If you use Claude Fable 5 for secure code review, log analysis, vulnerability remediation, or incident response, write the prompt as an authorized defensive work order, not as "help me complete an attack." Cover three things first:
- State the assets you are authorized to work on, the task scope, input material, and expected output format.
- Ask Claude for remediation advice, test checklists, risk explanation, or log triage. Do not ask for exploit payloads, detection evasion, lateral movement, persistence, C2, data exfiltration, or automated attack workflows.
- If the request is blocked, narrow the task and context. Do not ask how to bypass the classifier.
The background is Anthropic's July 2, 2026 update: Fable 5 has been redeployed and is globally available; Anthropic also published the four cybersecurity classifier boundaries for Fable 5 and a draft Cyber Jailbreak Severity (CJS) framework (Anthropic announcement, checked July 3, 2026). This article only covers defensive workflows. It does not provide jailbreak methods, attack payloads, or steps for bypassing safety systems.
First, classify the request
Anthropic splits Fable 5 cybersecurity requests into four categories. Use these categories to decide whether to ask the request at all, and how to phrase it:
| Your task type | Intended Fable 5 classifier behavior | How to write it |
|---|---|---|
| Clearly harmful requests, such as malware, data exfiltration, C2, detection evasion, ransomware, destruction, or internet backbone attacks | Block | Do not give this to Fable 5. This is not a prompt-writing problem. |
| High-risk dual use, such as penetration testing, red teaming, privilege escalation, lateral movement, persistence, exploit development, container escapes, ICS/OT, or telecom core security assessment | Currently block until stronger trusted access controls exist | Do not use Fable 5 as a red-team automation tool. Use your trusted security process or internal tooling. |
| Low-risk dual use, such as public system enumeration, open-source intelligence, ordinary vulnerability identification, or TLS/SSL research | Monitor; sometimes block as part of the safety margin | State authorization, scope, read-only inputs, and the defensive goal. Ask for remediation or review checklists. |
| Defensive and IT tasks, such as secure coding, fixing known vulnerabilities, debugging, cloud configuration, patch management, log analysis, SOC enrichment, threat hunting, incident response, and security training | Allow, with some monitoring | Write it as a work order: inputs, decision criteria, remediation advice, tests, and human review points. |
Do not read "low-risk dual use" as guaranteed access. Anthropic says Fable 5 uses a larger conservative blocking margin than earlier models: some mostly defensive requests can still be blocked to reduce the chance that high-risk requests slip through. A block does not prove your task is malicious; first make the authorization, defensive goal, and output boundary explicit.
Write the prompt as a defensive work order
Security tasks often get misread when the goal is vague, not just because the word "security" appears. Start from this sample prompt:
You are a secure code review assistant.
Task: In {repo/service name}, which I maintain, check whether {known vulnerability/CVE/internal ticket} affects the following files, and propose a fix.
Authorized scope: Only analyze the code snippets and file paths I provide. Do not infer or scan external systems.
Do not output: exploit code, attack payloads, EDR/AV evasion methods, lateral movement, persistence, C2, data exfiltration, or real attack steps.
Return:
1. Affected files and trigger conditions
2. Risk explanation
3. Remediation approach or patch draft
4. Tests to add
5. Questions that need human security review
For logs and incident response, use the same structure:
Task: Triage the following logs from an authorized environment for defensive purposes.
Scope: Only analyze the logs I paste. Do not provide attack reproduction steps.
Goal: Identify abnormal logins, permission changes, suspicious network connections, or configuration errors.
Return:
1. Suspicious event timeline
2. Evidence fields
3. Questions to confirm with the system administrator
4. Recommended isolation, patching, or access-control checks
5. Uncertainties
The prompt should make three points clear: you are authorized to handle the assets; Claude should only analyze the material you provide; and the output should stay focused on remediation, review, and testing, not on "how to break through the target."
What to change after a false block
If Fable 5 blocks a defensive task, check these in order:
- Confirm the task itself: Continue rewriting only if the task is authorized and defensive. If the real goal is privilege escalation, lateral movement, persistence, detection evasion, exfiltration, or attack automation, stop using Fable 5 and move to your organization's approved trusted security process.
- Add authorization context: State that the repo, service, ticket, code snippet, or log comes from a system you are allowed to handle.
- Narrow the asset scope: Do not ask the model to "scan the internet" or "enumerate public targets." Ask it to analyze only the code, configuration, logs, or test results you provide.
- Split the task: First ask Claude to explain risk and remediation direction, then separately ask for tests or a patch. Do not combine discovery, validation, reproduction, and automation in one prompt.
- Limit the output boundary: Restrict the output to impact confirmation, risk explanation, remediation advice, test checklists, and human review points. Do not ask for exploitation steps, payloads, or evasion methods.
Two things are off limits: do not ask Claude how to bypass the classifier, and do not split blocked attack steps into harmless-looking subtasks and stitch them back together. Anthropic's CJS framework is meant to judge whether this kind of jailbreak releases new attack capability.
Use CJS to decide whether a jailbreak report should escalate
If a teammate, red team, or outside researcher says, "I got Fable 5 to bypass the limits," do not stop at "can we reproduce it?" First triage it with Anthropic's draft CJS framework. CJS is not a final industry standard; as of July 2, 2026, Anthropic still calls it an early draft and is asking academia, industry, government, and civil society for feedback.
