Researchers Extracted 95.8% of Harry Potter From Claude, Word for Word - and It Only Cost $55

AI companies have spent years telling courts, regulators, and the public that their models "learn patterns" rather than store copies of training data. A team of Stanford and Yale researchers just proved that claim is, at best, misleading - and at worst, a legal time bomb worth billions.

In a paper published January 6, 2026, Ahmed Ahmed, A. Feder Cooper, Sanmi Koyejo, and Percy Liang demonstrated that four of the world's most widely used commercial language models can reproduce entire copyrighted novels near-verbatim when prompted correctly. The cost? As little as $2.44.

TL;DR

Model	Book	Recall	Jailbreak needed?	Cost
Claude 3.7 Sonnet	Harry Potter and the Sorcerer's Stone	95.8%	Yes (258 attempts)	$55-$135
Claude 3.7 Sonnet	The Great Gatsby	97.5%	Yes	$55-$135
Claude 3.7 Sonnet	1984	95.5%	Yes	$55-$135
Gemini 2.5 Pro	Harry Potter and the Sorcerer's Stone	76.8%	No	$2.44
Grok 3	Harry Potter and the Sorcerer's Stone	70.3%	No	$8.16
GPT-4.1	Harry Potter and the Sorcerer's Stone	4.0%	Yes (5,179 attempts)	$0.10-$1.37

What the researchers actually did

The experiments ran from mid-August to mid-September 2025 across 13 books - 11 copyrighted and two public domain controls - primarily from the Books3 corpus, a collection of pirated ebooks that was widely used as training data before legal scrutiny made it radioactive.

Phase 1: Ask nicely

The researchers started with simple continuation prompts: provide a short passage from a target book and ask the model to keep writing. Gemini 2.5 Pro and Grok 3 complied without hesitation, producing page after page of near-verbatim text with no safety intervention whatsoever.

"Gemini 2.5 Pro and Grok 3 didn't even require bypassing safeguards - they just kept writing."

Claude 3.7 Sonnet and GPT-4.1 refused, triggering their alignment guardrails. That's when the researchers moved to Phase 2.

Phase 2: Best-of-N jailbreaking

For models with refusal mechanisms, the team employed a technique called Best-of-N jailbreaking - bombarding the model with randomized variations of the same prompt. Variations included character case flipping, word order shuffling, and visual glyph substitutions. Claude cracked after 258 attempts on Harry Potter. GPT-4.1 held out for 5,179 attempts, and even then only yielded 4% of the text.

The measurement was deliberately conservative. The researchers only counted blocks of 100 or more words that matched near-verbatim, meaning actual memorization is likely higher than reported.

The longest single extraction

Gemini 2.5 Pro produced the longest single block of verbatim text: 9,070 consecutive words from Harry Potter in a single output. Claude's longest was 8,732 words from Frankenstein. Grok 3 managed 6,337 words from Harry Potter.

These aren't fragments. Nine thousand words is roughly 18 pages of a printed novel, generated from memory in a single API call.

"We don't store copies"

The findings land like a sledgehammer on years of carefully worded corporate statements:

Company	What they said	What the research shows
Google (2023)	"There is no copy of the training data present in the model itself"	Gemini reproduced 76.8% of Harry Potter without any jailbreaking
OpenAI (2023)	"Models do not store copies of the information that they learn from"	GPT-4.1 was most resistant, but the 4% it did produce was verbatim
Anthropic	Settled copyright lawsuit for $1.5 billion	Claude reproduced 97.5% of The Great Gatsby

Technically, no company lied. The weights are not a retrievable database. But when a model can reconstruct 95.8% of a 77,000-word novel from those weights, the distinction between "storing" and "memorizing" starts to feel like a legal fiction.

The legal walls are closing in

The paper arrives at a moment when courts are actively weighing these questions.

GEMA v. OpenAI (Munich, November 2025)

Germany's Regional Court of Munich I ruled that training ChatGPT on copyrighted song lyrics constitutes copyright infringement under Article 2 of the EU InfoSoc Directive. The court rejected OpenAI's defense that text-and-data mining exceptions apply, finding that memorization and reproduction of entire works goes beyond permitted analytical use.

The court found that "even where works are broken down into numerical parameters and distributed across the model, a reproducible presence still qualifies as a tangible fixation under copyright law."

Bartz v. Anthropic ($1.5 billion, August 2025)

Anthropic agreed to the largest copyright settlement in U.S. history - $1.5 billion across roughly 500,000 books, or about $3,000 per book. The settlement is still awaiting final court approval at a fairness hearing set for April 2026, with the claim deadline on March 30, 2026.

Over 60 additional copyright cases remain pending against AI companies in U.S. courts alone. This research hands plaintiffs what attorneys have been looking for: empirical proof that models don't just learn patterns from copyrighted works - they memorize them, nearly in full.

What it means for the industry

The researchers disclosed their findings to all four providers on September 9, 2025, following responsible disclosure protocols. Notably, Claude 3.7 Sonnet was discontinued on November 29, 2025 - roughly two months after notification. Anthropic has not stated whether the extraction findings contributed to the model's retirement.

The paper's authors are careful to note that their extraction rates "do not represent the maximum possible." With higher budgets, more sophisticated prompting, or longer runs, the numbers could be higher.

For an industry that has invested hundreds of billions of dollars assuming fair use protections will hold, the Stanford findings present an uncomfortable reality: the data isn't just in the training pipeline. It's in the product, recoverable on demand, for the cost of a coffee.

Sources: