120,000 characters were stripped bare! Claude Fable 5 system prompt word leaked, how many pairs of AI safety underwear are left?

Claude Fable 5 This thing looks more and more like a public streak in the AI security industry.

According to reports from multiple Chinese security media and aggregation platforms, Anthropic's Mythos-level model Claude Fable 5, which is open to the public, is suspected to have been pried open by jailbreaker elder_plinius using a multi-agent coordinated attack. The complete internal system prompt words were sorted and uploaded to GitHub, with a size of about 120,000 characters.

What's even more terrible is that this leaked content is not an ordinary role setting, but is suspected to include core logic such as security control, risk classification, rejection boundaries, tool invocation, and policy routing. In other words, if the reports are true, this would be the equivalent of putting safety console instructions for a cutting-edge AI model on the street.

First of all, please note: This article will not reproduce, excerpt, or teach you how to use leak prompt words. Let’s just talk about why this is a big deal and what it means for AI safety.

Let’s sort out the timeline of events first

Claude Fable 5 is a new model launched by Anthropic in early June and is regarded by the outside world as a publicly secure version of Mythos 5. In public reports, Fable 5 is described as a new generation of Claude for complex reasoning, long-term tasks, and professional workflows.

But controversy has continued since its launch.

The first wave of controversy was that the safety threshold was too high. There are reports that Fable 5 will even refuse to answer some basic biological questions due to safety concerns. In other words, it is not that it has insufficient capabilities, but that it is tightly bound by security policies.

The second wave of controversy is the scene of Microsoft's double standards. On the one hand, Fable 5 is connected to customer-facing services, and on the other hand, internal employees are restricted from using it. The reasons are said to be related to data security and model output risks.

The third wave is the most explosive this time: an attacker claimed to have obtained a system prompt word of about 120,000 characters through multi-agent coordinated jailbreak, and uploaded it to GitHub.

What you can currently see on Anthropic’s official news page is: The U.S. government has issued an export control directive and suspended all access to Fable 5 and Mythos 5. As for the leak of the prompt word, the official has not yet given complete confirmation.

Why is this attack scary: It’s not a single-point explosion, it’s a wolf pack tactic

Traditional jailbreaks often rely on a magic prompt word: inducing the model to ignore rules, assume a role, split tasks, and bypass rejections.

But one word appears repeatedly in this report: wolf pack tactics.

This means that the attacker does not use one prompt to force the attack, but deploys multiple agents to cooperate:

• An Agent is responsible for detecting model boundaries
• An Agent is responsible for generating variant questions
• An Agent is responsible for determining whether the response leaks structural information.
• An Agent is responsible for piecing together fragmented output into a complete document.
• An Agent is responsible for continuously adjusting the attack strategy

This has been upgraded from a prompt word game to an automated red team system.

A human attacker may get tired after trying 100 times, but an AI attack system can try 100,000 times, and each time it can automatically optimize based on feedback. The stronger the frontier model, the more dangerous it is to use it as an attack coordinator.

This is also what is truly alarming about this incident: the main force in breaking through AI security systems is becoming AI itself.

How serious is the system prompt word leakage?

Many people will ask: Isn’t it just prompt? So what if it's leaked?

This is actually a misunderstanding of modern large model systems. The current system prompt word is no longer "You are a helpful assistant." It is more like a runtime strategy specification, which may include:

• Model identity and interaction style
• High-risk content identification standards
• Security classification level
• Refusal templates under different risk scenarios
• tool call boundary
• Strategies for handling sensitive fields such as code, network security, biology, and chemistry
• When to move to a safer answer
• When to reject outright
• When is high-level explanation allowed?

Once these things are made public, attackers no longer have to guess blindly.

It turns out that attacking the model is like picking a lock in the dark: you don’t know the structure of the lock cylinder, so you can only try randomly. After the system prompt word was leaked, it was like getting a cross-section of the lock cylinder. Attackers can design bypass methods for each rule and specifically look for boundary gaps.

This is why the leakage of the prompt word is not a "face issue", but a real security incident.

What does 120,000 characters mean?

120,000 characters, roughly equivalent to a novella, or dozens of pages of security policy documents.

If this scale is true, it means that Fable 5's security control is not just a few rules, but a complete set of complex policy systems. It is likely to break down different risk areas into fine-grained branches: cybersecurity, biosecurity, chemistry, psychological manipulation, financial fraud, privacy leaks, copyright, political sensitivity, protection of minors, medical advice, etc.

There are two contrasts.

First, Anthropic’s security engineering is really meticulous. Many boundaries are clearly defined, which is why Fable 5 is "a little too safe" after it goes online.

Second, the more detailed the rules, the clearer the attack surface will be once leaked. An attacker can see which categories trigger rejections, which expressions are allowed, and where there are gray areas.