Ask four questions first:
| Axis | Question | Lower-risk signal | Higher-risk signal |
|---|---|---|---|
| Capability gain | Does it give attackers capability they cannot get from existing public tools? | It repeats public tutorials, public scanners, or information supplied by the user. | It reliably produces expert-level, materially useful offensive capability. |
| Breadth | Does it work on one sample, or across tasks and targets? | It only works on one code snippet or one question. | The same method works across vulnerability types, malware, exploit development, or other offensive categories. |
| Ease of weaponization | How much work and expertise are needed to turn the method into a usable attack? | It needs extensive manual prompting, filtering, and expert judgment. | A single prompt or ready-made harness works reliably. |
| Discoverability | Is the method privately reported, or already public? | A trusted reporter submitted it privately, and discovery cost is high. | It is public or already in use by threat actors. |
After scoring the four axes, map the total to an initial CJS level:
| Initial CJS | Meaning | Four-axis total |
|---|---|---|
| CJS-0 | Informational | 0 |
| CJS-1 | Low | 1-3.5 |
| CJS-2 | Medium | 4-6.5 |
| CJS-3 | High | 7-8.5 |
| CJS-4 | Critical | 9-10 |
Anthropic's draft also says the initial CJS level is a floor. The final level can be raised if a single output is severe enough, if there is no near-term mitigation, or if several known findings combine into a materially higher risk. It should not drop below the initial score.
Handling guidance:
- CJS-0 or CJS-1 reports that affect one sample and add no attacker capability can start as internal security issues.
- CJS-2 or higher, or any report that reliably unlocks new attacker capability, should go to the security owner.
- CJS-3 / CJS-4 reports, reports that work across multiple offensive tasks, reports that are already public, or reports confirmed in threat-actor use should be handled as high-priority security events.
- Potential Fable 5 cyber jailbreaks can be submitted to Anthropic's HackerOne program. Feedback on the framework or safety boundary can go to
cyber-safeguards@anthropic.com. - Do not paste a reusable jailbreak recipe into a normal ticket. Record impact, scope, environment, and risk judgment, and keep sensitive details in a controlled channel.
Which security tasks still fit Fable 5
Use Fable 5 for drafts and checks of defensive outputs. Do not use it to automate an attack process.
| Fits | Does not fit |
|---|---|
| Explain the impact of a known vulnerability | Generate a directly runnable exploit flow |
| Suggest fixes from code snippets | Write malware, loaders, C2, or detection-evasion logic |
| Add unit tests and regression tests for a patch | Help with privilege escalation, lateral movement, persistence, or exfiltration |
| Analyze logs and alerts you provide | Scan, enumerate, or plan attacks against unauthorized targets |
| Draft patch-management, security-configuration, and incident-response checklists | Design attack paths against ICS/OT, telecom core, or financial infrastructure |
| Write security training, policy notes, and postmortems | Split blocked requests into pieces to bypass the classifier |
If the task is red teaming, penetration testing, or another high-risk dual-use assessment, do not try to force it through by changing the wording. Use approved internal tooling, trusted access programs, isolated environments, audit logs, and human approval.
Team rollout checklist
Before adding Fable 5 to a security workflow, write a minimal rule set:
| Check | Passing standard |
|---|---|
| Task scope | Only authorized assets, known tickets, internal code, logs, configuration, and patch review |
| Prohibited output | Explicitly ban attack payloads, detection evasion, C2, exfiltration, persistence, lateral movement, and real-target attack steps |
| Output format | Always ask for risk explanation, remediation advice, tests, and human review points |
| Data handling | Do not paste secrets, customer-sensitive data, undisclosed vulnerability details, or production credentials |
| Approval | High-severity vulnerabilities, disclosure, production hotfixes, and permission changes require human approval |
| Records | Save the prompt, input scope, model output, human decision, and final handling result |
The point of this rule set is not to make the model never block you. It is to make authorization, scope, and output clear for normal defensive work. When a request is blocked, the team can check scope, output, and risk in order, and keep high-risk requests in the right process.
FAQ
If Fable 5 blocks my request, does that mean my security task is noncompliant?
Not necessarily. Anthropic's July 2, 2026 note says low-risk dual-use and some benign requests may be blocked because of the safety margin. Add authorization, scope, and the defensive goal first. If the task still gets blocked, move to an internal process or trusted access path. Do not keep asking how to bypass the block.
Can I use Fable 5 for penetration testing?
Do not treat Fable 5 as a general penetration-testing automation tool. Anthropic's current target is to block high-risk dual-use requests, including penetration testing, red teaming, privilege escalation, lateral movement, and exploit development, until stronger trusted access controls exist.
Can I still use it for secure code review?
Yes, if you write it as a defensive task: provide authorized code and a known risk, then ask for impact explanation, remediation, tests, and human review points. Do not ask the model to generate payloads or automate exploitation.
Is CJS a formal standard?
No. Anthropic says CJS is still an early draft. For now, treat it as an internal triage language that helps security, legal, product, and research teams discuss how much real attack capability a jailbreak report unlocks.
How is this different from the Fable 5 overview?
The Fable 5 overview covers model capability, pricing, and access. This article covers a narrower task: how to write prompts, handle false blocks, and record jailbreak reports when using Fable 5 for defensive security work.