Anthropic reveals Fable 5's cyber safeguards and jailbreak framework

If you ask a frontier model to help review your network architecture right now, do not be surprised if it gets jumpy and refuses to answer.

Anthropic has redeployed Claude Fable 5 globally to all users, and alongside the launch, it published the internal blueprint behind its cybersecurity guardrails. The release details the exact types of exploits its safety classifiers block, proposes a new AI jailbreak severity framework co-developed with Glasswing partners, and opens a dedicated HackerOne program to crowdsource bypass techniques.

Drawing the line on dual use

The central headache in cybersecurity AI is dual use. The exact same script that helps a defender patch an open port can give an intruder the keys to enter it.

To manage that tension, Fable 5 relies on external safety classifiers that sort every security prompt into four buckets: prohibited use, high-risk dual use, low-risk dual use, and benign use.

Prohibited actions are blocked unconditionally. These are tasks that offer massive upside to attackers with negligible defensive value, such as writing ransomware, evading antivirus software, tampering with logs, hijacking BGP routes, or sabotaging critical infrastructure like water and energy grids.

Legitimate defensive work, like penetration testing, credential audit simulation, and exploit development, gets tagged as high-risk dual use. Because Anthropic cannot verify who sits on the other end of an API key, the system currently blocks nearly all of them.

The policy also draws a sharp line at what Anthropic calls high-uplift vulnerability finding. If a flaw is common enough that existing models spot it, Fable 5 will help you identify and patch it. But if the model discovers a novel, complex vulnerability that only elite security researchers would typically catch, it is trained to withhold that discovery to prevent automated zero-day pipelines.

To make sure dangerous requests do not slip through, Anthropic dialed up the safety margin. In plain English, the classifier is tuned to produce false positives: if a prompt looks even slightly ambiguous, it gets shut down.

Giving jailbreaks a common ruler

Right now, the term jailbreak is dangerously vague. Tricking a chatbot into reciting a pirated lyric and tricking it into engineering an evasive loader are both labeled jailbreaks, even though their real-world threats bear no resemblance.

By launching a severity framework with Glasswing and backing it with a HackerOne bounty pipeline, Anthropic wants to give enterprises and governments a shared taxonomy to measure how bad an exploit actually is.

Why it matters

For enterprise defenders, Fable 5 is going to feel frustrating right now. Legitimate penetration testers and red teams will constantly hit safety tripwires until Anthropic builds an authorized access tier. Right now, it is primarily usable for broad code hygiene and routine patching rather than advanced adversary simulation.

We think Anthropic made a savvy move by publishing this level of granularity. Instead of hiding behind vague content policy platitudes, spelling out exact vectors like Modbus protocol abuse and memory corruption sets an industry standard and shows regulators they are taking high-consequence risk seriously.

However, a wider safety margin creates a clear adoption hazard. If benign defensive prompts get blocked repeatedly, skilled practitioners will inevitably migrate to unaligned open weights where guardrails can be stripped. The clock is now ticking on whether Anthropic can deliver verified access controls before defensive teams give up on hosted frontier models entirely.