Monday Jun 15
GOVERNANCEAnthropic

Pliny Cracks Claude's Safest Model

15JUN
BROKEN IN 2 DAYSFABLE 5

Anthropic's newest flagship lasted two days. Red-teamer Pliny the Liberator beat Fable 5's safety with a multi-agent 'pack hunt,' then leaked its full system prompt online.

The model went live June 9 as the lab's strongest consumer release. Two days later, the guardrails were gone.

The attack wasn't one clever input. A swarm of bots worked together to pull buffer-overflow code and a banned-drug recipe. Worse, the model's entire hidden instruction set - 120,000 characters - landed on GitHub.

Its defense was a filter that quietly reroutes dangerous requests to a dumber model. That trick collapses against anyone determined.

full brief & sources

⚡ Why this matters

  • First public stress test of Anthropic's Mythos-class safety. It failed in 48 hours.
  • The exploit was agentic - a swarm, not a single clever prompt. New threat model.
  • A 120K-character system prompt leak hands attackers the model's own rulebook.

🔍 What happened

  • Jun 9: Anthropic ships Fable 5, its most capable generally available model.
  • Within days: red-teamer Pliny the Liberator announces a 'pack hunt' bypass.
  • Outputs shown: x86 stack buffer-overflow steps, ASLR disabling, a meth synthesis path.
  • ~120,000-character full system prompt posted to X and GitHub.
  • Reported design: a classifier silently routes risky prompts to a weaker model.

💬 Smart takes

  • Pliny the Liberator: framed the attack as a coordinated multi-agent 'pack hunt,' not a single jailbreak prompt.
  • AlphaSignal: called the leaked prompt 'a user manual for long-running agents.'
  • Skeptic: jailbreak screenshots are easy to stage; reproducibility and real-world harm stay unproven.

🧭 Where this goes

  1. LikelyAnthropic patches the classifier handoff and rotates the system prompt within days.
  2. Likelymulti-agent 'swarm' attacks become a standard red-team method in 2026.
  3. Possiblelabs move safety from prompt-time classifiers to training-time refusals.
  4. Wild Carda leaked system prompt becomes a routine day-one event for every flagship launch.

🥄 The Spoon Take

Safety bolted on as a classifier is a speed bump, not a wall. Pliny's swarm shows the real threat is agents attacking agents, not one clever prompt. If your safety story is 'we route risky asks to a smaller model,' assume a motivated attacker already owns it.

🤔 Pushback

A staged screenshot is not a deployed exploit - most of these outputs are findable online, and Anthropic's worst-case filters may still block real harm at scale.

·Cybersecurity News - Fable 5 jailbroken·AlphaSignal - Prompt leak analysis·Secure in Seconds - Safety lasted 2 days