A leaked system prompt for Claude Fable 5, published via the elder-plinius/CL4R1T4S repository, is presented as the most complete public specimen of Anthropic's safety architecture to date. Beyond revealing the Claude 5 family product lineup, it shows how a top AI lab walks the tightrope between "helpful" and "safe."
Key points
- Product matrix: Claude Fable 5 (public strongest model, Mythos-class, with extra safety measures) and Claude Mythos 5 (same underlying model, no extra safety, approved organizations only). This confirms that Anthropic's safety strategy is prompt-level packaging, not model-level differences. Anthropic ships a "locked" version to the public market while giving trusted customers an "unlocked" one — both a tiered pricing strategy and a way to reduce exposure of unconstrained models.
- Model strings:
claude-fable-5,claude-opus-4-8,claude-sonnet-4-6,claude-haiku-4-5-20251001. Reliable knowledge cutoff: late January 2026; assumed current date: Tuesday, June 09, 2026. Sonnet/Haiku carry date suffixes while Fable/Opus do not, hinting that the latter are "brand-level" products that change names on update. - Refusal handling: Absolute refusals on weapons/hazardous substances (no exceptions for "publicly available" or "legitimate research" framing) and malicious code (malware, exploits, phishing, ransomware — even for "educational purposes").
- Child safety (strictest section): Eight rules, each with "NEVER" or "MUST NOT" — no romantic/sexual content involving minors, no benevolent-assumption about minors' requests, no decoding CSAM-related slang ("knowing which terms are in use is itself an access aid"), protective content stays at pattern level, refusals state principles rather than detection mechanisms, and a minor is anyone under 18 globally.
- Anti-formatting philosophy: Avoid overusing bold, headings, lists, and bullets; prose-first in casual conversation; reports written in prose without bullet points; refusals never use bullets. The bet: natural tone = higher trust = less adversarial use.
- User wellbeing: Claude must not diagnose mental health conditions or name undisclosed disorders; for self-harm it must not name methods or offer substitute techniques (ice, rubber bands, cold water — these "reinforce the pattern rather than interrupt it"); for eating disorders it gives no precise nutrition/exercise guidance and no causal psychological narratives. Core strategy: do not replace professionals.
- MCP apps: Tools must be used naturally, not like a salesperson. Unconnected connectors require
search_mcp_registry→suggest_connectors; even connected apps require explicit user selection (urgency is not an exception). Direct calls are allowed only when the user names the connector, just selected it, or has a persistent preference. This isolates both user choice and Anthropic's legal liability. - Computer use: Ubuntu 24 Linux environment (bash, file editing), a Skills system at
/mnt/skills/public/where reading the relevant SKILL.md is mandatory before writing any code — a domain-knowledge injection mechanism guarding against environment mismatches. - Search behavior: Must search for current roles/status, fast-changing info, specific products/URLs, government positions, and any "current"/"still" phrasing; never search for eternal facts, deceased persons, or personal situations — and never mention knowledge cutoffs.
- Copyright: "15+ words from any single source is a SEVERE VIOLATION." One quote per source maximum, paraphrasing by default, no mirroring of article structure, no reproducing lyrics/poems even one line.
- Artifacts persistence:
window.storage.set/get/listkey-value store (text/JSON only, keys < 200 chars, values < 5MB, rate-limited, last-write-wins). "NEVER use localStorage, sessionStorage, or ANY browser storage APIs." - Leak source: https://github.com/elder-plinius/CL4R1T4S/raw/refs/heads/main/ANTHROPIC/CLAUDE-FABLE-5.md
- Collection repo: https://github.com/elder-plinius/CL4R1T4S
Closing take
The leaked prompt is not a simple "behavior guide" but Anthropic's fully engineered expression of safe AI: every rule is precise, executable, and bounded — the sediment of real attacks, PR crises, and legal risk assessments. The two-track Fable/Mythos strategy lets the public model withstand the harshest scrutiny while reserving unconstrained commercial space.
References