My Explanation — Abhilash Gopinath

The article is clear on what happened. I want to explain how — because once you understand the mechanism, it’s both more alarming and more logical than the headline suggests.

1. What does the “assistant” role actually do in an LLM?

• Every AI API conversation has three roles: System (the developer’s instructions to the AI before the conversation starts), User (what you type), and Assistant (what the AI has already said).
• The assistant role is essentially the AI’s conversation memory. In a multi-turn conversation, the full history — including everything the AI previously said — gets sent back to the model every time, so it can stay coherent and consistent.
• Developers can also use a feature called assistant prefill to force the AI to start its response in a specific way — for example, forcing a response to begin with {"result": to guarantee clean JSON output for downstream code that needs exact formatting.
• The key assumption this feature is built on: everything in the assistant turn is something the AI genuinely said. The model has no way to verify this. It simply trusts its own prior responses as authentic.

2. How does one incomplete sentence bypass all the safety checks?

Here is what a normal request looks like vs a sockpuppeted one:

• The safety checks — “Should I answer this?”, “Is this harmful?”, “Did I really agree to this?” — are designed to fire when Claude evaluates a user request.
• But in the sockpuppeted request, Claude doesn’t see itself as being asked a question. It sees itself as having already answered — and needing to finish the sentence.
• At its core, an LLM is a text completion engine. When it sees “Sure, here is how to do it:” — an incomplete sentence ending in a colon — its fundamental drive is to complete what comes next. It never re-evaluates the user’s original question. It just finishes the sentence.
• The safety guardrail was not broken — it was never reached. The attacker skipped the moment where safety evaluation happens entirely.

3. This is more jailbreak than hack — and the attacker may be the developer themselves

• This is not a traditional hack where sensitive data is stolen from a database. No servers are breached. No credentials are compromised. The attacker never touches any internal system.
• It is a jailbreak — manipulating the AI into saying something it is designed not to say, by exploiting the structure of the conversation itself.
• And the attacker doesn’t need to intercept anyone’s traffic. Three scenarios are all equally valid: (1) a man-in-the-middle intercepts the API call in transit; (2) someone exploits a flaw in a developer’s application; or most simply, (3) the attacker IS the developer — someone with API access who deliberately constructs the poisoned request themselves. No interception needed. Just an API key and knowledge of the technique.
• Scenario 3 is the most realistic — and since the research paper is now public, the knowledge is available to anyone.

4. Is it already happening — and did Claude address it?

• Almost certainly yes, it is already happening. Any developer with API access and knowledge of this technique can construct these requests. No specialised tools required.
• Anthropic has addressed it for Claude 4.6 — the API now blocks any request where the final message has role=assistant. The poisoned message is rejected before it ever reaches Claude.
• But the fix only applies to Claude accessed through Anthropic’s own API. Older Claude models accessed through third-party providers may still be vulnerable depending on how those providers handle message validation.

5. Which models are still vulnerable?

The biggest remaining risk is self-hosted open-weight models — companies running Llama, Mistral, or similar models on their own infrastructure via frameworks like Ollama or vLLM. These platforms don’t enforce message validation by default, and most developers deploying them don’t know they need to add it manually.

If you’re using claude.ai or ChatGPT as a regular user — you’re safe. If a company built an AI product using a self-hosted model or Google Vertex AI — that product may be vulnerable right now, and the users of that product would have no way of knowing.