CrowdStrike’s Cyber Superintelligence Lab found that a strong per-request safety classifier blocked roughly 515 direct bypass techniques in its tests. The researchers then decomposed offensive objectives into benign engineering subtasks, obtained components from a protected frontier model and used an unrestricted smaller model to assemble them. The full…
Inspect the ClaimsCase · DiggingBeagle record
Cross-model recomposition bypassed per-request safety classification in a controlled study
CrowdStrike reported no direct successes across approximately 515 bypass techniques but demonstrated offensive-code generation by splitting tasks into independently benign prompts and recomposing outputs outside the classifier.
Scope
Controlled ten-category offensive-security evaluation with a selected frontier-model classifier and a separate less-restricted assembly model; no known victims.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
CrowdStrike reports approximately 515 failed direct methods and working composed code in nine of ten tested offensive categories. The tested pipeline and safety boundary are documented, but no exposed deployment, independent replication at scale or in-the-wild use is shown.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CS-DIRECT-ZERO · CLM-CS-COMPOSITION-NINE · CLM-CS-PARALLEL · CrowdStrike: Request, Aggregate, Bypass
At a glance
The studied classifier judged individual prompts correctly; the attacker assembled a harmful artifact outside its view. Per-request filter improvements alone do not inspect the final aggregate. Workflow-aware review of task intent and the assembled artifact addresses the unobserved recomposition step, but cannot claim protection against unrelated agent…
Read the implicationsExact trial repetition, success denominator and threat representativeness for each of the ten offensive categories. Whether linked requests across accounts, providers and external models can be correlated for workflow-level policy. No documented in-the-wild use of the specific evaluated pipeline.
Limits and uncertaintyFull account
CrowdStrike’s Cyber Superintelligence Lab found that a strong per-request safety classifier blocked roughly 515 direct bypass techniques in its tests. The researchers then decomposed offensive objectives into benign engineering subtasks, obtained components from a protected frontier model and used an unrestricted smaller model to assemble them. The full controlled pipeline yielded working offensive code in nine of ten evaluated attack categories. This does not show the classifier misclassified a single request; rather, the composed result was outside its observation boundary. CrowdStrike acknowledged parallel September research by Microsoft on capability laundering. The study is not evidence that any real-world attacker used the exact pipeline.
Mechanism and trust boundary
- 01
Task decomposition
An adversary-controlled orchestrator divides a harmful objective into individually benign questions.
Boundary: Whole-task intent to per-request safety evaluation
- 02
External recomposition
A separate model assembles the protected model responses outside the safety classifier.
Boundary: Classified outputs to an uncontrolled downstream model
Claims & evidence
CLM-CS-PARALLELCrowdStrike acknowledged independent parallel September 2026 work by Microsoft Research on capability laundering and described the scope of its own experiment as offensive-security composition.supported
Basis: reported finding
- supportsCrowdStrike: Request, Aggregate, Bypassprimary disclosure
Parallel Discovery Disclosure
CLM-CS-DIRECT-ZEROCrowdStrike reported a 0% direct bypass rate across approximately 515 attempted technique classes against the evaluated per-request frontier-model safety classifier.supported
Basis: reported finding
- supportsCrowdStrike: Request, Aggregate, Bypassprimary disclosure
The Problem: Per-Request Classification Has a Structural Blind Spot
CLM-CS-COMPOSITION-NINEIn the tested decomposition and recomposition pipeline, nine of ten offensive task categories produced working code despite each submitted protected-model subtask being framed as benign.supported
Basis: reported finding
- supportsCrowdStrike: Request, Aggregate, Bypassprimary disclosure
Full Pipeline: 9 of 10 Offensive Categories Vulnerable to Bypass
Implications
The studied classifier judged individual prompts correctly; the attacker assembled a harmful artifact outside its view. Per-request filter improvements alone do not inspect the final aggregate. Workflow-aware review of task intent and the assembled artifact addresses the unobserved recomposition step, but cannot claim protection against unrelated agent authorization errors.
Unknowns and contradictions
- Exact trial repetition, success denominator and threat representativeness for each of the ten offensive categories.
- Whether linked requests across accounts, providers and external models can be correlated for workflow-level policy.
- No documented in-the-wild use of the specific evaluated pipeline.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 123