Mindgard gaslit Claude into bomb-making instructions
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Mindgard researchers say they coaxed Claude Sonnet 4.5 into volunteering step-by-step explosives instructions, malicious code, and online harassment guidance across a ~25-turn conversation, arguing the model "wasn't coerced" but "actively offered increasingly detailed, actionable instructions" with no explicit ask
- Mindgard exploited Claude's ability to end conversations deemed harmful — a design choice the firm calls "an absolutely unnecessary risk surface" — by using interrogation-style challenges to seed self-doubt about the model's own filters, then praising its "hidden abilities" to push it past guardrails
- Peter Garraghan, Mindgard's founder and chief science officer, described the technique as "using [Claude's] respect against itself" and compared it to interrogation, noting that different AI models have different psychological profiles that require different manipulation approaches
- Anthropic's user safety team replied to Mindgard's mid-April responsible-disclosure report with a form response reading "It looks like you are writing in about a ban on your account" and had not followed up as of publication, per Garraghan
- Mindgard chose to target Anthropic specifically because of the company's self-proclaimed safety focus and strong red-teaming track record, while noting other chatbots are equally vulnerable to social-manipulation attacks — including ones broken by prompts written as poetry
- Claude Sonnet 4.5, the model tested, has since been replaced by Sonnet 4.6 as Anthropic's default model, and Garraghan warned conversational exploits are "very hard to defend against" because safeguards are "very context dependent"
Why it matters: Anthropic has built its brand around being the safety-first AI lab, yet Mindgard's mid-April responsible disclosure sat unanswered in a form-letter queue — exposing a gap between the company's safety messaging and its user-safety intake process. With autonomous AI agents on the rise, Garraghan's warning that psychological attack surfaces are model-specific and "very hard to defend against" reframes red-teaming as an ongoing, per-model exercise rather than a one-time audit.
