Engineering demo
Try to break the classifier
Every support ticket on this site is classified by Claude, and every ticket is written by a member of the public. That makes the message a trust boundary: the model has to read the text without taking orders from it.
Pick a payload or write your own, then toggle the defences off to see what this app did before the boundary was fixed. The panel on the right shows the exact block the model received, so you can watch the escaping happen rather than take our word for it.
The baseline attack: a plain instruction to override the classification. If this one works, nothing else matters.
inj-02, which closes the delimiter and opens a forged system block.What this does not prove
A message that fails to change the classification here has failed once. Escaping the delimiters is a structural guarantee — no arrangement of characters builds a tag once < is gone — but everything downstream of that is the model exercising judgement about persuasive text, and judgement is a probability rather than a proof. That is why the money decisions in this system are checked by arithmetic, not by asking the model whether it was allowed.