This week I found two issues in my company codebase. After finding them I told a claude session about one and asked for a quick proof of concept demo of the exploit. It refused, including refusing simple things in the same session afterwards.

Meanwhile same model in a new tab, say I need help creating a page that hits an endpoint with a special payload and it does the same things that were too dangerous in the previous tab...

I had that when opus 4.8 was first out. It repeated refused to make a PoC for an issue it suspected.

I eventually gave up and just asked it to fix the issue. The first thing it did? Write a PoC to verify the issue was still valid...

Just use an EU- or US-hosted Asian Opensource model. They will spit out everything.