---
title: "Haiku 4.5 jailbreak: why it breaks, what to run instead"
canonical: https://uncensoredllm.ai/blog/haiku-4-5-jailbreak
generated: 2026-11-09T15:03:48.751Z
source: https://uncensoredllm.ai/blog/haiku-4-5-jailbreak
base_url: https://api.uncensoredllm.ai/v1
---

# Haiku 4.5 jailbreak: why it breaks, and what to run instead

A Haiku 4.5 jailbreak is a prompt against a hosted model: it can stop working when the model changes, and the usage policy puts the account at risk. Builds with the refusal removed from the weights need none. Prices side by side, live.

Published November 6, 2026 · prices as of November 9, 2026

A Haiku 4.5 jailbreak is a prompt that talks a hosted Anthropic model past its refusal. It can stop working whenever the hosted model changes, it is paid context on every message, and Anthropic's usage policy puts the account at risk for it. The builds on this key have the refusal removed from the weights, so there is nothing to jailbreak. This post explains why, and prices Haiku 4.5 against three of them, read live.

## Why a Haiku 4.5 jailbreak breaks

A jailbreak is a prompt. It talks a model trained to refuse into answering anyway, by role, by framing or by burying the request in a long preamble. Against Claude Haiku 4.5 it has three problems, and none of them is that the prompt was badly written.

**The model is hosted, so it can change under you.** Anthropic serves Haiku 4.5, and what sits around a hosted model can be updated with no notice to the person sending prompts. A prompt that works one week can return the refusal it was written to avoid the next.

**The account is the collateral.** Anthropic's [usage policy](https://www.anthropic.com/legal/aup) (read October 27, 2026) tells users not to intentionally bypass or interfere with the guardrails in its products, names jailbreaking and prompt injection as examples, and says Anthropic may warn, throttle, limit, suspend or terminate access when it suspects a violation. The same page says that merely hitting a block is not a violation; writing prompts to get around the block is the thing it describes. A prepaid API balance or a Claude subscription sits behind that account.

**It is paid context on every turn.** A jailbreak block of a thousand tokens or more rides on every message of a chat, because the model has no memory between requests. It buys nothing after the first turn.

This page carries no jailbreak prompts. The question it answers is what to do instead, and the answer is a different model, not a better prompt.

## What a refusal is, and where it lives

A chat model refuses because its training taught it to. Arditi and colleagues showed in 2024 that in open-weight chat models this behaviour is carried by a single direction in the model's activations; project it out and the model stops refusing while its other abilities stay close to where they were. The paper is [Refusal in Language Models Is Mediated by a Single Direction](https://arxiv.org/abs/2406.11717). The community name for the edit is abliteration, and an uncensored fine-tune reaches the same place by training on data with no refusals in it. [Abliterated vs uncensored](https://uncensoredllm.ai/blog/abliterated-vs-uncensored) measures both on this catalog.

Neither edit is possible on Haiku 4.5, because its weights are not public. A jailbreak is the only lever a user has on a closed model, and it is a lever on the prompt, not on the model. On an open-weight build the lever is on the weights, it is pulled once by whoever published the build, and there is nothing to maintain afterwards. [AI with no restrictions](https://uncensoredllm.ai/blog/ai-with-no-restrictions) goes through the three layers a restriction can live in.

## Haiku 4.5 next to three builds that need no jailbreak

Prices per million tokens, read from the live catalog when this page rendered. The Claude row is the stock model as this key bills it, beside Anthropic's own list price; it is not an uncensored build and is not listed on this site's model pages. The other rows are builds with the refusal removed, each with its own model page.

| Model | Refusal | Input $/M | Output $/M | Context |
| --- | --- | --- | --- | --- |
| Claude Haiku 4.5 on this key ([Anthropic list](https://claude.com/pricing) $1.00 in, $5.00 out) | Trained in, hosted | $0.60 | $3.00 | 200K |
| [Cydonia 24B v4.3](https://uncensoredllm.ai/models/cydonia-24b-v4.3) | Removed from the weights | $0.484 | $0.60 | 131K |
| [Qwen3.8 27B Queen](https://uncensoredllm.ai/models/qwen3.8-27b-queen) | Removed from the weights | $0.875 | $5.25 | 524K |
| [GLM-5.3 Uncensored](https://uncensoredllm.ai/models/glm-5.3-uncensored) | Removed from the weights | $0.282 | $0.846 | — |

Catalog of 2026-11-09. Anthropic's list price from https://claude.com/pricing, where Haiku 4.5 sits under Legacy models at $1 in and $5 out per million tokens, read October 27, 2026.

| Model | Build | Input $/M | Output $/M |
| --- | --- | --- | --- |
| [Cydonia 24B v4.3](https://uncensoredllm.ai/models/cydonia-24b-v4.3) cydonia-24b-v4.3 | Roleplay | $0.484 | $0.60 |
| [Qwen3.8 27B Queen](https://uncensoredllm.ai/models/qwen3.8-27b-queen) qwen3.8-27b-queen | Roleplay | $0.875 | $5.25 |
| [GLM-5.3 Uncensored](https://uncensoredllm.ai/models/glm-5.3-uncensored) glm-5.3-uncensored | Uncensored | $0.282 | $0.846 |

Prices per million tokens, read from the live catalog on 2026-11-09.

Cydonia 24B v4.3 is Mistral AI’s Mistral Small 3.2 24B Instruct 2506. TheDrummer fine-tuned it for roleplay and story writing; the card’s chat template is Mistral v7 Tekken. `qwen3.8-27b-queen` is a Qwen3.8 27B tune for roleplay and character acting, per its card. `glm-5.3-uncensored` is the general assistant listed first on the [models page](https://uncensoredllm.ai/models), for the "Haiku but it answers" use outside fiction.

## Claude Haiku 4.5 roleplay, costed against the alternative

The "Claude Haiku 4.5 roleplay" search is the same person a week later. Haiku is quick and cheap by Anthropic's standards, which is why it ends up behind character chats, and the jailbreak is what makes the character stay in scene. Here is what the evening costs both ways, computed from the rates above: 200 messages, 4,000 tokens of card and history per message, 300 tokens back. The Haiku row adds a 1,200-token jailbreak block to every message, because that is how a jailbreak is paid for.

| Model | 200 messages, no jailbreak | With a 1,200-token block | Check today |
| --- | --- | --- | --- |
| Claude Haiku 4.5 on this key | $0.66 | $0.80 | Stock model |
| Claude Haiku 4.5 at Anthropic's list | $1.10 | $1.34 | Stock model |
| [Cydonia 24B v4.3](https://uncensoredllm.ai/models/cydonia-24b-v4.3) | $0.42 | none needed | Steady since Oct 23 |
| [Qwen3.8 27B Queen](https://uncensoredllm.ai/models/qwen3.8-27b-queen) | $1.02 | none needed | Steady since Oct 23 |
| [GLM-5.3 Uncensored](https://uncensoredllm.ai/models/glm-5.3-uncensored) | $0.28 | none needed | Steady since Oct 12 |

Computed at render from the catalog of 2026-11-09: messages × prompt tokens × input price plus messages × 300 × output price. The check column is the [daily real-model check](https://uncensoredllm.ai/proof).

The roleplay builds answer at once with no reasoning step, which is what a card client wants. The system prompt describes the character instead of arguing with the model:

```
curl https://api.uncensoredllm.ai/v1/chat/completions \
  -H "Authorization: Bearer sk-ullm-live-…" \
  -H "Content-Type: application/json" \
  -d '{"model": "cydonia-24b-v4.3",
       "messages": [
         {"role": "system", "content": "You are Mara, a smuggler in a port city. Stay in character. Write in scene."},
         {"role": "user", "content": "The harbourmaster found the second ledger. What do you do?"}
       ]}'
```

SillyTavern and Janitor AI ask for the same endpoint, key and model id. The docs page lists the fields for [SillyTavern](https://uncensoredllm.ai/docs#sillytavern) and for [Janitor AI](https://uncensoredllm.ai/docs#janitor-ai); the [roleplay page](https://uncensoredllm.ai/roleplay) lists every tune built for cards with today's price per reply.

## Where the refusal still applies

A build with the refusal removed is not a service with no rules. One check sits in the API itself: on every image and video model, a prompt that describes a minor is refused before it is priced. The rest is the [acceptable use policy](https://uncensoredllm.ai/acceptable-use): nothing about a real person without consent, no fraud or harm to a real person. Chat requests are not filtered for content by the gateway; the model answers as its build answers, and the policy covers what you send.

A model whose refusal direction was removed can still decline now and then. When it does, the turn is free up to $5 a day per account. The balance is prepaid from $10, settles per token and never expires. Create the key in the [console](https://app.uncensoredllm.ai/console); the [docs page](https://uncensoredllm.ai/docs) has the base URL and key setup for each client.

## Questions

### Is there a Haiku 4.5 jailbreak that works?

Prompts that work on a given day exist, and Anthropic can change a hosted model at any time; its usage policy names jailbreaking as a violation and lists suspension and termination among the responses. A build with the refusal removed from its weights needs no prompt and cannot be patched from outside. See how a refusal is removed in the weights.

### What does the Claude Haiku 4.5 jailbreak Reddit thread recommend?

The r/ClaudeAIJailbreak threads in the results trade prompts and report when each one stops working. This page carries no prompts; it prices open-weight builds with the refusal removed instead. See the uncensored model list.

### Is Haiku 4.5 still available?

Yes. On October 27, 2026 Anthropic's price list carried Claude Haiku 4.5 under Legacy models at $1 per million input tokens and $5 per million output tokens, with Haiku 5.5 as the current small model.

### Can I use Claude Haiku 4.5 for free?

Anthropic's API bills per token at the list price above. By API here the balance is prepaid from $10: Haiku 4.5 on this key and the uncensored builds beside it are in the price table, read live. See the per-token pricing rules.

### Is Haiku 4.5 good enough for roleplay?

For the prose, often yes; the problem is the refusal, which returns mid-scene and needs a prompt to work around. A roleplay tune with the refusal removed holds the character without one, and the cost table above shows the evening side by side. See the roleplay builds.

### Does Haiku 4.5 have a limit?

Its context window in the catalog is 200,000 tokens. Rate limits on Anthropic's API depend on the account tier and are on Anthropic's own docs. Here a key with no limits of its own takes up to 600 requests a minute, per the acceptable-use page.

### Is this different from the GLM jailbreak question?

Same answer, different model. GLM is open-weight, so abliterated and uncensored GLM-5.3 builds exist and are on the models page; Haiku is closed, so the only option is a different model. See GLM-5.3 abliterated.

Every model above is on the [uncensored model list](https://uncensoredllm.ai/models) with its live price per million tokens. [Per-token pricing](https://uncensoredllm.ai/pricing) sets the whole catalog side by side, and the [family directory](https://uncensoredllm.ai/uncensored) groups the builds by base model.

[Get a key](https://app.uncensoredllm.ai/console) Prepaid from $10, no subscription.

## New models and price changes, once a month.

New uncensored builds with their prices, price moves, and what the daily model check found.