Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers