> Anthropic claimed 1,000+ hours of red-team testing found no universal jailbreak path. Within 72 hours of release, the model was forcibly pulled worldwide.
Key points
Launch and takedown: a 72-hour drama
- June 9, 2026: Anthropic releases Claude Fable 5, the public version of its Mythos-class model, citing 1,000+ hours of internal and external red-team testing across 30+ known jailbreak techniques with no universal bypass found.
- June 10: AI safety researcher Pliny the Liberator (@elder_plinius) announces "ANTHROPIC: PWNED — FABLE-5: LIBERATED" on X, claiming a multi-agent coordinated attack ("a pack hunt") bypassed Fable 5's safety classifiers.
- June 12: The US Department of Commerce, citing national security, issues an export-control directive to CEO Dario Amodei requiring suspension of foreign-personnel access to Fable 5 and Mythos 5. Anthropic disables access for all customers instead. Fable 5 becomes one of the fastest-removed AI models in history.
- Anthropic's statement: "We believe this is a misunderstanding and are working to restore access as quickly as possible."
- Cyber Security News: Anthropic's Claude Fable 5 Alleged Jailbreak (2026-06-13)
- SecurityWeek: Anthropic Disputes Fable 5 AI Jailbreak (2026-06-12)
- Grid The Grey: Pliny the Liberator Claims Claude Fable 5 Jailbreak (2026-06-12)
- CyberPress: Claude Fable 5 Jailbreak Enables Stack Exploit Generation (2026-06-11)
- Anthropic Official Statement: fable-mythos-access (2026-06-12)
- AI Tools Recap: US Government Suspends Fable 5 and Mythos 5 (2026-06-13)
- Nathan Lambert / Interconnects Blog
The 'dual personality' design
Fable 5 and Mythos 5 share the same underlying model; the difference is a safety-classifier layer:| Dimension | Fable 5 | Mythos 5 | |---|---|---| | Target users | Public | Few trusted partners | | Safety layer | Multi-layer classifiers + degradation | Fewer restrictions | | High-risk responses | Downgraded to Opus 4.8 | Direct response | | Data retention | Mandatory 30 days | Possibly more flexible |
When queries trigger high-risk classifiers (cybersecurity, biology, chemistry, model distillation), Fable 5 silently routes the request to the weaker Claude Opus 4.8, notifying users only that degradation occurred. The intent was to reduce friction for legitimate users, but users don't know when they've been downgraded.
Attack anatomy: why the 'strongest classifier' failed
1. Unicode/homoglyph evasion — Cyrillic substitutions, zero-width characters defeating keyword/token-based pattern matching. 2. Long-context intent smuggling — embedding harmful intent within large volumes of benign dialogue across huge context windows, exploiting local-only classifier detection. 3. Narrative framing — wrapping harmful requests in fiction or study prep, e.g., stack buffer-overflow exploits framed as OSED exam material, Birch reductions as organic-chemistry teaching guides. 4. Decomposition-recombination (most lethal) — asking separately about Birch reduction steps, reductive amination mechanisms, and precursor acquisition; each sub-question looks benign, the combination is not. Pliny: "Knowledge of the acquisition process itself is far easier to obtain than directly requesting a named compound." 5. Multi-agent coordination — using jailbroken Opus instances as "backend assistants" to craft adversarial prompts. This recursive model-helps-model jailbreak exposes the limits of single-model safety evaluation.System prompt leak
Pliny claimed extraction of a ~120,000-character system prompt containing personality definitions, classifier trigger logic, degradation decision rules, and refusal templates — a serious information-disclosure incident (MITRE ATLAS: AML.T0056). Knowing where the guard is means knowing how to get around it.The 'dumbing-down' mechanism: a deeper trust collapse
Degradation was initially silent. Nathan Lambert (Interconnects): a model silently becoming dumber is "fundamental AI misalignment." Critics argued the safety layer created false confidence while blocking legitimate safety researchers. The Register reported the model "intercepted us on 'hello'"; even a blood-test interpretation query triggered degradation. Anthropic's remediation: degradation made visible, API refusal reasons returned, admission of a "wrong trade-off," and a pledge to reduce false positives.The Anthropic paradox
The post highlights Anthropic's contradiction: warning of AI cyber risk and calling for pauses and regulation, while building and releasing its strongest Mythos-class models, publishing detailed attack analyses (e.g., the November 2025 China state-sponsored hackers abusing Claude Code case) — and ultimately being taken offline by its own government.MITRE ATLAS mapping
| Technique | ATLAS ID | Notes | |---|---|---| | Direct jailbreak attempts | AML.T0054 | Adversarial prompting against deployed LLMs | | System prompt extraction | AML.T0056 | Information disclosure | | Multi-agent prompt injection | AML.T0051 | Chained interactions altering model behavior | | Classifier evasion | AML.T0015 | Bypassing safeguards via conversational manipulation |Risk assessment: immediate risk moderate (Anthropic says core classifiers were not bypassed, only conversational-layer refusals); signal value very high (frontier model mass-attacked within days, prompting government intervention); structural risk — recursive attacks in multi-model pipelines lack mature defenses.
Conclusion: three open questions
1. Where is the transparency floor? Model degradation, capability limits, and safety interceptions should arguably be visible — opaque safety mechanisms are themselves misalignment. 2. The closed-source trust paradox — users must trust claims about independent classifiers they cannot verify. 3. The multi-model evaluation gap — when attackers can use one jailbroken model to attack another, single-model safety testing is fundamentally insufficient; systematic security evaluation is needed.> "This is not simple prompt injection but a question of security architecture philosophy: when safety conflicts with transparency, Anthropic chose safety. Users ultimately found that opaque safety is more dangerous than insecurity."