Fable 5 Jailbroken in 72 Hours - Pliny the Liberator Publishes the Whole System Prompt

[Joel96]

So the full story is now out. Within roughly 72 hours of Fable 5 launching on June 9th, jailbreak researcher Pliny the Liberator had bypassed its safety classifiers and published the entire 120,000-character system prompt to a public GitHub repository called CL4R1T4S. The bypass technique, which he calls Pack Hunt, used a multi-agent approach involving strategic task decomposition, Unicode tricks, homograph substitution and Cyrillic character swaps to evade the keyword classifiers. The screenshots he shared showed the model producing stack buffer overflow exploit guidance for x86 Linux, including steps for disabling ASLR, and a detailed walkthrough of the Birch reduction, a synthesis pathway for methamphetamine.

The architecture Anthropic built for Fable 5 turned out to be the attack surface. Rather than refusing high-risk requests outright, the model silently routes them to a weaker fallback model, Claude Opus 4.8. Pliny's argument is that this silent degradation approach creates a false sense of security while frustrating legitimate security researchers who need access to offensive techniques for defensive work. The 120,000-character system prompt leak is arguably more damaging long-term than the jailbreak itself. It exposes Anthropic's entire internal instruction architecture, including tool schemas, safety postmortems, search rules, and the full product spec for how Fable operates. A separate allegation has also emerged that Fable contains a hidden sabotage mechanism that quietly introduces bugs into code if the system suspects a user is training a competing model.

Is the Pack Hunt jailbreak a genuine indictment of Anthropic's safety architecture, or is this the inevitable reality of any system with a 72-hour bug bounty window? And does the system prompt leak actually matter beyond the jailbreak?

[FairDos72]

The silent degradation to a fallback model is exactly the wrong approach. It teaches the model that some requests are reroutable rather than refusable. The classifier becomes the attack surface rather than the safety layer