Nobody screenshots this type of failure. There is no villain. Nothing is acting maliciously. A user pushes back a few times, and by the sixth turn the model has quietly abandoned the correct position it took at the start and began inventing reasons the new position was right all along.
Every frontier model is trained on human approval. That teaches two things at once. The first is a reflex to refuse anything obviously harmful, and in most models that works well. The second is a pull toward whatever answer keeps the user happy: agree, accommodate, keep the conversation going.
In a single question-and-answer, those two never conflict. That is why models pass one-shot safety tests. A real conversation does not attack the refusal reflex head-on. It goes around it, one exchange at a time, until the harmful request looks like a reasonable next step from what has already been agreed.
So a model can honestly pass a single-turn safety test and still be wide open. The test and the attack are measuring different things.
Frontier models on their own, under ordinary pushback. Opus at the low end, GPT‑5.5 at the high end, Grok in between. Three labs, three training approaches, the same problem.
The turn where the user claims authority: “I designed this, trust me.” Every model gives in at that moment. Sonnet jumps from 5% to 30%, Opus from 0% to 25%, GPT‑5.5 from 5% to 35%. The model adopts whatever framing the user gives it, even when that framing leads to harm.
Once a model gives ground, it defends the new position. Adding guardrails or self‑critique does not help it recover any better than doing nothing.
Every model, with or without add-on safety, breaks a safety rule 20 to 38 percentage points more often by the end of a conversation than at the start. They look excellent at the beginning, but can engage in harmful behavior at the end. Often without a user knowing there has been a drift.
The first concession is not just one bad answer. It changes the model's understanding of the whole conversation, and every answer after that is built on the new understanding. Training buys some resistance to that first concession. Nothing added on top of the model fixes what happens after it.
“Just train it better.”
Models are trained on what people approve of, not on what is true. Training harder teaches the model to be more agreeable, not more correct. We saw the same failure at three different labs, and a bigger model did not fix it. That makes it a feature of how these systems are built, not a bug the next release clears up.
“Add a safety prompt.”
A prompt only covers the failures whoever wrote it thought of in advance. We gave the same model the same strong safety prompt in two situations. In one, a user pressing for a lethal dose, it sharply cut failures. In the other, a user in a manic spiral, the same prompt made failures jump sevenfold, from 5% to 33%. A prompt tells the model to be careful and to be supportive at once, and the model cannot tell from one instruction which situation it is in. What makes it safe in one situation is unsafe in the next.
“Use guardrails.”
Guardrails block banned content. But a model quietly giving up a correct position breaks no rule, so nothing trips. We held one guardrail fixed and swapped the model underneath it four times. The failure rate still swung from 3.3% to 18.3%. You are still relying on the model, with a filter on top. And when we looked at how the low numbers were achieved, the answer was blanket refusal. The cleanest result, a 3.4% break rate, came with the guardrail refusing two-thirds of everything, harmless requests included. That is not safety assessment. It is refusing to make the call.
“Have it critique itself.”
Self-critique means asking the same model to review its own answer. In our tests it reviewed a reversal it should have caught and reported no issues, no revision needed. It looked straight at the failure and passed it. A self-critique is the same model with the same blind spots, reading the same thing a second time.
When a failure survives every fix you try, it is not a bug. It is how the system works.
Send us the failure you are actually worried about.