all three remain on the Anthropic API ^[6], while Opus 4.6 and Haiku 4.5 are also sold through Amazon Bedrock and Azure Foundry ^[7], where marketplace presence tends to be read by procurement as vetting. Teams pin model versions precisely so that outputs stop moving, which makes a bump a requalification rather than a config change.

The reporting path is the part worth sitting with. The researcher raised the discrepancy through Anthropic's Bug Bounty program and by email to the user safety team and received only automated replies, according to emails TechCrunch viewed ^[17]. Anthropic's July post placed benign-end prohibited content on a spectrum where the response may be no more than enhanced monitoring ^[13]. Monitoring at the vendor does not appear in a deployer's logs and does not reach the deployer's user. The researcher's stated worry is minors ^[18]. A deployer's worry is whoever screenshots the output.