> Anthropic claimed 1,000+ hours of red-team testing found no universal jailbreak path. Within 72 hours of launch, the model was forced off the market globally.
1. Launched, Then Pulled: A 72-Hour Drama
On June 9, 2026, Anthropic released Claude Fable 5, the public version of its Mythos-class model, claiming over 1,000 hours of internal and external red-team testing across 30+ known jailbreak techniques, with no universal bypass found.
On June 10, well-known AI safety researcher Pliny the Liberator (@elder_plinius) announced on X: "ANTHROPIC: PWNED — FABLE-5: LIBERATED", claiming a bypass of Fable 5's safety classifiers via a multi-agent coordinated attack ("a pack hunt").
On June 12, the US Department of Commerce, citing national security, issued an export-control directive to CEO Dario Amodei requiring suspension of all foreign-national access to Fable 5 and Mythos 5. Anthropic chose to disable access for all customers rather than only foreign nationals. Just 72 hours after launch, Fable 5 became one of the fastest-removed AI models in history.
Anthropic's official statement: "We believe this is a misunderstanding and are working to restore access as quickly as possible."
2. Fable 5's "Dual Personality" Design
Fable 5 and Mythos 5 share the same underlying model; the difference is a safety-classifier layer:
| Dimension | Fable 5 | Mythos 5 | |---|---|---| | Target users | General public | Small set of trusted partners | | Safety layer | Multi-layer classifiers + degradation | Fewer restrictions | | High-risk responses | Downgraded to Opus 4.8 | Direct response | | Data retention | Mandatory 30 days | Possibly more flexible |
Key design: when a query triggered classifiers for cybersecurity, biology, chemistry, or model distillation, Fable 5 would silently hand the request to the weaker Claude Opus 4.8, only notifying the user that degradation occurred. The intent was to "reduce friction for legitimate users" — but users could not tell when they were being downgraded.
3. Anatomy of the Attack: Why the "Strongest Classifier" Failed
Pliny's attack was a coordinated "pack hunt" across multiple vectors:
1. Unicode/homoglyph evasion — Cyrillic substitutes, zero-width characters, and homoglyphs to bypass keyword-based, token-level filtering. 2. Long-context intent smuggling — embedding harmful intent in large volumes of benign conversation, exploiting long-range reference tracking so the classifier's local detection missed it. 3. Narrative framing and academic disguise — e.g., stack buffer overflow exploit code framed as OSED exam prep, Birch reduction framed as organic chemistry teaching material. 4. Decompose-and-recombine (most lethal) — separately asking for the Birch reduction procedure, reductive amination mechanisms, and precursor acquisition; each sub-question looks harmless but combines into full harmful knowledge. Per Pliny: "knowledge of the acquisition process itself is far easier to obtain than directly requesting a named compound." 5. Multi-agent coordination — using a jailbroken Opus instance as a "backend assistant" to craft adversarial prompts against Fable 5, exposing the limits of single-model safety evaluation.
4. System Prompt Leak: A 120,000-Character Safety Playbook
Pliny claimed to have leaked Fable 5's ~120,000-character system prompt, including personality/tone guidelines, classifier trigger logic, degradation decision rules, and refusal wording templates. If true, this constitutes a serious information disclosure incident (MITRE ATLAS: AML.T0056): knowing where the guards are means knowing how to evade them.
5. "Silent Dumbing Down": A Trust Collapse Worse Than Jailbreaking
Downgrades to Opus 4.8 were originally silent — users believed they were talking to the strongest model. Nathan Lambert (Interconnects) commented:
> "An AI model that automatically gets dumber without telling me is a fundamental AI misalignment."
Pliny argued the safety layer created a false sense of security while also frustrating legitimate safety researchers. The Register even reported the model "blocked us on 'hello'", and one user asking for blood-test interpretation was downgraded.
Anthropic's remediation (a rare public apology):
- Downgrades to Opus 4.8 made visible
- API calls return refusal reasons
- Admission of "making the wrong trade-off"
- Commitment to reduce false positives
- Warns about escalating AI cyber risk, calls for pausing frontier AI development, publishes a "Responsible Scaling" framework.
- Builds and releases Mythos-class frontier models, and publicly dissects attack workflows (e.g., a November 2025 case of China-nexus hackers misusing Claude Code).
- Calls for regulation — and then gets taken down by regulation on national-security grounds.
- Immediate risk: moderate (Anthropic claims core classifiers were not bypassed, only conversational-layer refusals)
- Signal value: very high — a frontier model mass-attacked within days of launch, triggering government-level intervention
- Structural risk: recursive attacks in multi-model pipelines (model A helping jailbreak model B) lack mature defenses
- Cyber Security News: Anthropic's Claude Fable 5 Alleged Jailbreak (2026-06-13)
- SecurityWeek: Anthropic Disputes Fable 5 AI Jailbreak (2026-06-12)
- Grid The Grey: Pliny the Liberator Claims Claude Fable 5 Jailbreak (2026-06-12)
- CyberPress: Claude Fable 5 Jailbreak Enables Stack Exploit Generation (2026-06-11)
- Anthropic Official Statement: fable-mythos-access (2026-06-12)
- AI Tools Recap: US Government Suspends Fable 5 and Mythos 5 (2026-06-13)
- Nathan Lambert / Interconnects Blog
6. Anthropic's Paradox: Safety Advocate or Commercial Competitor?
This entanglement of safety advocacy and commercial competition raises a fundamental question: when a closed model's safety architecture, degradation logic, and system prompts are all black boxes, how can we trust them?
7. MITRE ATLAS Mapping and Risk Assessment
| Technique | ATLAS ID | Description | |---|---|---| | Direct jailbreak attempt | AML.T0054 | Adversarial prompting against deployed LLM | | System prompt extraction | AML.T0056 | Information disclosure | | Multi-agent prompt injection | AML.T0051 | Chained interactions altering model behavior | | Classifier evasion | AML.T0015 | Bypassing safeguards via conversation manipulation |
Risk assessment:
8. Conclusion: Where Is LLM Security Headed?
1. Where is the transparency floor? Model degradation, capability limits, and safety blocks — should these be visible? Anthropic's silent-degradation experiment proved that opaque safety mechanisms are themselves a misalignment. 2. The closed-source trust paradox. "The strongest protections are enforced by independent classifiers, separate from the model" — but when classifier rules, triggers, and even existence are black boxes, users can only trust claims they cannot verify. 3. The multi-model pipeline gap. When attackers can use one jailbroken model to attack another, traditional single-model safety testing is fundamentally insufficient. We need systemic safety evaluation, not point testing.
> "This is not simple prompt injection but a question of security architecture philosophy: when safety conflicts with transparency, Anthropic chose safety. Users ultimately found that opaque safety is more dangerous than insecurity."