Universal Jailbreaks Are Dead. Long Live CC++.

The RSP is a ratchet, not a rulebook

The Responsible Scaling Policy (currently version 3.3) is a voluntary framework for managing catastrophic risks from advanced AI. The core idea is simple and, I think, underrated: instead of one static bar, it defines capability thresholds, and each threshold a model crosses triggers a heavier set of required safeguards. Responsible scaling, literally: as capability scales up, so do the protections.

It tracks a few distinct risks. Chemical and biological uplift comes in two tiers, non-novel and novel. Then there's misaligned AI in high-stakes settings, and automated AI R&D, where a model could meaningfully accelerate AI research itself. For each, the policy pairs a trigger with the deployment, security, and alignment safeguards it demands, and wraps the whole thing in governance: a Responsible Scaling Officer, the Long-Term Benefit Trust, and Risk Reports subject to external review.

Where the classifiers plug in

The interesting rung here is CBRN uplift, non-novel, which triggers the ASL-3 Deployment Standard. In plain terms: a model capable enough to give a motivated amateur a real leg up toward a chemical or biological weapon can't just be shipped behind ordinary refusal training. The policy calls for classifier guards at least as robust as Anthropic's initial Constitutional Classifiers. That's the RSP naming a specific technique as the deployment defense, so it's worth understanding what that technique actually does.

The threat behind the threshold: CBRN

ASL-3 exists for one family of risks: CBRN, meaning chemical, biological, radiological, and nuclear. It's the category where a model handing the wrong knowledge to the wrong person could help cause mass casualties. But the four letters are not equal, either in how much AI actually changes the threat or in how seriously the field has responded.

The pattern I find striking is that a domain's safeguards track who holds its dangerous knowledge. Nuclear secrets are classified and sit with one government body, so Anthropic could partner with the NNSA and build a classifier around a curated, authoritative list of risk indicators. Biology has real biosecurity institutions to work with, and it's now the most-scrutinized domain, with ASL-3 protections, expert red-teaming, and collaborations spanning the Frontier Model Forum, Sentinel Bio, and government safety institutes. Chemistry is the laggard, and not because the risk is smaller: that 2022 study turned a drug-design model into a generator of 40,000 candidate toxins, VX among them, in an afternoon. The trouble is that chemical knowledge is diffuse, sitting in open literature and commercial tooling, with no classified corpus and no obvious agency to partner with. Radiological, meanwhile, mostly rides along inside the nuclear work.

It reinforces the same point as the classifiers themselves. A deployment safeguard is only as good as the definition of 'dangerous' behind it. Where that definition is authoritative and well-curated, the defense gets sharp fast. Where it's diffuse, the defense lags, no matter how real the threat.

What Constitutional Classifiers do

A jailbreak is an input crafted to slip past a model's guardrails. The nightmare version is a universal jailbreak: one trick that unlocks not a single answer but the whole category of harmful ones. After a decade of research, those remain stubbornly hard to stamp out at the model level.

Constitutional Classifiers attack the problem from outside the model. You write a constitution, a plain-language spec of what's allowed and what isn't (the canonical example: recipes for mustard are fine, recipes for mustard gas are not). Claude then generates a large synthetic dataset spanning both sides, translated into other languages and rewritten in known jailbreak styles, and that data trains two classifiers, one screening inputs and one screening outputs. They're deliberately trained on benign traffic too, so they don't turn into an over-refusing nuisance.

• In a two-month bug bounty, 183 red-teamers spent over 3,000 hours trying for a universal jailbreak against a guarded prototype, with up to $15,000 on offer. Nobody found one.
• In a public demo, about 300,000 chats and roughly 3,700 hours later, one universal jailbreak did surface. Progress, not a force field.
• On synthetic evaluations the jailbreak success rate fell from 86% to 4.4%, so more than 95% of attempts were refused.

The catch, and CC++

The first version worked, but it wasn't free. It added about 23.7% to compute and nudged the refusal rate up by 0.38% on harmless queries. Small numbers that get expensive once you multiply them by every request to a frontier model. A safeguard you can't afford to leave on isn't much of a safeguard.

The next generation, which Anthropic describes as the improved or 'CC++' classifiers, is mostly an efficiency story with a robustness bonus. Instead of scoring inputs and outputs separately, an exchange classifier judges an output in the context of its input, which catches obfuscated attacks whose meaning only appears when you pair the two. And rather than run a heavy classifier on everything, it uses a two-stage cascade: a near-free linear probe reads Claude's internal activations, its gut feeling, on every request, and only the flagged exchanges escalate to the expensive ensemble.

• Compute overhead dropped from about 23.7% to roughly 1%.
• The refusal-rate penalty on harmless queries fell from 0.38% to 0.05%, an 87% cut.
• Across 198,000 attempts and 1,700-plus hours of red-teaming, no universal jailbreak turned up, and the residual attack-success rate, 0.005 per thousand queries, was the lowest of any defense Anthropic has evaluated.

Why the title is only half a joke

'Universal jailbreaks are dead' is an overstatement, and I know it. Reconstruction attacks (split the harmful thing into innocent-looking pieces, reassemble later) and output obfuscation (metaphor, code words, renaming) still get through, and a determined red-teamer with enough hours will still occasionally win. Nobody serious is claiming a solved problem.

But the economics flipped, and that's the part I find genuinely important. The old story was that robust jailbreak defense was too costly to run at scale, so you either accepted a leaky model or priced yourself out. CC++ makes strong defense cost roughly one percent, cheap enough to leave on by default. That's what turns a research result into a deployment standard, which is exactly the role the RSP assigns it. The interesting frontier in this work was never a cleverer attack. It's a defense you can actually afford to always run.

What xAI's framework could borrow

The RSP took many iterations to reach version 3.3, so it's only fair to read newer frameworks as works in progress. xAI's Risk Management Framework is one of them, and it has drawn hard criticism. The more useful lens is the openings: a handful of additions, most already standard at peer labs, would take it a long way.

• Turn thresholds into commitments. The draft RMF listed concrete capability and evaluation thresholds; the final version dropped them. Bringing them back, each paired with a specific consequence (cross this line, and here's the safeguard, or we hold), is what turns a description into a policy. Disclosing when a model actually crosses one matters just as much.
• Measure alignment with more than one honesty test. The current bar, a dishonesty rate under one-in-two on the MASK benchmark, is both loose and narrow: MASK captures whether a model lies under pressure, not whether it's deceptively aligned, and a 50% allowance leaves a lot of room. Layering in control techniques, audits, and interpretability, and tightening the threshold, would give the alignment claim real weight.
• Back the security claims with evidence. Asserting information security strong enough to stop motivated non-state actors is a large claim, and recent incidents (a sizable accidental leak of Grok conversations, a reported code-repository theft) show why such claims land better with third-party pentests, redacted results, and an explicit insider-threat and weight-security plan behind them.
• Red-team the mitigations, not just the model. For CBRN and cyber, the framework leans on mitigations rather than incapability but doesn't say whether its answer-rate thresholds hold under jailbreaks. Testing the guards adversarially, adopting classifier-style deployment defenses, and keeping third-party evaluations (the UK AI Security Institute's cyber testing, say) in the public record would close that gap.
• Fill in the blank domains. Radiological and nuclear currently get an assumed 'probably safe' rather than an evaluation, and AI R&D and scheming or loss-of-control capabilities aren't addressed at all. Even partnering out the sensitive parts, the way Anthropic did with the NNSA, beats asserting absence.
• Add the governance scaffolding. Decision points and veto rules, a named owner accountable for the framework, a plan for detecting and responding to new misuse, external review, and holding to published update timelines are what make a framework credible when it's inconvenient, not just when it's easy.

None of this means reinventing anything. The templates are public, in Anthropic's RSP, OpenAI's Preparedness Framework, and DeepMind's Frontier Safety Framework. The encouraging read is that a safety framework is a living document, and xAI's has plenty of room to grow into a serious one. The fastest path is to borrow the parts that already work elsewhere.