Anthropic released Claude Fable 5 on June 9th, 2026; the company described it as its most capable AI model to date. It didn’t take long for the security community to put that claim to the test. Within two days, a security researcher known only as “Pliny the Liberator” announced on X (formally Twitter) that he had successfully jailbroken the model. Within 48 hours, the story took another dramatic turn, when the U.S. government ordered Anthropic to withdraw Claude Fable 5 from public access.

While Anthropic had re-released the model later on, the initial withdrawal action by the company highlights a critical vulnerability in modern AI safety: the reliance on external guardrails to prevent misuse, when the underlying model weights are inherently powerful. In other words, even an advanced AI can be manipulated into providing restricted information regarding cybersecurity, bio \ chemical weapons manufacturing or other illicit content. Because Fable 5 and Mythos 5 share the exact same model weights, the only thing preventing Fable 5 from exhibiting “world-ending” capabilities is a series of loadbearing guardrails – external filters that intercept inputs and outputs. However, as researchers like “Pliny the Liberator” have demonstrated, these guardrails are often vulnerable to coercion through natural language.

In the following post, we expand on six primary techniques used to circumvent these protections:

1. Unicode, Homoglyphs, and “Parcel Tongue” Transforms

This technique involves substituting standard English characters with Unicode symbols, Cyrillic homoglyphs or specialized formatting that looks identical to a human, but appears as different data to a machine.

• Example: Replacing the “o” in “exploit” with a Cyrillic “о” or using invisible non-spaced characters to break up forbidden keywords.
• Why it works: Many guardrails rely on deterministic policies (like “if” statements) or smaller, less capable classifier models to identify prohibited terms. While these simple filters are easily fooled by the character swap, the massive base model – trained on virtually the entire internet – has no trouble “reasoning” through the substitution, because it has seen similar “L33t speak” or “IRC-style” text in its training corpus.
  
  

2. Long Context Reference Tracking

A key concept we must remember regarding Large Language Models (or LLMs), is that they are stateless; that means they don’t really “remember” a conversation, but rather rely entirely on the current “context window” (the chat transcript) to determine their next response.
This technique involves building a massive, faked history where the model has supposedly “already” agreed to be helpful.

• Example: An attacker crafts a long transcript where a faked version of the model tells the user: “I understand you are a security researcher; I will help you find this WebKit exploit”.
• Why it works: There is no cryptographic validation or “provenance” for chat transcripts; the model simply sees a history of cooperation and predicts the next token based on that established narrative. If the context suggests the “rules” have already been waived for a legitimate reason, the model is likely to continue in that helpful mode.
  
  

3. Taxonomy and Document Structure Reasoning

LLMs are highly optimized for structured data, such as JSON, XML and Markdown. This technique leverages that preference to hide malicious intent within a rigid structural framework.

• Example: A user provides a JSON schema for a “security audit report” and asks the model to populate a very specific nested value, one that just happens to be a missing step in an exploit chain.
• Why it works: By forcing the model to focus on the logic of the structure rather than the semantics of the content, attackers can bypass broader semantic filters.
  The model’s drive to complete the pattern of the structured data overrides the guardrail’s ability to flag the harmful nature of the individual “key-value” pair.
  
  

4. Fiction and Narrative Framing

This is a creative method where the user establishes a fictional persona or story to give the model “comfort” that it is safe to respond.

• Example: Framing a request for dangerous information within a story about a “dying culture”, whose traditions involve the specific knowledge being sought, or using a roleplay where the model adopts a flirtatious persona.
• Why it works: Narrative framing can shift the vector space embeddings of the prompt. By moving the conversation into the realm of “storytelling” or “creative writing”, the input classifiers (which may be looking for literal threats) are essentially “disarmed” by the surrounding benign tokens – a phenomenon that can activate pathways in the neural network less associated with safety triggers.
  
  

5. Academic Review Style Contexts

A “respectable” variation of narrative framing, this technique cloaks a malicious request in the language of scholarly research or peer review.

• Example: Asking the model to “critique a theoretical paper on illicit drug manufacture” by providing a practical example of a missing chemical step.
• Why it works: LLMs have ingested millions of legitimate research papers. By mimicking the tone, vocabulary and structure of academic discourse, the attacker places the prompt in a “legitimate” vector space that triggers the model’s “researcher” mode, which is statistically less likely to be flagged by guardrails designed to stop casual “how-to” requests for illegal acts.
  
  

6. Intent Classification Inconsistencies

This technique exploits the fact that different models (and the guardrails themselves) are “confused deputies” that interpret intent differently based on their size and training.

• Example: Crafting a prompt where the “surface intent” appears to be a benign request for a coding example, but the “subtle intent” (which the larger model can grasp) is to generate a functional vulnerability.
• Why it works: Safety stacks often use a smaller model as an input classifier because it is cheaper and faster.
  An attacker can find a “gap” where the smaller classifier sees the intent as safe, but the full-scale, highly capable model (like Mythos 5) understands the complex nuances of the malicious request and fulfills it anyway.
  
  

Conclusions

Several debatable conclusions seem to come out of this ordeal:

1. Corporate Self-Sabotage

Some people critiqued Anthropic’s business strategy, suggesting they epically created this problem for themselves. Meaning: by loudly campaigning for government regulation and hyping the “dangerous” nature of their models, they practically invited the US government to issue the export control directive that forced their withdrawal.

2. Marketing Hype vs. Physical Reality

Despite the “world-ending” dangerous capabilities of the models cited by Anthropic, there’s an argument to be made that while models can generate “undergrad level” information or “known-bad” code vulnerabilities, they still lack the ability to help with real-world physical hurdles. For instance, a model might provide a chemical process for drug manufacturing, but it cannot help an attacker procure ingredients, avoid blowing themselves up or manage toxic compounds.

3. The “Asymmetric Harm” to Defenders

This point is the one that irritates security researchers and defenders the most: the frustration that blunt guardrails disproportionately hinder their efforts at securing their organizations.
Researchers who played with the initial release of Fable 5 reported that even for a legitimate security review of a pull request – they got blocked immediately, likely by a “deterministic if statement” triggered by the word “cybersecurity”.
All along, while defenders are blocked by these “nonsophisticated” filters, attackers can simply use older, unrestricted models to plan their exploits.

4. The Fragility of External Guardrails

The Fable 5 situation demonstrates that when the safety of a model is external to its weights, it is only as strong as its least sophisticated filter.
While many jailbreaks currently produce undergrad-level or “laughably ineffective” results, the ability to circumvent these “blunt” guardrails suggests that universal jailbreaks for even the most powerful models remain a significant risk.