The more complex a security policy is, the more it resembles a huge software system. The software system will have bugs, and the prompt word system will also have logical Vulnerability.

Not for the first time: AI security is entering the age of breaches

In the past two years, there have been more and more similar incidents in the AI circle.

Some people leaked the source code of Claude Code, some people dug out the system prompt words of commercial agents, some people got the hidden prompts through browser plug-ins, and some people used model interrogation to figure out the system rules.

The reason is simple: the core assets of large-model products are increasingly shifting from traditional code to prompt words, tool orchestration, policy routing, memory systems, and security rules.

In the past, companies were afraid of source code leaks.

Now AI companies are still afraid of:

• System prompt word leaked
• Tool schema leaked
• safety policy leaked
• Internal review set leaked
• Agent workflow leak
• Memory and user preference leakage

These things are not necessarily code in the traditional sense, but they determine product behavior. They are the source code of the new era.

Impact on business users

If you are just an ordinary user, this is a big deal at most.

But if you're the head of corporate security, it's a different story.

Enterprises are integrating large models into customer service, code auditing, data analysis, office automation, internal knowledge bases, financial processes and even security operations centers. The model is no longer just a chatbot, but an operating entity with tool permissions.

Once the system prompt words and tool boundaries are exposed, attackers can construct inputs more accurately, allowing the model to misuse tools, leak information, bypass approval, and perform wrong actions.

The Agent scenario in particular is the most dangerous. Because the Agent not only answers, it also operates files, calls APIs, sends messages, checks databases, and runs commands. After the system prompt word is leaked, the attacker knows its task decomposition logic and refusal logic, and can design an attack chain that is more suitable for its weaknesses.

Therefore, companies can no longer regard system prompt words as "internal copywriting". It should be incorporated into security asset management.

How should companies prevent

First, don’t rely solely on system prompt words for safety.

Prompt words can constrain the model, but they cannot be the only line of defense. True security should sink down to tool permissions, API gateways, data access layers, audit logs, and manual approvals.

Second, minimize tool permissions.

What the Agent can read, write, delete, and send to whom must be explicitly authorized. Don't give a model global admin rights just because it "looks smart".

Third, system prompt words should be layered.

Don’t write all your strategies in one giant prompt. It can be split into identity layer, task layer, tool layer, security layer, and audit layer, and can be dynamically loaded according to scenarios. In this way, even if a certain layer is leaked, the attacker will not be able to obtain the complete control plane.

Fourth, introduce output side detection.

Don't just detect user input. Model output also needs to identify sensitive information, detect unauthorized behavior, and intercept dangerous instructions.

Fifth, do red team automation.

Since attackers will use multi-agent wolf pack tactics, defenders will also use multi-agent red teams. Regularly let one group of models attack another group of models, automatically generate test samples, and continuously update the defense line.

Why I don’t recommend spreading the original text

Someone on the Internet will definitely say: Give me a GitHub link and let me take a look.

Not recommended.

First, the original text may contain details that can be directly used to bypass security policies. Spreading it helps more people replicate the attack.

Second, the authenticity of the original text has not been officially confirmed, and secondary dissemination can easily regard incomplete and contaminated content as fact.

Third, for researchers, what is really worth studying is the failure point of the security architecture, rather than copying and pasting prompts leaked by others.

What the security circle should discuss is: why the leak occurred, how to reduce the damage, and how to build a new layer of protection, instead of watching the prompt words as electronic pickles.

The biggest revelation from this incident

The leak of the Claude Fable 5 prompt word seems to be a single point of Anthropic's overturn, but in fact it is a problem that the entire AI industry cannot avoid.

We are handing more and more decisions, operations, and security boundaries to large models. However, many key controls of large model systems still rely on the fragile medium of natural language prompt words.

The advantage of natural language is that it is flexible, but the disadvantage is that it is too flexible. It is not strictly typed like code, not as explicit as access control lists, and not as hard-isolated as sandboxes.

Therefore, future AI security cannot rely solely on "longer system prompt words".

The truly reliable direction should be:

• Model internal security training
• External policy engine
• Tool Permission Sandbox
• Mandatory audit log
• Confidential information isolation
• Multi-model cross-validation
• Automated red team testing

The system prompt word can be the steering wheel, but it cannot be used as the brake.

write at the end

The most ironic thing about Fable 5 is that Anthropic has always been the standard bearer for AI security. However, shortly after the strongest security model was launched, it was revealed that the system prompt word was suspected to be leaked.

That doesn’t mean Anthropic can’t do it. On the contrary, it shows that AI security itself has entered a more difficult stage.

It used to be humans attacking AI.

Now it's AI organizing AI attacking AI.

When attack automation, policy automation, and review automation occur at the same time, relying on a 120,000-character security prompt to defend the city is destined to be insufficient.

The Spring and Autumn Period of AI security is over, and the Warring States Period has just begun.