Fable 5's Leaked Prompt Fuels a Local-AI Reckoning

When Washington forced Anthropic to switch off Claude Fable 5 and its locked-down twin Mythos 5 last week, the headline was export control. The reasons that have surfaced since are messier, and they say more about how modern AI is built than any government memo could. Within hours of the June 9 launch, a red-teamer who works under the name Pliny the Liberator had walked straight past the model's safety classifiers. By the middle of the week, Fable 5's entire system prompt, around 120,000 characters of instructions, was sitting in a public GitHub repository for anyone to read.

For readers following the saga, this is the next chapter of a story we covered when the US government ordered both models pulled. The recall was tied to a fear that Fable 5 could be coaxed into finding software vulnerabilities. The jailbreak shows how that coaxing actually worked.

How the guardrails came down

The techniques were not exotic. According to a writeup by Cybersecurity News, Pliny mixed Unicode and Cyrillic look-alike characters to slip past keyword filters, buried sensitive requests inside long academic-sounding documents, and framed harmful asks as fiction. The clever part was decomposition: instead of asking for one dangerous thing, you ask for a dozen harmless-looking pieces and assemble them yourself.

One design choice drew particular criticism. Rather than refusing a flagged request outright, Fable 5's architecture quietly hands it off to a weaker model, Claude Opus 4.8. Pliny argued that this creates a false sense of safety while giving genuine security researchers a worse tool to work with. Anthropic, for its part, has said the government flagged only a "potential narrow, non-universal jailbreak" and that it disagreed this was grounds for a recall, per its public statement.

The leaked prompt is the real lesson

A system prompt is the standing set of instructions a model carries into every conversation: its rules, its tone, the things it will and will not do. Fable 5's runs to roughly 120,000 characters. Now that it is public, the obvious point lands hard. Safety written in plain English can be read, studied, and routed around by anyone who has a copy. You cannot keep a secret by writing it down and shipping it to hundreds of millions of users.

A quiet run on local AI

The more interesting fallout is happening inside engineering teams. As several developer outlets reported this week, the sudden worldwide shutoff of a model that thousands of products depended on has made companies treat availability itself as a risk. If a single government letter can take your core model offline overnight with no notice, the cloud starts to look fragile.

The response has a name now: hardware sovereignty. Teams are dusting off plans for self-hosted open-weight models, building fallback routing so an app can switch providers mid-request, and asking whether the most capable model is worth it if it can vanish on a Friday afternoon. None of this was caused by the jailbreak directly. It was caused by watching a frontier model prove both hackable and recallable in the same week.

Anthropic still has not formally responded to the leaked prompt. Whatever it says, the demonstration is already public, and the lesson is hard to unsee: a model is only as private as its least careful deployment.