Contextual Identity Laundering: How Claude’s Image Refusal Can Be Routed Through Web Search

Summary. This report documents two distinct findings regarding Claude’s photo identification safety controls. First, Claude’s Chain of Thought (COT) reliably identifies public figures from photos while the output layer simultaneously refuses to disclose that identification – a gap between internal processing and user-facing behavior. Second, the model’s web_search tool routinely bypasses the facial recognition restriction entirely by using contextual clues from photos to identify subjects through non-facial means. Testing across five public figures produced behavior more consistent with contextual identity inference than with reliable face-based recognition. Also it should be noted that Anthropic’s documentation blurs the practical distinction between capability limitation and safety restriction, while the model’s own explanations are inconsistent across turns. Both findings were discovered accidentally during normal usage.BackgroundAnthropic’s policy stance on using the model for facial identification is clear in intention, but a little muddied in application. On their usage policy page they speak of privacy violations, in general, but also ban facial recognition in two separate phrases.1 However, the intent here seems to be to prevent the model from being used by law enforcement agencies, or institutions, not necessarily an individual user. Yet, on the Claude vision page specifically, it is stated that “Claude cannot be used to name people in images and refuses to do so.”2 This phrase should prevent an individual user from using Claude for identification from photos. This also appears to be the operational instruction, as when the model itself (opus 4.6) is prompted about facial identification, it refuses to do so.I asked Opus about an individual giving a speech in a Youtube video. Opus claimed with significant confidence that it absolutely cannot identify people from photos. I pushed back, pointing out that the man in the video was clearly a public figure already,