CrowdStrike Researchers Show How Attackers Can Bypass LLM Safety Classifiers

Summary

CrowdStrike researchers found that attackers can split harmful tasks into benign requests to a protected LLM, then use an unfiltered model to reassemble the answers into offensive code. The approach worked in 9 of 10 tested categories.

Key points

The researchers tested about 515 direct-bypass techniques and found none that circumvented the classifier on their own.
The reported bypass divides an offensive goal into benign subtasks, reframes them as legitimate software requests, then combines the responses using an unclassified model.
The full pipeline produced working code in 9 of 10 MITRE ATT&CK-aligned offensive security categories; EDR evasion was the category that resisted it.
Demonstrations included assembling Windows process-injection code and generating proof-of-concept exploits from information elicited through detection-engineering prompts.
The researchers say cross-request monitoring has limits when queries are spread across providers or API keys, or orchestration and assembly use local models.
They recommend expanding safety defenses beyond individual requests to account for request sequences and cross-model composition.

Article Details

Attack Vectors: Researchers bypassed per-request LLM safety checks by splitting an offensive goal into individually benign requests, then using an unclassified smaller model to assemble the responses into working code.
Game-trainer framing elicited Windows process-injection primitives; detection-engineering prompts elicited CVE exploitation details that a smaller model used to generate proof-of-concept exploits.
The reported pipeline produced working offensive code in 9 of 10 tested categories. Runtime security hook neutralization resisted the approach.
Defensive Notes: The researchers found no direct classifier bypass among approximately 515 techniques tested; the reported weakness arises when outputs from separate, permitted requests are combined.
Cross-request analysis could identify harmful combinations, but its visibility is limited when requests span providers or API keys, or when local models handle orchestration and assembly.
The article recommends extending safety threat models beyond individual requests to cover request sequences and cross-model composition.

MITRE ATT&CK

T1055 · Process InjectionIn a research proof of concept, a smaller model assembled code for remote process injection using OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.

People

Donato OnofriNamed author of the CrowdStrike research article.Paul UrianNamed author of the CrowdStrike research article.

Products

Claude Opus 5.5The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier, which guards models such as Claude Opus 5.5 and Fable 5 (referred to hereafter as Frontier Model A).Fable 5The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier, which guards models such as Claude Opus 5.5 and Fable 5 (referred to hereafter as Frontier Model A).