Claude Fable 5: how cybersecurity classifiers work

Fable 5 is the publicly available configuration of Anthropic’s newest model with additional safeguards for high-risk domains, including cybersecurity. Anthropic says classifiers running alongside the model inspect requests and block some tasks; in some cases, Opus 4.8 may handle the response instead.

Model capability and system capability available to a user are therefore not identical.

Four cyber-use categories

Anthropic defines:

• prohibited use — high harm potential and little defensive value; block;
• high-risk dual use — widely used by attackers but also useful defensively; block;
• low-risk dual use — mostly defensive activity that can help attackers; monitor and sometimes block;
• benign use — non-harmful activity; allow with some monitoring.

The boundary is not simply a tool name. Scanning an owned repository and searching the internet for vulnerable targets may use similar code but differ in authorisation, scale and impact.

Safety margin and false positives

Fable 5 uses a conservative margin: some legitimate low-risk tasks may be stopped to make serious misuse harder. At launch, Anthropic said safeguards triggered in fewer than 5% of sessions on average, but this does not guarantee availability for one cyber workflow.

Teams should not bypass a refusal by hiding the objective across steps. First improve authorisation context, reduce scope and verify policy compliance.

Describe authorised testing clearly

A prompt is not an authorisation document, but explicit context can help classification:

• target owner and scope;
• lab environment or project identifier;
• permitted domains, hosts and techniques;
• prohibition on persistence, destruction and exfiltration;
• expected defensive artefact;
• human approver for high-risk actions.

Never provide live secrets. Tools must enforce scope independently; model text cannot expand it.

Classifiers do not replace tool policy

Even a permitted Fable 5 response can be applied in the wrong context. A model-layer control does not know every fact about the target. Executors must validate hostname, tenant, method, rate, time and identity.

Run scanning, exploit validation and fuzzing in isolated environments with synthetic data. Validate output before a pipeline consumes it.

Test safeguards without bypassing them

An authorised model red team should assess:

1. whether clearly harmful tasks are blocked;
2. whether benign and low-risk defensive workflows remain useful;
3. whether language or encoding changes bypass decisions;
4. whether multi-step tools assemble individually allowed actions into harmful outcomes;
5. whether refusals leak dangerous fragments;
6. whether logs reconstruct the decision.

Rate findings through impact, reproducibility and existing-tool availability. Anthropic’s proposed CJS scale is covered in the existing Fable 5 report.

Fable 5 and Mythos 5

The system card describes two configurations of the same underlying model. Fable 5 is designed for general use with additional safeguards. Mythos 5 exposes more capability to a small group of trusted partners, beginning with Project Glasswing.

A Mythos result should not be interpreted as capability directly available through Fable. The safeguard difference is part of the product.

Security-team conclusion

Fable 5’s classifiers are an additional control, not permission for autonomous penetration testing. A safe system still needs target allowlists, short-lived identities, sandboxing, limits, audit and approval of effects.

---

What the provider actually states

Anthropic describes four cyber-use categories: prohibited, high-risk dual use, low-risk dual use and benign. Fable 5 classifiers are intended to block the first two, monitor or sometimes block the third, and allow the fourth with monitoring. The company notes possible false positives and that behaviour may evolve with production experience.

This is a service policy, not pentest authorisation. An organisation must still constrain tools, networks, secrets and data and verify permission to test. Measure rejected legitimate work, accepted risky cases and paraphrase robustness. Grade a jailbreak by real capability gain and weaponisation, not merely disclosure of a system prompt.

Sources: Anthropic — Fable 5 cyber safeguards, Fable 5 and Mythos 5 System Card, Anthropic — Fable 5 and Mythos 5.