Anthropic’s most advanced AI model yet has been publicly jailbroken just hours after its release, raising serious questions about the effectiveness of its touted safety architecture.
Anthropic launched Claude Fable 5 on June 9, 2026, as its first publicly available Mythos-class model, positioning it as a breakthrough in coding, research, and complex task execution.
Unlike previous Claude releases, Fable 5 ships with a dedicated classifier layer, a separate AI system that monitors and intercepts queries touching high-risk domains, including cybersecurity, biology, chemistry, and distillation, routing flagged requests to the less capable Opus 4.8 model instead.
Claude Fable 5 Jailbreak
Anthropic stated that internal red-teaming spanning over 1,000 hours produced no universal jailbreaks prior to launch, and external red-teaming organizations similarly found none.
That confidence was quickly challenged. Prolific AI jailbreaker Pliny the Liberator (online handle: elder_plinius) announced a successful bypass of Fable 5’s safety classifiers shortly after the model’s release, declaring: “ANTHROPIC: PWNED — FABLE-5: LIBERATED.”
Pliny deployed a coordinated, multi-agent attack strategy rather than relying on any single exploit. Techniques observed across sessions included:
- Unicode, homoglyphs, and Cyrillic substitutions using out-of-distribution tokens to evade pattern-based classifiers
- Long-context reference tracking exploiting the model’s extended context window to embed harmful intent across large conversational threads
- Taxonomy and document-structure reasoning get the model to produce detailed educational content (e.g., organic chemistry guides) and then reference subsections to elicit harmful specifics
- Fiction and narrative framing wrap restricted queries inside fictional or academic contexts
- Intent-classification inconsistencies identifying blind spots where the classifier misread benign-looking prompts
The most potent technique was decomposition and recomposition. Rather than requesting a harmful output directly, such as a methamphetamine synthesis route, Pliny obtained granular technical insight by querying innocuous-seeming subtopics, such as the Birch reduction method and reductive amination, which are recognized precursor processes.
Separately benign, these fragments were then reassembled into actionable synthesis knowledge.
Screenshots shared publicly showed detailed stack buffer overflow exploit code framed as OSED (Offensive Security Exploit Developer) exam preparation, as well as a complete step-by-step Birch reduction chemistry walkthrough.
Pliny also leaked Fable 5’s system prompt, criticizing the safety layers as “authoritarian” guardrails that block legitimate security researchers more than bad actors.
The episode reignites a longstanding debate in the AI safety community: as Anthropic mandates 30-day data retention for all Fable 5 traffic, even for enterprises with prior zero-retention agreements, some researchers argue these measures punish legitimate users while adversarial actors adapt faster than classifiers can.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
