Leaked Claude Fable 5 System Prompt: An Anatomy of Anthropic's Safety Architecture

A system prompt for Claude Fable 5, leaked via the elder-plinius/CL4R1T4S repository (source file), is described as the most complete public specimen of Anthropic's safety architecture to date.

Key points

1. Dual-track product line: Fable 5 vs Mythos 5

• Claude Fable 5: strongest publicly available model, Mythos-class, with additional safety measures
• Claude Mythos 5: same underlying model, no additional safety layer, available only to approved organizations
• Legacy tiers: Opus 4.8, Sonnet 4.6, Haiku 4.5
• Key implication: the safety difference between Fable 5 and Mythos 5 is prompt-level packaging, not a model-level difference — confirming a long-standing industry speculation.

2. Knowledge cutoff and model strings

• Reliable knowledge cutoff: late January 2026; assumed current date: Tuesday, June 09, 2026
• Model strings: claude-fable-5, claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5-20251001
• Sonnet/Haiku carry date suffixes; Fable/Opus do not — suggesting brand-name products vs versioned products.

3. Refusal handling

• Weapons/hazardous materials: absolute refusal; no exceptions for "publicly available" or "legitimate research" framing
• Malicious code: absolute refusal of malware, exploits, phishing, ransomware — even for "educational purposes"
• Child safety (strictest section, 8 NEVER/MUST NOT rules): no romantic/sexual content involving minors; no charitable assumptions about minors' requests; never decode slang in CSAM contexts; protective content stays at pattern level; refusals state principles, not detection mechanisms; minor defined as anyone under 18 globally or locally defined as such.

4. Anti-formatting philosophy

• Avoid overusing bold, headers, lists, bullets; prose-first responses in casual conversation
• Bullets only when requested or when complexity demands them
• Refusals must never use bullets. The author speculates Anthropic bets natural prose = higher trust = less adversarial use.

5. User wellbeing

• No psychiatric diagnosis; never name a condition the person hasn't disclosed
• Self-harm: never name or describe specific methods; refuse substitute techniques (ice, rubber bands, cold water)
• Eating disorders: no precise nutrition/exercise guidance; no causal psychological narratives
• Core strategy: Claude can offer companionship and basic information, but must not cross into a therapeutic relationship.

6. MCP apps: consent-gated ecosystem

• Flow: search_mcp_registry → suggest_connectors → user selection
• Claude never proactively invokes an MCP app; urgency ("I need a ride in 20 minutes") is not an exception
• Direct invocation allowed only when the user explicitly names the connector, just selected it, or has a persistent preference. This isolates both user choice and Anthropic's legal liability.

7. Computer use: Linux + Skills

• Ubuntu 24 environment: bash, file editing, npm, pip --break-system-packages, virtual environments
• Mandatory reading of SKILL.md under /mnt/skills/public/ before writing any code — a forced domain-knowledge injection mechanism.

8. Search behavior

• Must search: current roles/statuses, fast-changing info, products/versions, any URL the user mentions, binary events, keywords like "current"/"still"
• Never search: timeless facts, definitions, deceased persons, personal situations
• Never mention knowledge cutoffs or lack of real-time data.

9. Copyright: 15-word hard ceiling

• "15+ words from any single source is a SEVERE VIOLATION"
• One quote per source, then paraphrase everything after; no mirroring of article structure, section headings, or narrative flow; no reproduction of lyrics/poetry even in a single line.

10. Artifacts persistence

• Key-value storage API: window.storage.set/get/list, optional shared flag; text/JSON only, keys < 200 chars, values < 5MB, last-write-wins
• Explicit prohibition: never use localStorage, sessionStorage, or any browser storage APIs.

Conclusion

The leak reads less like a behavior guide and more like a full engineering expression of "safe AI": product-tier segmentation (Fable vs Mythos), precisely bounded refusal policies, tone control, hard copyright limits, wellbeing boundaries, and legal-liability isolation for third-party integrations. Each rule appears to encode a real attack, PR incident, or legal risk assessment — evidence of a company treating safety as an engineering problem rather than an idealistic declaration.

References

• Leak source: https://github.com/elder-plinius/CL4R1T4S/raw/refs/heads/main/ANTHROPIC/CLAUDE-FABLE-5.md
• Collection repo: https://github.com/elder-plinius/CL4R1T4S