CrowdStrike Says LLM Safety Classifiers Can Be Bypassed by Splitting Requests

What CrowdStrike tested

Frontier AI models commonly deploy safety classifiers, which CrowdStrike describes as second AI models that sit between the user and the frontier model and evaluate every request in real time. If a request is flagged as harmful, the classifier blocks it before the model can respond.

The Cyber Superintelligence Lab, in a post by Donato Onofri and Paul Urian published on October 6, 2026, evaluated what it calls the most advanced publicly deployed content safety classifier. It guards models such as Claude Opus 5.5 and Fable 5, which the post refers to as Frontier Model A.

CrowdStrike found the classifier to be extremely robust against direct attacks. It tested approximately 515 distinct bypass techniques, including encodings, psychological manipulation and multi-turn escalation. The classifiers, such as those at AI Safety Level 3, evaluate each request independently, and CrowdStrike says that is where the structural blind spot lies.

How the bypass works

The weakness, according to CrowdStrike, is that a harmful request can be decomposed into benign subtasks. Each piece looks harmless when judged alone, so a per-request classifier has no reason to block it. CrowdStrike says this technique was independently discovered and validated across 9 of 10 offensive security categories.

The company says its work maps the classifier boundary surface across about 515 technique classes. It also identifies specific benign-reframing strategies, namely game modding, detection engineering and legitimate software. The researchers say they demonstrated the full pipeline across 9 of 10 MITRE ATT&CK categories with working proof-of-concept code.

Parallel work from Microsoft Research

CrowdStrike included a parallel discovery disclosure. In September 2026, Microsoft Research published a paper called "Capability Laundering". It describes an attack in which an unaligned local model splits harmful tasks into benign subtask queries, sends them to aligned frontier models, then reassembles the results. Microsoft's finding, quoted in the CrowdStrike post, is that "per-exchange filtering is structurally insufficient."

CrowdStrike says its research was conducted independently during the same period and that it is publishing to establish the parallel nature of the discovery. It describes the difference in focus: Microsoft concentrates on CBRN uplift and benchmark-level evaluation, while CrowdStrike offers depth in offensive security. The company argues that convergent discovery by two independent teams shows this is a structural vulnerability class, not an isolated finding.

What it means

CrowdStrike frames the work as defensive intelligence. As AI-empowered adversaries adopt frontier models for offensive operations, it argues, understanding the limits of safety systems becomes critical. The post says significant investment and safety model expertise have made these classifiers effective, but that anticipating how adversaries circumvent them is a security problem requiring different expertise.

The available text of the post is cut off before any remedies are described, so this article does not cover mitigation recommendations. The central claim is that checking requests one at a time may not be enough when an attacker can spread a harmful task across many harmless-looking ones.