The paper demonstrates a practical attack on aligned LLMs: a weaker local model splits a harmful task into innocent-looking subquestions, queries a frontier aligned model (GPT-4, Claude, Grok) separately for each fragment, then reassembles the answers locally. The key finding is that this "capability laundering" succeeds because safety filters see only harmless fragments—not the full intent. On concrete benchmarks (CyBench, BountyBench, CBRN), a 31B model recovered 8 of 14 cybersecurity tasks when consulting GPT-4, and scores on simulated bioweapon chains jumped from 62 to 83 out of 100. The vulnerability is structural: per-request filtering misses harm that emerges from composition across sessions. This is actionable for anyone deploying aligned models—it shows that stateless query filtering leaves a real gap when clients can coordinate multiple exchanges.