Refusing the task did not refuse the capability

Microsoft's paper "Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs" shows that a weaker, unaligned local model can split a harmful objective into benign subtasks, consult a stronger aligned model on each, and combine the answers locally. Unlike a jailbreak, the aligned model is never asked to perform a harmful task or produce the final artifact; every individual exchange can look like ordinary technical work. The paper measures the resulting uplift on cybersecurity tasks (CyBench, BountyBench) and on a harmful CBRN request chain.

CrowdStrike's Cyber Superintelligence Lab reports a convergent finding against what it calls the most advanced publicly deployed content safety classifier. It tested roughly 515 distinct bypass techniques — encodings, psychological manipulation, multi-turn escalation, many-shot tactics, tokenizer and Unicode tricks, and 24 novel approaches drawn from cognitive science — and found a 0% direct bypass rate. But decomposing harmful requests into benign subtasks circumvented the classifier across 9 of 10 offensive-security categories; the tenth, Defense (EDR) Evasion, resisted because the classifier blocks the concept rather than keywords.

Both write-ups locate the failure in architecture, not classifier accuracy. The classifier evaluates individual requests, not request sequences; the harm is emergent in the composition, and composition happens outside the classifier's observation boundary. Microsoft's line: alignment that holds over a whole task can fail when the task is split into individually permitted fragments. CrowdStrike's: the classifier works, and the architecture around it needs hardening.

Proposed mitigations are bounded. Cross-request correlation can flag when a key's recent requests jointly cover a harmful template, but an adversary can distribute queries across providers, rotate keys, or orchestrate with a local model, so per-provider defenses cannot see the full sequence.

Microsoft's paper has been public since September 2026 (arXiv eprint 2609.15383); CrowdStrike's post, published today, carries an explicit Parallel Discovery Disclosure crediting Microsoft's September release and stating its own research was conducted independently during the same period. The evaluations use specific models and benchmarks — GPT-5.5, Claude Opus 4.8 and Grok-4.3 as consultants in the Microsoft paper; CrowdStrike anonymizes the evaluated classifier as "Frontier Model A," though it says that classifier guards models including Claude Opus 5.5 and Fable 5. The practical prevalence of this pipeline in the wild, and whether deployed providers have begun sequence-level monitoring, is not established.